Unless you have a valid need to. That's correct. By doing so, you're just adding extra, and unneeded complexity. Don't go out of your way to make things hard for yourself.
Again, something crazy is configured on the machine to make it need this. I don't know what you've done to make it, and I - honestly - can't even imagine why this would be happening.
That's a symptom of your other problems. It's a handy one as it's simple to check.
Uh? That's the standard for RTP ports. It's not like it's something unusual. I mean, it's not like it's a requirement, and the odds are things will work perfectly if you change it, but there's no need to change it.
Then that IT security person is making a pretty fundamental mistake. The entire point of having such a large pool of ports is to make the rtp ports more random. By limiting the range, you're making it less random. Ignore anyone who says that. They're wrong. In fact, they're fractally wrong -- the closer you look at it, the more incorrect it is. It's wrong all the way down.
As I said at the start, it's not Asterisk. Asterisk works. I did suggest you try a different type of phone, how did you go with that?
But I would have thought you spending 10 minutes to quickly deploy a new machine to prove me wrong would have been a easy thing to do, too 