I came up against this and worked out you need to add roles="*" in your web.sitemap file to any nodes with external urls, as by default security trimming removes any nodes with external urls.
eg: <siteMapNode title="my menu item" url="http://www.microsoft.com/" roles="*" description="description"/>
You don't want to disable security trimming or then all users will see the full menu even if there are items they don't have access to.