All of the TFTP traffic bypasses the firewall via IPSec, along with all of the VoIP traffic. The remote DHCP servers are set to point to the PBX, but it only succeeds when pointed to the external IP. Perhaps the best next step would be to point at a different TFTP server, perhaps a windows-based one. If the problem persists, that’ll be a data point.