OK - for anyone else that might need to do this, here’s how I ended up getting this done - at least for now.
- In EPM cloned a template from one of my templates for local SPA509G phones.
- Adjusted the “Destination Address” to the outside IP of the FreePBX system.
- Set the Provision Server to be a PC at the local site.
- Use the Extension Mapping to create an entry for phone with the MAC address of the remote phone.
- Downloaded the following files/folders from the /tftpboot folder on the FreePBX server:
- spa.xml
- SPA509G.cfg
- cisco
- Placed the download files in folder c:\tftpboot on a computer at the remote office - e.g. with IP address 192.168.1.32.
- Installed tftpd32/64 on the PC and set it to just run the tftp server service, using the c:\tftpboot folder.
- Reset the Cisco SPA509G to factory defaults.
- Used the web interface on the SPA509G to set the “Profile Rule” on the Provisioning tab to “tftp://192.168.1.32/spa$MA.xml” - pretty much as you’d expect from the EPM instructions for this model phone.
- Rebooted the phone and watched it upgrade firmware and provision. It works.
For the remote offices that have static IPs I might try provisioning using HTTPS instead of TFTP. That would eliminate the manual copying of the xml files when updates occur. Not sure it’s worth the trouble though. We would need to open port 443 and add firewall rules that only allowed the remote office IP’s access.
For a half dozen phones or less that can’t do VPN this seems doable.