Why do you need to test? If you restricted access to that hosted PBX, just open port 69 in vultr settings and if you use the PBX firewall make sure it’s allowed there as well.
I stayed up late working on this. Just got back on it
New scenario:
It is now provisioning using this profile rule:
tftp://fqdn.com/spa$MA.xml
However, there are 3 new issues
It does not provision instantly when you choose save, build and update phones - It takes its time. Could be 10 minutes could 30 minutes - No pattern here
After it does update the phone says “Checking DNS” for about 20 minutes before it reboots 100%
The username password to the phones http gui is unknown. I am assuming admin. In the global settings it is set to 222222 and that doesn’t work. I tried the ext password even though I knew that couldn’t be right. So once I provision the phone, wait 30 minutes for the update, wait another 30 for checking DNS, I can’t access the phone manually because it chose some other password.
So I went into the basefile for the spa508g in EPM and set dnserver NO. That stopped the 20 minute wait time of checking DNS
Password issue: I set my admin password in global settings to 222222. I can use that password directly on the phone but it does not work on the http gui.