If your using the distro and it’s built in firewall you need to add that remote sites ip address to the trusted network list before provisioning will work.
TFTP provisioning only worked for me when I was on the same subnet that the server was on. If on a different subnet I had to use http provisioning. I guess I could have changed it all to http but I’m now deployed so it’s not a big deal to me.