Hello Daniel,
someone should add a floating static route on the router where the tftp server is connected or an ACL needs to be modified to add permission for tftp/http traffic.
Have you got another DSL link on the site where the CUCM is located or are you trying to use an IPSec VPN over the internet ?
You need to investigate the configuration on the CUCM site but you are pointing on the right direction.
Hope to help
Giuseppe