The other thing to try is settings your SIP default transport type to TCP (on both VCS and CUCM SIP trunk security profile).
I have no idea why this works but I've had multiple CUCM to VCS problems fixed this way.
EDIT: also, try fiddling with the region bandwidth settings (make the bandwidth between regions higher or lower) on CUCM and also with the default and maximum call rate on the Tandberg stuff (try increasing and decreasing).
Lastly, you could try registering the TANDBERG stuff to CUCM? I know that's not a permanent solution but it will help you isolate the problem.
In that case, maybe it's actually worth trying an H323 call from the TANDBERG endpoint?
We recently had an issue (not using encryption) where CUCM to an old version of VCS only worked when interworking from SIP to H323 - calling direct SIP to SIP didn't work (we fixed this by upgrading however).
What s about The Trunk configuration on The VCS? Did you Chose The cucm or custom in the Zone config? I Think The video Codec negociation fails. Which encryption mode do you have on Tanberg. I think, this Should be bestEffort.
Are you getting this error “Installer User Interface Mode Not Supported. The installer cannot run in this UI mode. To specify the interface mode, use the -i command-line option, followed by the UI mode identifier. The value UI mode identifiers...
The below trick might come handy when you have to add a new node to a cluster but you don't have or is unsure of the security password for the publisher. This procedure has been around for ages.
1) Login into the CLI of the Publisher.