The PBX DHCP server is only capable of specifying its own address as the default IP gateway? Really? Are you sure? If such is the case, its DHCP functionality is, to put it politely, less than ideal.
If this is true, turn off the DHCP functionality in the PBX and configure DHCP on the TA900 for that subnet. You can use numbered options on the TA900 to specify the PBX IP (or hostname if using internal DNS) for TFTP and the like.
The phones don't learn their SIP server and registrar via DHCP. This information is either statically configured on each phone or extracted from a configuration file loaded at bootup. Where they get the file *may* be learned by DHCP. The file server IP can and almost certainly will be different than the default IP gateway.
Sequence:
Phone boots.
Phone gets IP, subnet, gateway, DNS, and the like via DHCP.
Phone gets IP address of a TFTP, FTP, HTTP, or HTTPS server either by DHCP (option 66 usually) or via manual setting stored on phone.
Phone contacts file server and downloads one or more files with configuration info such as SIP server, username, password, display info, etc. unique to phone, perhaps also generic file for all phones. Filename is usually based on phone MAC address.
Phone uses the content of these files to contact SIP server and register.
In summary, all DHCP needs to do is to provide the IP address of the file server (which is most likely the PBX) to the phone as a numbered option.
Let your IP router handle IP routing and IP services.
Let your PBX handle call processing and voice services.
Your network will be happier.
Your phones will be happier.
