This took me a couple of hours to figure out tonight, after installing tftp-0.38-2.rpm in order to upgrade a Cisco PIX.

When permitting inbound tftp traffic in SuSEfirewall2 using YaST (either using YaST Control Centre --> Security and Users --> Firewall --> Reconfigure Firewall Settings --> [x] TFTP Server, or Network Services --> TFTP Server --> [x] Open Port in Firewall), the following change is made to /etc/sysconfig/SuSEfirewall2:

FW_SERVICES_EXT_TCP="ssh" (inbound ssh traffic already enabled in this example)

Is changed to:

FW_SERVICES_EXT_TCP="ssh tftp"

Which doesn't work of course. The reason? tftp uses UDP, not TCP.