any cheat sheets or docs on installing remote VPN 96xx telephone

Question

any cheat sheets or docs on installing remote VPN 96xx telephone

Z-man (IS/IT--Management)

(OP)

26 Jul 19 22:01

I am looking for any assistance, docs, cheat sheets etc that might help me install a remote 96xxG telephone to a customer network using the in-phone VPN. ? The firewall appliance is a Cisco 5506 ASA.

No issues connecting a laptop using the Cisco Anywhere client. I guess I should ask if it can use the same user login as a remote user? or does something need to be different? Also, what about making sure certain firewall ports are open?

Thanks for the help.

Z

aarondyck (TechnicalUser) · Answer 1 · 2019-07-26 22:05:35

Start here: https://downloads.avaya.com/css/P8/documents/10100...

It's an older document but it should show you want you need to do.

I also found this: https://downloads.avaya.com/css/P8/documents/10009...

It's for the Cisco 5510, but I would imagine there aren't a lot of differences.

http://www.adventuresinvoip.ca/

Z-man (IS/IT--Management) · Answer 2 · 2019-08-06 17:40:18

So it appears to be trying to establish a VPN tunnel, but fails.

The error I get is IKE Phase 1 no response.

Can anyone tell me if I can use the spelled out DNS name of the VPN Tunnel? Or do I need to list the actual physical IP address?

And just to clarify that I shouldn't need any settings on the IP office other than sitting up the user?

derfloh (TechnicalUser) · Answer 3 · 2019-08-06 17:52:07

You can also use a FQDN as long as the phone has a DNS Server configured. No response in phase 1 usually means that the VPN gateway doesn't answer.

Need some help with IP Office? https://www.fwilke.com/home
CLI based cale blocking: https://blog.fwilke.com/ip-office-block-calls-from...
SCN fallback over PSTN: https://blog.fwilke.com/ip-office-scn-fallback/

Z-man (IS/IT--Management) · Answer 4 · 2019-08-06 18:07:59

I have the DNS set to 75.75.75.75 does this work?

Also, if the VPN Gateway doesn't answer, then perhaps they are missing something on their end? Opening up a port on the Gateway?

derfloh (TechnicalUser) · Answer 5 · 2019-08-06 18:16:25

If 75.75.75.75 is a DNS that can resolve the FQDN... Perhaps the phone doesn't get a valid default gateway to reach the public network.

Need some help with IP Office? https://www.fwilke.com/home
CLI based cale blocking: https://blog.fwilke.com/ip-office-block-calls-from...
SCN fallback over PSTN: https://blog.fwilke.com/ip-office-scn-fallback/

AlfonsoSF (Vendor) · Answer 6 · 2019-08-08 09:00:59

If you have dynamic IP address or two or more WAN at the IPO site, you can use dynamic DNS.
You can set it up at the phone with no problem.

I can send you prodedure for Sonicwall firewalls.

jayjr1105 (IS/IT--Management) · Answer 7 · 2019-08-09 17:06:58

Does the client not already have a site to site vpn between firewalls setup? That's how we've always setup remote phones. Never did the phone VPN thing.

Z-man (IS/IT--Management) · Answer 8 · 2019-08-12 04:12:36

this is a single user at a remote site. Using remote desktop on the laptop to connect. We are just trying to connect the phone.

aarondyck (TechnicalUser) · Answer 9 · 2019-08-12 15:14:45

I've always used the public IP of my ASA, and not an FQDN. Try that - if we take away DNS as an issue and still have problems then you can start looking at the next steps.

Right now your VPN server isn't answering the initial request. Once you get over that issue you'll be well on your way.

One word of advice - create a VPN user for the phone with no password expiry. You don't want to have to walk the user through changing the VPN password on the phone every time they change their password.

http://www.adventuresinvoip.ca/

Z-man (IS/IT--Management) · Answer 10 · 2019-08-14 04:36:59

an update. We seem to have gotten the phone to connect through the VPN. It was a matter of making sure all the settings on the VPN matched the settings on the phone. I was lucky to have a tech person who knew the Cisco quite well.

We still have not gotten the phone fully operational.

We can establish the tunnel, exchange keys, and I can even see a couple of txt files being download from the call server. It sees the call server and even contacts it. I can get to the field where is asks for extension number and password, which I enter. Then it seems to almost instantly time out and the screen goes to "discover 10.1.4.1" (IP address of IP Office). its almost like it can see the call server and connect, but its not getting any response from the call server.

One thing to note. The IP Office is at version 9.1 and this is a brand new phone, so I assume its probably at version 10 or higher. Could this be causing an issue? I might go onsite and just do a firmware update locally.

Westi (Programmer) · Answer 11 · 2019-08-14 05:24:28

make sure that the Cisco doesn't try to "improve" the h.323 with some voice settings in the firewall.
Cisco is famous for that because they tweak their own voice products but that sometimes breaks the Avaya stuff.
SIP ALG also off just in case

Joe W.

FHandw, ACSS (SME)

"This is the end of the world, make sure to buy your T-shirt before it is too late"
Original expression of my daughter

Come Join Us!

Posting Guidelines

Jobs

any cheat sheets or docs on installing remote VPN 96xx telephone