Solved

CIsoc IP Phone Using AnyConnect VPN Client on ASA

Posted on 2011-02-27
8
1,393 Views
Last Modified: 2012-05-11
Hello
I wonder if somebody was successful in configuring Anyconnect VPN Client on Cisco ASA in order to facilitate connections from remote Cisco IP Phones to Call Manager cluster. The solution is so purely explained on Cisco website. I spent few days already trying to make it work but I'm not getting anywhere.  Even CallManager configuration is not clear either. Thanks for help.
Pchopin
0
Comment
Question by:pchopin
8 Comments
 
LVL 1

Assisted Solution

by:orbistechnology
orbistechnology earned 125 total points
ID: 34993772
What model Cisco phone are you using?  

Anyconnect is SSL-based VPN.  Using self-signed certificates often causes us problems.  We always use a certificate from a CA and install it on the ASA.  

We have anyconnect setup per instructions from Cisco and have no issues with current model Cisco phones, using a well-known CA certificate on the ASA.
0
 

Author Comment

by:pchopin
ID: 34993851
I'm using Cisco IP Phones 7965 with firmware v9 and Call Manger v8. I'm kind new to VoIP so I'm struggling a bit.  Would you know where I can fine working configuration for ASA using CA? I've been trying to use self-signed certificate till now.
Thank you for help
Pchopin
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 375 total points
ID: 34997442
I've set this up for 2 clients.     As orbs said, you will need a CA Cert for the ASA.  
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808b3cff.shtml

Once the ASA is loaded, you will need to export the .pem for both the CA authority and the Asa cert.    These 2 pem files are uploaded to the call manager as Trusted-Phone-Cert in CM Servicability.

On the ASA, you create a new VPN profile for the phones.   Configure ip pool and auth.  The important part is setting a Group URL in the Profile's Clientless SSL section.    This URL will be used in call manager config.  

On the call manager side, you create a new Phone Profile.  Make sure the certs are loaded in CM.   Create a VPN gateway In here you add the group URL form the ASA, and also pick the 2 trusted phone certs you uploaded earlier.    Next you create a new VPN group and create a common device profile.   In the device profile, make sure to fill in the VPN Group and VPN profile you created earlier.  

Assign a phone to that new profile.

On the phone, clear the itl entry and reset.   The phone should get the ITL and CTL.   Take it outside the LAN and enable VPN.   It should prompt for ID/PW and establish a connection.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 33

Accepted Solution

by:
MikeKane earned 375 total points
ID: 34997451
HERe's more info:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/admin/configuration/guide/cmevpn.html

Also, you will need the VPN phone lic. on the ASA for this to work.  
0
 

Author Comment

by:pchopin
ID: 35002197
Thanks MikeKane. This very helpful. But I just wonder why I would need 3-rd paryt certificate?  Why can't I use self-signed certificate from ASA?  This is not clear to me.
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 375 total points
ID: 35007892
The Intermediary cert must be installed and trusted by the CUCM if it isn't already.    I'm sure that using a self signed cert can be done, but I have never done one that way so I can't give any practical advice/direction.    However, like any cert, the CM must trust the issuer of the ASA cert and have a PEM file to load up as a trust-vpn-phone cert in Serviceability on the CM.  

0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37049239
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Imagine a situation that you have installed SSL (http://en.wikipedia.org/wiki/Secure_Sockets_Layer) Certificate on your Cisco ASA (Cisco Adaptive Security Appliance) firewall. Installation of SSL certificate on ASA is an another topic for which you …
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now