8945 IP Phone with AnyConnect?

[gmgarrian]

I have a client who would like to configure an ASA 5505 to terminate an AntConnect vpn initiated by an 8945 phone.  I can find a lot of docs on AnyConnect but few regarding this setup.  The ones I do find do not list the 8900 series as valid but they are for CUCM version 8.0.

Can anyone point me to updated info on AnyConnect for 8945 phones?

Thanks!

[clileikis]

Hi there,

You can see all of the phones that support the VPN feature using the following steps:

Supported Devices

You can use Cisco Unified Reporting to determine which Cisco Unified IP Phones support the VPN client. From Cisco Unified Reporting, click Unified CM Phone Feature List. For the Feature, choose Virtual Private Network Client from the pull-down menu. The system displays a list of products that support the feature.

For more information about using Cisco Unified Reporting, see the Cisco Unified Reporting Administration Guide.

From the following CUCM Security guide:  http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/security/8_0_2/secugd/secuvpn.html

HTH,

Chris

[gmgarrian]

I currently don't have access to the system to be able to follow those steps.  Is there a guide online somewhere that lists which phone firmware supports vpn?

[clileikis · Accepted solution]

Hi GM,

Here's a list from our 8.6 CUCM in the lab:

List Features

Product	Protocol	Feature	Parameters
Cisco 7942	SCCP	Virtual Private Network Client
Cisco 7945	SCCP	Virtual Private Network Client
Cisco 7962	SCCP	Virtual Private Network Client
Cisco 7965	SCCP	Virtual Private Network Client
Cisco 7975	SCCP	Virtual Private Network Client
Cisco 8961	SIP	Virtual Private Network Client
Cisco 9951	SIP	Virtual Private Network Client
Cisco 9971	SIP	Virtual Private Network Client
Cisco Cius	SIP	Virtual Private Network Client
Cisco Dual Mode for Android	SIP	Virtual Private Network Client
Cisco Dual Mode for iPhone	SIP	Virtual Private Network Client

HTH,

Chris

[gmgarrian]

Thanks! 

One follow up question since I'm not too familiar with AnyConnect.  The design is to have the IP phone at an end user's home initiate a vpn tunnel to the ASA, once established it should be able to register to the CUCM server.

With that list from CUCM, does that mean this setup won't work, or only that the tunnel can't terminate on the CUCM server itself?

[dlcharville]

Looks like as of version 9.3(2), the VPN client is supported on the following:

This feature is supported on the following Cisco Unified IP Phones (SIP):

• Cisco Unified IP Phone 8941
• Cisco Unified IP Phone 8945

The docs also state you do NOT need a device pack to enable this feature.  What I'm having a hard time figuring out is what version of CUCM do I need to be on to enable this feature.

Thanks,
Dan

[Ian Brennan]

Did you ever figure this out?  I'm on CUCM 8.6 and have my 9951's working on VPN just fine.  On my 8941/8945's I can't get the VPN application window to come up, under status there is a line saying "VPN not configured".  I do have everything configured in CUCM though.

It looks to me like it isn't supported on my CUCM version, even with the latest device pack.  I can't find any other Cisco Documentation on this either.

[jeremiah88]

Ian,

I am having exact same issue with 8945 and VPN option, were you ever able to resolve this? 

Thanks, JP

[Ian Brennan]

JP,

The issue I had is that CUCM 8.6 doesn't support VPN on the 8945/8941 phones, I think it was introduced in CUCM 9.  I know I eventually found documentation on this, but I can't locate it now.

You can use Cisco Unified Reporting to determine which Cisco Unified IP Phones support the VPN client. From Cisco Unified Reporting, click Unified CM Phone Feature List. For the Feature, choose Virtual Private Network Client from the pull-down menu. The system displays a list of products that support the feature.

[esa786_2]

Hi

Did you any body have info on the VPN option in Cisco phone 8941.

[jeremiah88]

Esa,

I was able to resolve the VPN issue by using SCCP firmware instead of SIP.  I simply used the newest SCCP firmware available, and the VPN option was there.  At the time, I could not get the SIP firmware to work, although this has been a while and they may have fixed it with an update.  I would try the latest SIP firmware first, and then if that does not work I would just use SCCP Protocol, and that should do the trick for you!

Good luck!

Jeremiah

[usman ali dar]

Hello ian Brennan,

can you help me out please for configurations of Cisco ip phone for vpn i am not good with CUCM just familar with some basics. need help to set up the authentications through Certiciation