Connecting a 7841 to CUCM through a Fortinet Firewall

[drobison]

Hello,

I have been tasked with configuring a Cisco 7841 IP Phone to be able to connect to our Call Manager from any network, utilizing our Fortinet 200E Firewalls.

The idea is the ability to plug this 7841 to any internet connected network and have it self configure and talk back to our Call Manger via TFTP to get its configuration. The phones are currently configured with MRA but as that does not support Extension Mobility the change to a direct connection was requested.

I have a few questions I need answered before I can procede with this.

Notably, will I require the MPP version of the firmware to accomplish a connection like this?

Also, will I need to open the Call manager to a public IP that I program into the Phone's TFTP settings?

Will the phone need to be configured with a static IP or can it be left in DHCP with the Alternate TFTP option set to the public IP of the Call Manager?

I have been rather unsuccessful in finding any information on these specific connection requirements in searches on these forums and Google, and was hoping to get a little more information.

Thanks,

Dustin

[Jaime Valencia · Accepted solution]

■ CSCvd68778 is resolved in this release, which means that Extension Mobility works via MRA for those Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series phones that support MRA.

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/release_note/Cisco-Expressway-Release-Note-X8-10-4.pdf

[drobison]

That is good to know! Thank you for informing me of this.

Unfortunately I am required to find another solution, because they do not want the user to have to input any credentials into the phone as is required by MRA. They would like the phone to configure itself via TFTP. Am I correct in thinking the 7841 does not have a built in VPN? 

In this thread Nipun asks "On CUCM, go to Unified Reporting >> Unified CM Phone Feature List. Do you see 78XX listed under Phone-vpn feature ?"

I did not see any VPN entries under the 7841. But when you reset the Service Mode on a 7841 it warns the process will deactivate any VPNs that are configured, is this a mistake or can you actually configure a VPN in a 7841?

[Jaime Valencia · Accepted solution]

User Credentials Persist for Expressway Sign in

Disabled Enabled

Disabled

Controls if the phone stores the user's sign-in credentials. When disabled, the user always sees the prompt to sign into the Expressway server for Mobile and Remote Access (MRA). If you would like to make it easier for users to log in, you enable this field so that the Expressway login credentials are persistent. The user then only has to enter their login credentials the first time. Any time after that (when the phone is powered on off-premise), the login information is prepopulated on the Sign-in screen.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7800-series/english/admin-guide/pa2d_b_7800-series-admin-guide-cucm/pa2d_b_7800-series-admin-guide-cucm_chapter_01011.html

[drobison]

Updating the Expressways and using Persistent Credentials fixed my issue!

Thank you so much!