Help configuring ASA for IP Phone VPN with AnyConnect

[kdotten36]

I have plenty of CUCM experience but no ASA experience whatsoever.  Can anyone assist with getting the IP Phone VPN to work?

This isn't a random stab, I've already tried and failed three times, using the following articles as a step-by-step guide and toting my phone back and forth from home to work.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/8_5_1/secugd/sec-851-cm/secuvpn.html

https://supportforums.cisco.com/comment/reply/12049476%23comment-form

and

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html

Unfortunately, practically every guide says "It's super easy as long as your ASA is already configured for it".  Woops. 

The following article looked promising until I noticed it was 3 major release versions behind my ASA rending it irrelevant.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70511-sslvpnclient-asa.html

CUCM 9.1.2 and ASA 9.1(1)

Any guidance would be greatly appreciated.

[johnd2310]

Hi,

What errors do you see on the ASA logs? Can you see any connection attempts from the phone? Does the asa have all the licences to support phone vpn?

John

[kdotten36]

We are licensed for it.  Screenshot attached.  Unfortunately, I don't know what to look for in the logs.  Is there a debug I can run?  The phone doesn't seem to be reaching the ASA, I'm not getting any sort of rejection message, just spins at Configuring IP.

[mark.watson]

I had this same thing happen to me.  I too have vast CUCM experience but no VPN.  I did get the anyconnect VPN to work with a client but my phone would just spin on "configuring IP" and nothing would happen on the ASA.

I did not realize that you had to enable the VPN on the phone itself under Settings - Security Configuration.  Once I did that it started talking to the ASA.

[kdotten36]

I'm unable to enable VPN on the phone.  It's greyed out, even with the settings unlocked.  Any other ideas?

[johnd2310]

Hi,

Is the 'Common Phone Profile' configure and applied to the phone?

Thanks

John

[kdotten36]

yes