SSL VPN for 8800 phones

[tato386]

I have this working for 7900 and 9900 series phones but 8800 is a  no go.  The working phones are using a LSC and CAPF cert on the ASA and connect well.  I tried adding Cisco manufacturing certs from CUCM to ASA but didn't have any effect.  I have also read about disabling MRA but don't know where to do that.  Anything else that 8800 phones need that others don't?

Thanks,

Diego

[balaji.bandi]

what is the version running in 8800 phones.

have you looked any settings you missing ( i know you mentioned all working old phones).

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html

[tato386]

I was running 11.7 at first then upgraded to 12.1 but no change. I noticed the doc only shows 8861. I have 8841 and 8851. 

[tato386 · Accepted solution]

Problem fixed by disabling DTLS for the phone VPN group policy.

[balaji.bandi]

Glad that it all working as expected.

[SiobhanSaragusa]

I wanted to add, there is a Cisco bug CSCvn43335 related to this.  In summary, if the TLSv1.2 GCM ciphers are enabled in an ASA, the 8800 series phones will make a Parent Connection with them, and then the DTLS connection will fail to negotiate.  You can work around this one of two ways:  disable DTLS in group-policy PhoneVpnGroup attributes->webvpn->anyconnect ssl dtls none, or remove the GCM ciphers from the global ssl cipher tlsv1.2 custom "list:of:ciphers:without:gcm:here".

Also, I hope those at Cisco get around to resolving this. It's incredibly inconvenient to be charged with either lowering security across the board for all AnyConnect sessions in a given ASA, or disabling DTLS for phones which makes calls sound awful when there is the slightest bit of latency.