Thanks for the rapid reply.  Worked like a champ. ... View more

Hello Ohamien, Any chance that you could post the fix for bypassing PAB to get to Fast Dials? Thanks, Kevin ... View more

Thanks much for your reply.  I did get the URL to finally launch...It was the Connection protocol to CallManager that had it snafu'd.  We had turned off HTTPS access a while ago and the default protocol on the .asp page is HTTPS.  Change it to HTTP and it launched.  Everything else is pretty straight forward and the display doesn't look to bad using the default Cisco layout where it scrapes the DN's off the Phone configuration page and adds themm to the Image...Just keep in mind that you need to create a seperate .asp page for each possible phone button template applied to the device so that the appropriate number of DN's get populated.  This will require that the Idle URL entry be specific per device, per phone button template... ... View more

The ID Payload was sending the Address of the WAN port that is using DHCP. Does the SW need to know the Identity of the 871 Router? If so, I would think that using the Hostname would be preferred, since that would never change... ... View more

No joy! I cannot confirm 100% that the SW is configured as you suggested since I am not allowed to touch it. Looks like Phase 1 is not completing now, since the router is doing a lot of "retransmitting phase 1 MM_KEY_EXCHANGE" messages... ... View more

Thanks much for your reply. I will try this out and will repost the results... ... View more

The SW guy said that to run in Main Mode, he had to build the Tunnels with a Peer IP Address and we won't have a "static" ip at the 871 end... ... View more

We have switched the Sonicwall to Main Mode, set the IP to what my 871 hits the Internet with and Phase 1 and Phase 2 complete. We can't do this in production since the production site does not have any Static, Public IP's... ... View more

In the "Dynamic" mode, the Sonicwall won't complete phase 1 do to the failure in setting up as Aggressive mode. According to the gent working on the Sonicwall end, there was no way to configure a "source network", but only a Destination Network... ... View more

OK. Here's my config, do you see anything wrong with it? If not, I don't think that I am getting good assistance on the Sonicwall... dot11 syslog ip cef no ip dhcp use vrf connected ip dhcp excluded-address 192.168.97.1 192.168.97.200 ip dhcp excluded-address 192.168.197.1 192.168.197.200 ! ip dhcp pool DATA network 192.168.97.0 255.255.255.0 default-router 192.168.97.1 dns-server 192.168.1.5 192.168.1.6 domain-name cvistl.com ! ip dhcp pool VOICE network 192.168.197.0 255.255.255.0 default-router 192.168.197.1 dns-server 192.168.1.5 192.168.1.6 option 150 ip 192.168.101.5 domain-name cvistl.com ! ! ip domain name cvistl.com ! ! ! ! ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 crypto isakmp key Interior2009 address 63.252.122.130 crypto isakmp keepalive 10 ! ! crypto ipsec transform-set CVI_VPN_SET esp-3des esp-sha-hmac ! crypto map CVI_VPN 10 ipsec-isakmp set peer 63.252.122.130 set transform-set CVI_VPN_SET match address 110 ! archive log config hidekeys ! ! ip tcp synwait-time 10 ! class-map match-any VoIP-Control match ip precedence 3 class-map match-any VoIP-RTP match ip precedence 5 ! ! policy-map WAN-QOS-POLICY class VoIP-RTP priority percent 40 class VoIP-Control bandwidth percent 25 class class-default fair-queue ! ! ! ! interface FastEthernet0 switchport voice vlan 2 spanning-tree portfast ! interface FastEthernet1 switchport voice vlan 2 spanning-tree portfast ! interface FastEthernet2 switchport voice vlan 2 spanning-tree portfast ! interface FastEthernet3 switchport voice vlan 2 spanning-tree portfast ! interface FastEthernet4 description WAN Interface bandwidth 500 ip address dhcp no ip redirects no ip unreachables no ip proxy-arp ip mtu 1350 ip route-cache flow duplex auto speed auto no cdp enable crypto map CVI_VPN service-policy output WAN-QOS-POLICY ! interface Vlan1 description DATA VLAN ip address 192.168.97.1 255.255.255.0 ! interface Vlan2 description VOICE VLAN ip address 192.168.197.1 255.255.255.0 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 FastEthernet4 ! no ip http server ip http authentication local no ip http secure-server ip http timeout-policy idle 5 life 86400 requests 10000 ! access-list 23 permit 192.168.0.0 0.0.255.255 access-list 102 permit udp host 63.252.122.130 any eq 10000 access-list 102 permit udp host 63.252.122.130 any eq non500-isakmp access-list 102 permit udp host 63.252.122.130 any eq isakmp access-list 102 permit esp host 63.252.122.130 any access-list 102 permit ahp host 63.252.122.130 any access-list 102 permit icmp any any echo-reply access-list 102 permit icmp any any time-exceeded access-list 102 permit icmp any any unreachable access-list 102 deny ip 10.0.0.0 0.255.255.255 any access-list 102 deny ip 172.16.0.0 0.15.255.255 any access-list 102 deny ip 192.168.0.0 0.0.255.255 any access-list 102 deny ip 127.0.0.0 0.255.255.255 any access-list 102 deny ip host 255.255.255.255 any access-list 102 deny ip any any log access-list 110 permit ip 192.168.97.0 0.0.0.255 any access-list 110 permit ip 192.168.197.0 0.0.0.255 any ! ! ! control-plane ! ! line con 0 exec-timeout 60 0 logging synchronous no modem enable line aux 0 line vty 0 4 access-class 23 in exec-timeout 60 0 logging synchronous no login ! scheduler max-task-time 5000 ntp server 192.168.101.2 end GW-871-ROB_K-01# ... View more

First question on my response...Should the initial design actually work (Sonicwall in Aggressive Mode and router with "standard" IPSEC config and using DHCP for the WAN)? My Sonicwall rep says that the Cisco router will not run in Aggressive Mode unless there is a Static IP Assigned to the WAN and is referenced in the ISAKMP PEER to set aggressive mode.... Funny thing is that the Sonicwall will not run Main Mode unless a peer Address is entered into the configuration page... My debugs look fine as the router is building the ISAKMP connection. The failure is at the Sonicwall that won't dynamically switch to Main Mode. If we switch the Sonicwall to Main Mode, use the PAT address of my Firewall (which is where the router is getting sent to the internet and something that I can't do in production), and take out the Aggressive-mode stuff from the router, the Tunnel comes all the way up except for no receive decrypted packets... ... View more

I am connecting to the Sonicwall's Static IP. The router is set for DHCP. Since I don't have a static IP for the Router, I'm assuming that I cannot use Aggressive Mode, since the "crypto isakmp peer X.X.X.X" command is looking for my Routers static IP... ... View more

Hi. I am trying to get a Cisco 871 to VPN connect to a Sonicwall and we are failing Phase 1. The router is using DHCP on the WAN. The Sonicwall is static. The router will not start Agressive Mode, which appears to be a problem at the Sonicwall. Any thoughts on what to check on the Sonicwall and the router would be greatly appreciated... ... View more

I got this same message when my authentication failed with AD. Since my Web Server was not on the Domain I had to change the UserID to: (this is an example) access @domain.com ... View more