UC520/Fortinet, remote office setup

[compenviron]

Hi,

I`m very new to cisco products, and I`m having trouble setting up the 7940 phones in our remote offices.

In our main offices, I setup a UC520 and five 7940 phones, which are all working great. The uc520 is behind a fortinet firewall.

In our remote office, there is the same fortinet firewall, and a VPN tunnel is created between them. our main office has the ip address of 192.168.0.XX, and the remote office has 192.168.9.xx, thru the vpn tunnel the computers can access the server in our main office.

The phones in our main office has ip addresses of 10.1.1.xx, and the DHCP Server, TFTP server are both 10.1.1.1.

I tried to set the 7940`s IP address in the remote office  to 192.168.0.xx, or to 192.168.9.xx, or to 10.1.1.xx, all to no available.

The phone seems to be stuck at "configuring cm list" everytime.

What should I do to make the remote phone working?

I used CCA to setup the uc520 and never tried CLI.

Thanks!

[paolo bevilacqua]

In the remote office, you need to setup option 150 in DHCP server, or manually in each phones, with Uc500 IP address.

[compenviron]

How do I setup the option 150? I checked my phone and it only has options up to 58? and for manual setting, I just need to put the DHCP server of the remote phone as the UC520`s IP address? (which is 192.168.0.55 here.)

thanks

[paolo bevilacqua]

In DHCP server config. You can refer to its documentation or search the web, etc.

[compenviron]

anyone has ideas?

The uc520 is in the main office with the IP address of 192.168.0.55. I can ping it or see it from the main office. The problem is I can`t see it or ping it when I am at the remote office, but I can see other laptops or server from the remote office.

What should I do to allow ping to the uc520 from remote office? how to resolve this problem?

[johschaf]

Hello,

Do you have a static default route on the UC pointing to the local fortinet for VPN/Web access? You need to do that so the UC has a gateway to route the traffic back to.

How do you have the VPNs configured on the fortinet? You need to allow the voice vlan and CUE vlan in the VPN configuration.

Hope this helps.

Thanks,

-john

[compenviron]

Hi John,

Thanks for replying. How to set the default route? I tried to add a static routing in the CCA, I tried to put the destination IP as the outside/inside IP of the remote office gateway, netmask as 255.255.255.0, gateway IP of main office gateway(192.168.0.99), but CCA said it was not a valid entry.

how do I set that?

Thanks,

Peter

[johschaf]

Hello,

The static default route should look like: 0.0.0.0 0.0.0.0 192.168.0.99

Destination: 0.0.0.0

Netmask: 0.0.0.0

Gateway: 192.168.0.99 <- I'm assuming this is the local IP of the Fortinet at the main site.

Thanks,

-john

[compenviron]

Hi John,

I tried your setup, but the CCA  does not allow me to set the netmask as 0.0.0.0, there is a drop down list, from where I can choose a netmask, which includes(128.0.0.0, 192.0.0.0, etc), can`t put 0.0.0.0 myself.

Also in our fortinet VPN configuration page, I don`t see any options to allow voice Vlan and data Vlan?

thanks,

Peter

[johschaf]

Hello,

If you can't add the static default route then you probably already have one defined, and you can only have one static default route. Do you see another static default route?

You will need to permit access on the VPN to the voice and CUE networks for the remote phones to register. I couldn't tell you how to configure the Fortinet to allow that though.

Thanks,

-john

[compenviron]

Yes there is one already defined, destination 0.0.0.0, netmask 0.0.0.0, but it is not showing the gateway IP though. Do I need to delete this one and create a new one to fill in the gateway IP?

also there is another static routing 10.1.10.1, netmask 255.255.255.0, not showing gateway IP either.

I think the VPN is configured to allow any traffic thru the VPN tunnel. But for the voice network, since it is in 10.0.0.x network, how do I allow it into the 192.168.0.x network?

As for CUE network, is it data Vlan that you are referring to?

Thanks,

Peter

[johschaf]

Hello,

Can you post from the CLI what your IP route statements are? CCA might be having an issue reading your CLI configuration. There should be a route to the CUE module in the routing, so that seems normal except that you are missing the gateway.

If I read your original post correctly, the voice network should be 10.1.1.x. Whatever your voice network is, you need to make sure that if the UC is not your default gateway, that there is a route to that network on your default gateway.

The CUE network(voicemail) is separate from the voice and data networks. The default network for CUE is 10.1.10.0 mask 255.255.255.252

Thanks,

-john

[compenviron]

I`m very new to cisco products and I`m limited on support locally. I don`t know how to use the CLI, or how to perform the action you mentioned. Do you mind giving me the instructions?

The voice network is indeed 10.1.1.x, my bad on the 10.0.0.x.

[johschaf]

Hello,

In CCA go to Troubleshoot -> IOS Exec Commands

The default command should be show running-config. Click the run button to generate the output from that command. In the search box search for "ip route"

Copy and paste all of your ip route commands here.

Thanks,

-john

[compenviron]

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route 10.1.10.1 255.255.255.255 Integrated-Service-Engine0/0

That`s all IP routes I have...