UC540 vpnserver <-IPsec VPN->ASA5505 vpnclient+SPA303g3

[Fco. Javier Sanchez Ropero]

Hi,

I've just setup and UC540 at main office (SITE A) and a ASA5505 in a remote site (SITA B).

I've just setup properly IPsec VPN, where UC540 is working as a server VPN and  SA5505 as cliente VPN both of them in EZVPN_GROUP_1 group.

Ping between networks in Site A from Site B is OK in both Vlans 1 (data) and Vlan100 (voice).

Cisco IP Comunicator (Softphone) in Site B is working fine as an extesion from UC540.

But I have a Cisco SPA303G2 phone, also behind the ASA5505 in Site B, and it is not working properly. The display is always showing "initializingNetwork".

I'd tried to register manually the  MAC of the SPA303g2 in UC540 but is not working.

I will apreciate any help...

Regards,

[Alexander Maroukian]

Hello Javier,

Please check if the phone is getting ip address.

It seems that it could not find its vlan.

HTH,

Alex

*Please rate helpful posts

[Fco. Javier Sanchez Ropero]

Hi Alexander,

You are right, the phone is not getting ip address despite network settings is like a DHCP client and Vlans not enabled.

You are right, the phone is not getting ip address despite network settings is like a DHCP client and Vlans not enabled.

Do you have any guide or document where could I check the right configuration in order to assign a static IP from my Lan network ??

Thanks in advanced.

[Alexander Maroukian · Accepted solution]

Hello Javier,

Please check the admin guide for SPA3xx phones.

http://www.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/administration/guide/spa500_admin.pdf

Also when you are in the menu and press **# under the network settings menu you can enter specific ip address from the network on the remote site so that the phone will be working properly and connect to the UC.

You should enable the alternate TFTP and point to the tftp of the UC which by default is 10.1.10.2.

HTH,

Alex

*Please rate helpful posts

[Fco. Javier Sanchez Ropero]

Hi Alex,

In the ASA I've modified inspect options in order to allow tftp, but now the phone is trying to download files via TFTP and It's not working fine.

The files are:

XMLDefault303.cnf.xml

This is the conf of the ASA:

dhcpd dns 8.8.8.8

dhcpd auto_config outside

dhcpd option 150 ip 10.1.1.1 10.1.10.2

dhcpd option 3 ip 192.168.20.200

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect icmp

  inspect tftp

ciscoasa(config)# ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Any idea ??

[JOHN NIKOLATOS · Accepted solution]

Javier, If you have a site to site the issue isn't TFTP is being blocked.  THe issue is the phone is looking on the wrong VLAN for DHCP and its settings (like option 150).  Have you reset the phone to defaults..  Is this is used phone where you plugged it in somewhere else?  Usually on the 7900 series I have to initiate a factory reset to get the setting blank because it is trying to contact the DHCP and TFTP server from wrong addresses.. 

John NIkolatos

www.niktek.com

[Fco. Javier Sanchez Ropero]

Also in the phone, after press **# under Network settings, Edit option to TFTP server 1 is disable...

[Fco. Javier Sanchez Ropero]

Resolved !!

Thanks everyone !!

Now is working fine...!