I just upgraded our UC520/32U to 8.1.0 and bought a few SPA525G's to use as our teleworker phones. I've got the SSL piece up and running and the phones come up just as they should in the remote locations. Everything seems to be working just fine. BUT, the remote phones seem to be acting "flakey" every so often. Here are some issues I've run into this week:
Has only had a lot of experience with these phones using the SSL VPN client? I can alway fall back to doing IPSEC tunnels for most of the users, but that just doesn't seem smart.
Last piece of info...phones are running the load that came with 8.1.0 which is 7.4.6.
Any help will be greatly appreciated!
Thanks in advance!!
Thanks for the feedback. I have to say that I personally use a SPA525G2 permanently connected via VPN to a UC500 (SPA525G2 from Madrid, Spain to UC500 in San Jose, USA) and have not experienced the issues you mention with one exception, issues when bandwidth is not sufficient. When bandwidth is not good, voice quality is definitively affected but also the VPN connectivity itself.
Do you have the autoconnect feature enabled? I assume yes. If you think bandwidth is not an issue, I suggest you open a case with the Support Center in order to troubleshoot it live.
I don't have the G2 version, but rather the G version. I find it hard to believe that this isn't a widespread issue...unless the number of people using these phones aren't using the SSL VPN feature.
I do have the autoconnect feature turned on.
As fas as bandwidth, we are all on the same cable provider (Comcast) and, like I said, when I was letting the 871's do IPSEC tunnels back to the UC500, everything we just find...which leads me to believe that it's not a connectivity or bandwidth issue.
You're not alone. I've been working with Cisco support techs for a long time about this issue. I don't know if it's because our phones are the spa525g and not spa525g2, but it's definitely flakey in terms of maintaining its connectivity. We were able to fix most issues with call quality but definitely it's still giving us call drop issues. Make sure you have the latest firmware 7.4.7 and also the latest CCA. Another thing we did was enable "dtls". I don't have time to go into it but supposedly it allows the phone to work better by using UDP packets (I think). If you don't have a Cisco support contract, I can paste up some configuration steps for you to try out.
Thanks for the reply! It reassuring to know that I'm not the only one having this issue. I'm running 7.4.6 rather than 7.4.7. Did you actually see any significant improvements from 7.4.6 to 7.4.7? I did configure everything with CCA 3.
I do have a support contract, but I'd almost rather gargle broken glass than use it for support. I spent three hours one night letting a guy remote in and muck with a VPN that was up and down. The tunnel was flakey unless I turned off cef on the remote end. I wanted someone to telll me why I had three other remotes configured the same as this one and they worked fine...so what was wrong with this ONE?! After three hours, I ended the call and disconnected him from my laptop. I haven't called back since. I've also had two customers try to call TAC for issues and say they refuse to call them again. :-)
I've not seen anything on the dtls that you're talking about. If you could post a little config, that would be great!!
See below on the changes we made. As of today, I'm still having issues with the spa525g phone booting up and connecting right away. It takes a few minutes and sometimes it requires me to do a "reload" in CME for it to work. This is very frustrating, especially if one of these phones is supposed to go to the owner of the company and he expects it to work.
ip access-group 104 in
policy group SDM_WEBVPN_POLICY_1
svc address-pool "SDM_WEBVPN_POOL_1"
aaa authentication list sdm_vpn_xauth_ml_1
access-list 104 permit udp any host (your_WAN_IP_address_here) eq 443
Thanks, Renato! I enabled dtls and can see the matches in my access list.
I'll see if that AND the upgrade to 7.4.7 helps out any!!
Oh yeah...when I rebooted my remote phone...twice...the soft buttons don't show up. I've got to go into CME and restart the phone to get the buttons to appear. Must be a new "feature"...like Microsoft!! :^)
I have seen the button missing issue as well. On my lab system, some times I can not see the softkeys, but if i press it, it works, just the name is not displayed. So you have to remember what the button is. Seems to have happened when I was testing the 7.4.6 Mute Beep issue and upgraded to 7.4.7.
Do you know of a way to clear out the SSL VPN connections? The phone I'm testing on is connected to the VPN but it's not registering. I did get it to work at one point but now it seems that a "reload" in the CME is the only thing I can think of doing.
I have had lots of problems with this with multiple versions on a few customers. The BU is looking into it still. If you are having problems, I would open a TAC case and escalate to the BU, and they might want to test with your system for a while. Cisco has been working with one of my customers for a month now with trying different versions and settings.
Yeah I've been escalated before and got a group of people working on it. Turns out that "dtls" thing is supposed to help with it but now it seems there is a new problem with the phone registering after connecting to the VPN.