9620L VPN Discover

[racom]

I have a 9620L VPN phone on an IPOffice 500V2 running 6.0.18 (yes, I know, its older) on a Sophos UTM 9 router. The VPN establishes, but I get Discover xxx.xxx.xxx.xxx. I have tried everything I know to get this up. Here is the odd thing. If I upgrade the firmware on the phone to 3.2 or higher, I can ping the phones VPN Pool IP from the main site. And I see it in Monitor, just not registered and it lists as No Phone. I see the MAC and everything. The screen says phone... connecting.... phone... connecting and flashes back and forth. And I get the error "ERR: TPKT Recv: Length 2106 bad - bigger than buffer" in the monitor traces. If I allow it to downgrade via the VPN to any of the 3.1x firmware, it connects long enough to install the HA96xx firmware, reboots, then I no longer can ping it or see it. The VPN is still up, but it seems dead to the network. I don't see it in monitor, and I don't even see any 96XXUpgrade.txt requests. And I can't ping it. I have tried firmware 3.11, 3.13, 3.14, 3.22, 3.24. I have tried every combination I know in the router's firewall. I have tried adding all IP ranges in trusted networks. My router is also the VPN router and I have the default 0.0.0.0/ 0.0.0.0/ 192.168.10.1/ LAN1 in the IP routes on the IP Office. I even had Sophos look into it. I loaded a VPN client on my PC with the same settings, and I am able to establish a VPN and access their full LAN. Any suggestions???

 

[holdmusic34]

Try a local HTTP server at the 9620 end instead of using the IP Office for HTTP requests.
HFS.exe for example.

Also see this thread:

https://community.sophos.com/produc...-access/54496/ipsec-with-avaya-9600-vpn-phone

And try the attached setup guide. It pertains to 9611G handsets, but the principle should be similar.


A madman with a taste for speed.

 

[racom]

Resolved.... I think.... I took the VPN phone to another remote network and it came right up. Went back to mine, and got the Discovery. On a hunch, I changed my IP range on my network from 192.168.0.X to another range and phone came right up. I can't seem to find what is wrong with 192.168.0.x, but it does not like it. Not sure if this IP range conflicts at the host site or if is being blocked for one reason or another. I think I may just leave it at that. I have spent way too many hours troubleshooting for a 100.00 feature.

 

[TouchToneTommy]

The host network is also 192.168.0.0/24 and it can't route properly when your subnet matches.

 

[racom]

No, it isn't Each network is unique, so there shouldn't be a conflict. I looked through the routes, firewall and VPN Pools. Nothing conflicts.