Avaya 96XX phones VPN on Cisco ASA 5515 running 9.1(3)

[crhoads71]

Experiencing an odd problem in that my remote phones will all start a constant cycle of restarts after about a week of being connected. To get them back online I have to delete each phones H323 extension and re-add it.

I have removed all timers and fixups on the ASA and this still continues to happen. I did have h323 timeout errors in the logs prior to removing the timers, but I don't have those errors anymore when this happens. I can't seem to find any errors in the IP Office monitor when this happens, but the fact that deleting the H323 extension seems to mitigate the issue for another week points to something, right?

 

[RNIPO]

Do you use the same xauth credentials for all of the VPN phones?

I have had an issue recently where the ASA would only let you fixup 5 tunnels, the 6th would boot someone off, forcing it to reboot, then when that came back it would boot someone else off.

 

[Bas1234]

For the ASA vs 56XX i used these settings so almost the same for 9600;

IKE/IKE2 3DES/MD5/DH2
IKE Xchg Mode Agressive
Remote Net 0.0.0.0/0
Cisco Xauth with PSK
Cert Ex/DN disabled
Copy TOS no
File srvr IPO
Conn Check Always
Qtest Disabled
VPN start mode Script.

Here is a link it's not for the IPO but for the CM, the way to configure it on the 96XX is the same.

http://support.avaya.com/elmodocs2/vpn/vpnphon_pix.pdf

___________________________________________
It works! Now if only I could remember what I did...

Dain Bramaged (Avaya Search tool

http://tinyurl.com/bas1234

)
______________________________________

 

[crhoads71]

It looks like RNIPO got it, how do I make each phone prompt for a VPN User? my 96xxvpn settings are overwriting my manual changes each time the phone reboots.

 

[RNIPO]

There is a setting in the ASA to increase the max XAUTH limit, then you can leave the phones as they are. Or you can just remove the setting from the settings file so it doesn't over write.

To increase the simultaneous logins add the following to the VPN policy on The ASA:

ciscoasa(config)#group-policy <policy name> attributes
ciscoasa(config-group-policy)#vpn-simultaneous-logins 20