IP Telephones over VPN 1

[ntwrkrbkj]

Yes, this isn't standard, I know .

Ok, here is the situation, I have 2 locations.

Location 1

1.1 SDSL connected to a BEFVP41 Linksys router (new version with the Cisco logo).

The BEFVP41 is connected to an ethernet interface on a Cisco 3661 router.

The 3661 is connected into our network via a Cisco 3524 switch.

This location contains all CCM servers, DHCP server, etc, etc.

___________________________________________________________

Location 2

768 SDSL connected to a BEFVP41 Linksys router (new version with the Cisco logo).

The BEFVP41 is connected to a Cisco 2912 switch.
___________________________________________________________

Location 1 uses a subnetted 10.0.0.0 network #. The connection between the BEFVP41 and the 3661 uses the 192.168.1.0 #. Location 2 uses the 192.168.2.0 #.

The VPN is established, the routing tables on all devices contain static routes for each network. There is a DHCP relay agent on the 192.168.2.0 network, with a scope configured for it on the primary DHCP server in the 10.0.0.0 network. NetBIOS broadcasting is enabled on the Linksys routers, ip directed-broadcast is configured on the 3661. CCM is configured to NOT allow dynamic configs, and the config for the phone is in CCM and correct. I can access resources in both networks successfully.

The DHCP relay agent shows that all requests are being dropped. I know I have missed something simple and stupid. I realize this isn't quite Cisco standard, but there isn't any reason it can't work. Any ideas?

A+, i-Net+, MCSA, MCSE, CCNA

 

[simonxts]

Have you configured an ip helpder-address? are you sure the udp bootpc packets are forwarded?

n0m0r3

 

[scaine]

We've got a single IP phone at our "Location 2" like you describe above - it works a treat. Only substantial difference is that our location 2 has it's own DHCP scope, so we'd never run into this problem above. Given that it works okay in our environment, I'll agree with nomor3 above and suggest that you'll need an IP-Helper-Address on your BEFVP41 Linksys router at location 2. Otherwise, your DHCP broadcast will never reach your primary location, being dropped onsight at location 2.

Sounds like we're missing something else though, since you talk about relay agents and IP-Directed-Broadcasts above. Although you only need a forwarder on the Location 2 side since the reply to the DHCP broadcast is a unicast packet. Perhaps it's an issue with the relay agent on the Linksys? Is it possible that it's not VPN aware in some manner?

Our VPN is running over Checkpoint, so you don't have to do Cisco for this to work. Possibly your best bet is to try a DHCP server locally with the Option 150 configured. I can pretty much guarantee that solution.

 

[ntwrkrbkj]

Sounds like a decent plan to me. I will give it a shot and let you know what happens. Thanks for the posts.

A+, i-Net+, MCSA, MCSE, CCNA

 

[ntwrkrbkj]

The DHCP scope at the location worked. Ok, that is great, but what about locations that don't have DHCP servers? I have some locations that will just have a computer and an IP phone behind that same linksys router. Any ideas on how to get the phones to talk to the DHCP and the CCM?

A+, i-Net+, MCSA, MCSE, CCNA

 

[scaine]

Your easiest option is to use the Linksys router to assign the DHCP locally, like it probably already does for the PC. Then you'll have to manually edit the TFTP location using the handset's **# edit facility. Unless of course the Linksys router is clever enough to allow its DHCP to be configured with Option 150 to point to your TFTP server automatically.

The problem with forwarding DHCP broadcasts in this instance is that I have no idea how the Linksys router would tag the request - meaning I have no idea which scope the DHCP server would honour the request from, if it does so at all.

Not an expert on DHCP though, so I'll leave it at that.

 

[ntwrkrbkj]

Linksys isn't that advanced ;-). Sounds like a winner on the static config idea, I never thought of that. I am still a little new to the VoIP area. Thanks for all the posts, I will let you know how that works out.

A+, i-Net+, MCSA, MCSE, CCNA

 

[ntwrkrbkj]

When I went into the Network Configuration and did the **# to unlock the config, the edit button showed up. However, upon pressing the edit button, it tells me, "that key is not active here". Sorry for my noobness, what did I miss?

A+, i-Net+, MCSA, MCSE, CCNA

 

[scaine]

You have to disable DHCP first. On my 7960 phone, this is in Network Settings, option 30. Once you've done that, you can then enter IP address/mask/gateway, and then TFTP server. You should be able to edit most of the IP settings once DHCP is inactive.

Hope that helps.

 

[ntwrkrbkj]

Outstanding, thanks a ton.

A+, i-Net+, MCSA, MCSE, CCNA