Site to Site VPN - 9611G IP Phone 2

[tac84]

Merry Christmas, everyone!

Stupid question here...

I've set up a site-to-site VPN to access my Network remotely. My issue is that I can ping my IP Office address, access manager, sysmon, etc....however IP Phones display the old 'Discover X.X.X.X' and don't receive a 200 response when trying to obtain settings, etc.

Site 1 - Main
UDM Pro
Main LAN - 172.16.1.0/24
VLAN 10 (Voice) - 10.10.10.0/24
IP Office - 10.10.10.2
R11.1.2.3
IP Office has IP Routes for network 172.16.1.0/24 and also the 192.168.1.0/24 for site 2 (Not sure if it needed the second one...)

Site 2 - Remote
SonicWall
SonicWall LAN 192.168.1.0/24
Device: 9611G

I can ping the IP Office and anything on the 10.10.10.0/24 Network from Site 2, but like I said the 9611G displays 'Discover 10.10.10.2' and also won't receive 200 messages on startup. To keep it simple, I've used a static IP address for the 9611G in the 10.10.10.0/24 range.

No doubt this is basic networking but I thought with a site to site VPN it would be fairly simple. Any help would be appreciated

Thanks, Tim
Adelaide, Australia

 

[derfloh]

Probably you need firewall rules to allow traffic

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[tac84]

Thanks @Derfloh will take a look at it

Thanks, Tim
Adelaide, Australia

 

[tac84]

**Solution**

Managed to get it working. Wasn't Firewall rules. I enabled H.323 Remote Worker under System | LAN1 which I didn't think was needed because it was a site to site VPN network (Not using the 9611G VPN settings) and with the IP Route in the IP Office to the local LAN of the remote site, it worked perfectly.

Thanks, Tim
Adelaide, Australia

 

[derfloh]

Then you have NAT enabled on your VPN setup. You should disable this

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[tac84]

Thanks so much @derfloh. Just reading that this is apparently an issue with Ubiquiti devices (UDM Pro). Apparently there is no option to disable in the normal GUI - you need to access via putty and disable, but it won't disable it permanently unless you modify a config file and upload the new config...

Thanks, Tim
Adelaide, Australia

 

[derfloh]

Ok. That’s not my interpretation of a Site to Site VPN.

With NAT enabled, IPO sees the phone as remote device that had to be licensed.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN