VPN for Avaya 9608G 3

[WhosYourDiffie]

Hello all,

I'm new to the whole Avaya world and so far I got it down pretty well. However, I just ran into a new issue... VPN.

I was tasked with getting a VPN up and running for the phones with a Cisco 5506 ASA and I don't know where I went wrong.

After farting with it for almost 2 weeks I got the phone to a point where it would say "Discover [IP ADDRESS]". I took the phone home and then the phone said "IKE ID/PSK Invaild". I bring it back to the office and get the same thing.

I was wondering if anyone had any pointers as how they set up their ASA to get phones to work. This ASA really have a thousand bells and whistles!

Any and all help is appreciated!

I'll supply some information below about the situation:

Outside IP of ASA - XXX.XXX.XXX.XXX
Inside IP of ASA - 192.168.42.254 [Also is pushing out DHCP]
IP Office IP - 192.168.42.1
IP Pool of VPN Phones - 192.168.44.100-200

If there is anymore more information needed, please let me know.
There be a way to route the IP Pool of the VPN Phones to the Inside IP, I think that where my issue may be.

Thank you for all your help!!

 

[tlpeter]

You need to make an IProute in the ipo to the pool.

BAZINGA!

I'm not insane, my mother had me tested!

 

[WCeightoh]

If it's coming up "Discover XX.XX.XX.XX" with the IPO then as tlpeter says you need an IP route built.

IP Address = Local subnet at remote site (ie 192.168.1.0)
Subnet = 255.255.255.0
Gateway = 192.168.42.254
LAN1 (assuming you're using LAN port on IPO)

 

[WhosYourDiffie]

@tlpeter & @WCeightoh

Thank you for your input. I just put that IP Pool into the IPO.

I also noticed this morning that I was missing a few incoming rules in the following:
Configuration > Firewall > Access Rules

I believe this was my problem because the phone is coming up now as it should, however, I've noticed that when I restart the phone it will periodically come up strangely where the display seems all out of whack.
I believe this is because the firmware for the phone is a higher version than the IPO that it is connected to.

Thank you for all your input!

 

[critchey]

Make sure that you set the HTTP server in the phone to the IP office as well. Make sure the HTTP server in manager is set to the interface IP (LAN1 or LAN2 IP). Then the phone should automatically grab its firmware after a reboot. If not verify, in embedded file management, the firmware is present for IP phones (upgrade wizard can often times leave the IP firmware out for whatever reason).

IP office is not like other systems, such as Cisco, where you can run newer firmware then the system expects. IP office typically wants exact firmware for the release you are running. If you unsure what firmware you should have for your release see the tech bulletin for the release you are running. It lists the firmware for all compatible phones.

The truth is just an excuse for lack of imagination.