Cisco VPN Phone
Cisco VPN Phone is a Cisco Unified IP Phone–based VPN solution that extends the reach of your Cisco Collaboration solution to outside the logical perimeter of your organization. It enables telecommuters, remote workers, and branch office workers to leverage corporate voice and video resources via a phone-based Secure Sockets Layer (SSL) VPN client. Cisco VPN Phone enables remote connectivity with a CUCM cluster for signaling via SSL on the Internet and RTP with an IP Phone within the enterprise premises without extra hardware, as shown in Figure 5-3.
)
Figure 5-3 Cisco VPN Phone
Cisco VPN Phone is supported on 7942G, 7945G, 7962G, 7965G, 7975G, and 99xx series as well as 89xx series Cisco Unified IP Phones. For a complete list of supported IP Phones in a certain CUCM version, go to Cisco Unified CM Administration and choose Cisco Unified Reporting > System Reports > Unified CM Phone Feature List > Generate a New Report > Feature: Virtual Private Network Client.
The minimum requirements for implementing Cisco VPN Phone are as follows:
- IP Phone SCCP firmware version 9.0(2)SR1S or later
- CUCM 8.0.1 or later
- Cisco ASA IOS 8.0.4 or later
- AnyConnect VPN Pkg 2.4.1012
- AnyConnect premium license and AnyConnect for Cisco VPN Phone license required for Cisco ASA
Example 5-5 outlines the configuration on Cisco ASA to support Cisco VPN Phone.
Example 5-5 Cisco ASA VPN Phone Configuration
UCASA(config)# group-policy GroupPolicy1 attributes UCASA(config-group-policy)# vpn-tunnel-protocol WebVPN ! UCASA(config)# ip local pool VPN-Phone 10.10.1.200-10.10.1.254 mask 255.255.255.0 ! UCASA(config)# tunnel-group VPNPhone type remote-access ! UCASA(config)# tunnel-group VPNPhone webvpn-attributes UCASA(config-tunnel-webvpn)# group-url https://UCASA.org.corp/PhoneVPN enable ! UCASA(config)# tunnel-group VPNPhone general-attributes UCASA(config-tunnel-general)# address-pool VPN-Phone UCASA(config-tunnel-general)# default-group-policy GroupPolicy1 ! UCASA(config)# webvpn UCASA(config-webvpn)# enable outside UCASA(config-webvpn)# anyconnect image disk0:/anyconnect-win-3.1.00495-k9.pkg 1 UCASA(config-webvpn)# anyconnect enable UCASA(config-webvpn)# tunnel-group-list enable
The following steps summarize the configuration required on CUCM to support the Cisco VPN Phone feature:
- Step 1. Upload VPN certificates from Cisco ASA to CUCM by going to Cisco Unified CM Operating System Administration and choosing Security > Certificate Management. Upload the Cisco ASA self-signed certificate as Phone-VPN-Trust certificate.
- Step 2. Configure the VPN gateway by browsing to Cisco Unified CM Administrator and choosing Advanced Features > VPN > VPN Gateway.
- Step 3. Create a VPN group under Advanced Features > VPN > VPN Group.
- Step 4. Configure the VPN Profile under Advanced Features > VPN > VPN Profile.
- Step 5. Assign the VPN group and profile to the Common Phone Profile by going to Device > Device Settings > Common Phone Profile.
- Step 6. Configure the Cisco Unified IP Phone with a TFTP server manually and register the IP Phone internally to test and ensure that VPN works, before you give it to a user.
- Step 7. On the Cisco Unified IP Phone, go to Settings > Security Configuration > VPN Configuration. Enable VPN and use your credentials/certificate to establish a VPN connection.