Cisco Unified Communications Manager for Cisco VXC VPN
The following Cisco Unified Communications Manager configuration is required to support the Cisco VXC
VPN:
PC Port Enabled
You must set the PC Port to Enabled. If the PC port is disabled, the Cisco VXC cannot access the
network. The phone provides no enforcement of this configuration.
Span to PC Port Disabled
You must set the Span to PC Port option to Disabled. The Cisco VXC does not require this feature.
You can set the preceding parameters in Cisco Unified Communications Manager Administration by using
any of the following configuration windows:
•
Phone Configuration window (Device > Phone)
•
Common Phone Profile Configuration window (Device > Device Settings > Common Phone Profile)
•
Enterprise Phone Configuration window (System > Enterprise Phone Configuration)
VPN Concentrator for Cisco VXC VPN
The recommended VPN concentrator for use with this feature is the Cisco ASA 5500 Series Adaptive Security
Appliance. To support the Cisco VXC VPN, you must set up the ASA for multisession support so that the
phone can establish two tunnels that use the same credentials.
Network Guidelines for Cisco VXC VPN
The following network guidelines exist for the Cisco VXC VPN feature implementation:
•
The MTU size in the phone VPN profile is a configurable value. The default value is 1290.
•
The maximum MTU value on the phone itself is hardcoded at 1406.
•
The MTU value must be no greater than 1406, but it should not be less than 576, because some IIS and
virtualization servers do not accept values less than 576.
•
You must set up the firewall to allow the MTU value that you specify in the phone VPN profile.
•
If the phone cannot download the certificate file or the phone configuration file, check for the allowed
packet size in the network.
•
If the Cisco VXC VPN cannot establish a tunnel, then ping the VPN concentrator IP address with a
packet size (load) to match the MTU value that the VPN profile specifies.
•
If the ping fails, try another ping that specifies no load. If the ping still fails without the load, check the
routing configuration.
•
If the ping fails only with the load included, check the firewall to ensure that it is configured to allow
the required MTU.
•
Perform a traceroute to the VPN concentrator IP address, and then ping each route with the load to
determine the source of the issue.
Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager
10.0
254
Cisco VXC Requirements
To Next Page
Loading...
Need help?
General
