IP Office Technical Tip

Tip No: 221

Release Date: 9 October 2009

Region: GLOBAL

Configuring VPNremote Telephones with Cisco Adaptive Security Appliance (ASA) 5510 using the Adaptive Security Device Manager (ADSM)

Full PDF Text Version

The following document assumes that the user/installer is familiar with configuring both IP Office and VPN devices as well as with manually configuring IP Hard-phones. This document details how to create the VPN tunnels required. It is for reference purposes only. It does not provide details on how to configure any other aspect of either device.

Test Systems Software Versions and Basic Telephone Settings

IP Office Core Software


Cisco ASA Model 5510


Cisco Adaptive Security Device Manager (ADSM)


IP Telephone Model

5610SW, 5620SW

IP Telephone Firmware


IP Office IP Address

TFTP Server

IP Telephone IP Address


IP Telephone CallSV

IP Telephone CallSVPort

1719 [Default]

IP Telephone Router


IP Telephone Mask


IP Telephone FileSv

IP Telephone 802.1Q


IP Telephone VLAN ID



1. The IP Telephones may require a Virtual IP Address to be configured in the VPN settings. Please take care in choosing a Virtual IP Address range. Consider where the telephone is most likely to be used and ensure that the Virtual IP Range selected will not conflict. For instance, many VPNremote Telephones may be installed at user’s homes. Typically a Home Router uses 192.168.0.x or 192.168.1.x as its internal network range; therefore it is recommended that this is not used as a Virtual IP Address Range.
2. Review the Sample 46vpnsetting.txt file for simplifying configuration settings on the IP Telephones
3. While the defaults for Encryption are set at 4500-4500 and these settings do work in most configurations, there may be instances where depending on what the VPN Router and the Home router supports, the user may need to either amend or disable this setting.

IP Office Configuration

Using IP Office Manager, Open the Configuration and select IP Routes. Add a New IP Route for the Virtual LAN Network to be used in the environment.

Networking Scenario:

Cisco Adaptive Security Appliance (ASA) Configuration

1) From the Adaptive Security Device Manager (ADSM) home screen, select the License tab to identify the IPSec encryption algorithms licensed for use. Encryption algorithms other than DES require the installation of an enhanced encryption license from Cisco.

2) Start the VPN Wizard by selecting Wizards>VPN Wizard from the ADSM top toolbar. Select Remote Access for the VPN Tunnel Type and outside for VPN Tunnel Interface. All remaining fields can be left at default values. Click Next to continue.

3) Keep the default selection of Cisco VPN Client, Release 3.x or higher, or other VPN Remote Product. Click Next to continue.

4) Select the Pre-shared Key Authentication Method. Enter your Pre-shared Key and Tunnel Group Name to be used by the Avaya VPNremote Telephones. Click Next to continue.

5) The internal ASA user authentication database is used in this document. Select the Authenticate using the local user database and click Next to continue.

6) The following screen allows you to create user names and passwords for VPNremote Telephone users. vnpuser1, vpnuser2 and vpnuser3 have been created as shown. Click Add to create your users and then click Next to continue.

7) Click the New button to create a new IP Address pool. Enter the pool name and the IP Address range to be assigned to VPNremote Telephones as the Virtual IP Address. This address range must not overlap with any addresses on the private enterprise network and must be routable within the enterprise network. Click OK and then click Next to continue.

8) Enter the DNS, WINS and Domain information to be used by the VPNremote Telephones. Click Next to continue.

9) Select the IKE security association parameters that you want to use from the drop down lists. Here 3DES, MD5 and 2 are used. Click Next to continue.

10) Select the IPSec VPN encryption and authentication parameters from the drop-down lists. Here AES-128 and SHA are used. Click Next to continue.

11) Accept the default Address Translation Exemption and Split Tunneling options and click Next to continue.

12) Verify the VPN Tunnel options and click Finish to complete.

13) Ensure the default route has been set. The default route here is set to the outside (public) interface. Navigate to Configuration>Routing>Static Routes and click the Add button. The IP address of with Mask of signifies the default route. The IP address of is the ISP next hop router. Click OK to continue.

14) If the VPNremote Telephone extensions on the IP Office are configured to allow direct media path, then the following must be done. Navigate to Configuration > Interfaces and tick the Enable traffic between two or more hosts connected to the same interface check box.

VPNremote Telephone Configuration

Below are the parameters to be configured in the VPNremote telephones. Please refer to Technical Tip 205 " VPN Telephone Deployment Guide for IP Office on how to configure these parameters.

Configuration Options



VPN Profile

Cisco Xauth with PSK

VPN configuration profile


IP address of the ASA outside interface

User Name


User created in the ASDM VPN Wizard



Password created in the wizard for the User

Group Name


Group name created in the wizard

Group PSK


Pre-shared key created in the wizard for the Group

IKE Parameters



Specifies the format of the Group Name

Diffie Hellman Group


Can be set to “Detect” to accept ASA settings

Encryption ALG


Can be set to “Any” to accept ASA settings

Authentication ALG


Can be set to “Any” to accept ASA settings

IKE Xchange Mode


Mode used for Phase 1 negotiations

IKE Config Mode


Enables IKE



Cert Expiry Check


Cert DN Check


IPSEC Parameters

Encryption ALG


Can be set to “Any” to accept ASA settings

Authentication ALG


Can be set to “Any” to accept ASA settings

Diffie Hellman Group


Can be set to “Detect” to accept ASA settings

VPN Start Mode


IPSec tunnel dynamically starts on phone power up

Password Type

Save in Flash

Saves password in flash so that user is not prompted at phone boot up


4500 " 4500

Default value to enable NAT Traversal

Protected Nets

Virtual IP

Remote Net #1

Access to all private nets

Remote Net #2

Remote Net #3

Copy TOS


Re-write TOS bit value to outside IP Header for QOS

File Srvr

TFTP/HTTP file server

Connectivity Check


Frequency of connectivity check

Issued by:

Avaya SME Customer Product Engineering

Contact details:-


Tel: +44 1707 392200

Fax: +44 1707 376933

Email: gsstier4@avaya.com


Tel: +1 908 204 4686

Fax: +1 908 204 4687

Email: IPONACALAT4@Avaya.com

Internet: http://www.avaya.com

© 2009 Avaya Inc. All rights reserved