Conflict with ISA570W Remote VPN

Question

Ok... this one makes absolutely no sense. I'm hoping someone can help.
My customer's IP phones stopped working when I enabled Remote IPSec on the ISA570W.
Here's the configuration:
When the Mitel IP phones power on, they acquire an IP address from the hosted VoIP server via DHCP (option 128) then download the configuration file via TFTP. When I enable Remote IPSec on the ISA570W, the phones obtain their address, but stall during the TFTP transfer. If I disable Remote IPSec and power-cycle the ISA570W, the phones start up normally. If Remote IPSec is enabled and I disconnect the WAN1 interface, the phones start normally.
I fail to see how enabling Remote IPSec on the ISA570W causes a communication failure between the IP phones and the hosted VoIP servers.
The phones are not communicating through the ISA570W. The path is: IP Phone<-->LAN<-->Cisco 2430<-->Host
Any ideas?
Thanks,
Rick

Answer 1

Nagaraja,
The VoIP solution is hosted by a third party (Broadview Networks), so I have limited information on the configuration of their Cisco 2430.
Here's what I can provide:
LAN
  192.168.0.0/24
ISA570W
  LAN
    VLAN 1 (Default - GE2-GE9)
      IP Address: 192.168.0.1/24
  WAN1 (GE1 - Internet - Fairpoint FTTP)
    IP Address: 71.***.***.39/24
    Add'l IP: 71.***.***.139/24
  WAN2 (GE10 - Internet - Broadview Cisco 2430 Data interface)
    IP Address: 64.***.***.138/31
  Note: WAN1 is used primarily for Internet access and inbound connections.
           WAN2 is used for site-to-site IPSec over Broadview Internet to remote office.
  Site-to-site IPSec: 192.168.0.0/24 <--> 192.168.16.0/24
Cisco 2430
  WAN: T1 to Broadview Networks
  Data interface (fe?/?)
    IP Address: 64.---.---.137/31
  Voice interface (fe?/?)
    IP Address: ???
  TFTP Server: 10.161.0.32/??
  Phones are assigned IP addresses on network 10.160.90.0/?? via DHCP (Option 128)
Servers, computers and phones are connected to the same physical switches. This is necessary because we use the passthrough port on the phone for the computers.
When Remote IPSec is enabled on the ISA570W, phones successfully acquire DHCP and begin the TFTP transfer, but stall after a few blocks. In rare cases, a phone will complete the TFTP transfer but hang during initialization.
Here's a sample capture:
10.160.90.43 10.161.0.32 TFTP: Read Request - File: MinetIp5220Dpl.bin, Transfer Mode: octet blksize: 4096 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Option Acknowledgement - blksize: 1024 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 0 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 1 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 1 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 2 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 2 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 3 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 3 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 4 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 4 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 5 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 5 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 6 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 6 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 6 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 6 {UDP:3132, IPv4:3129}
10.161.0.32 10.160.90.43 TFTP: Data - Block Number: 6 {UDP:3132, IPv4:3129}
10.160.90.43 10.161.0.32 TFTP: Acknowledgement - Block Number: 6 {UDP:3132, IPv4:3129}
Note that in this example, block six continues to retry indefinately.
Any one of the following actions will clear the problem:
  Disconnect the ISA570W from the LAN
  Disconnect the ISA570W WAN1 interface
  Disable Remote IPSec and power-cycle the ISA570W
Here's the Remote IPSec configuration:
  Group name: M*******s_VPN
  WAN Interface: WAN1
  IKE auth method: Pre-shared key
  Password: ************
  Mode: Client
  Pool range for client LAN: 192.168.0.176 - 192.168.0.191
  Client internet access: Create NAT rule... enabled
  WAN failover: Off
  Zone Access Control: Only LAN and WAN permitted
  Mode configuration:
    Primary DNS: 192.168.0.19
    Default Domain: m*********c.com
    Split tunnel: On
      Protected network: 192.168.0.0 255.255.255.0
Based on the capture, the path between the TFTP server and the phone is unaffected. The TFTP traffic is UDP. Is it possible it's getting corrupted?
Thanks,
Rick