IP Phone SSL VPN to ASA for multiple CUCM (CallManager)

hi all,
I have a case to support multiple CallManager clusters in different locations for internet SSL VPN IP Phone. We will deploy one ASA firewall for SSL VPN IP Phone connections. So, can we use single ASA firewall for mulitple CUCM clusters?? In order words, Internet IP Phone will connect to different CUCM via a single ASA firewall (by using SSL VPN).
I tested I need to upload the ASA's certificate into CUCM and upload CUCM's certificate into ASA for one ASA to one CUCM. If I create multiple profile (e.g. different URL for phone logins) for different CUCM. Is it possible to do that?
thanks for your input!
Samuel

Samuel,
Did you ever find an answer to your question? I have a similar scenario.
Any input would be appreciated.

Similar Messages

  • IP Phone SSL VPN through ASA

    Im in the middle of configuring Ip Phone SSL VPN through ASA, got stuck on authentication.. When I enter username and password on the phone screen, i get "Username and password failed" message on the screen. However, in ASA logs I see the following line
    Feb 16 2011    15:12:57    725002    85.132.43.67    52684            Device completed SSL handshake with client vpn:85.132.*.*/52684
    Feb 16 2011    15:17:26    725007    85.132.43.67    52745            SSL session with client vpn:85.132.*.*/52745 terminated.
    What does it mean?  How can I turn on debugging to see what is going on?
    Thank you in advance!

    Hi,
    If you're not using certificates in client authentication then the SSL handshake will complete before the user is requested to authenticate with username/password.  If this authentication request fails you will see the SSL session terminated immediately following this failure (as in the logs you provided).  Notice the 5 seconds between the SSL session establishment and termination, this is most likely when the user is being authenticated against the aaa server.  If the phone is failing authentication against an external aaa-server you'll want to investigate the logs on that server to determine the root cause of the failure.  The ASA can also provide confirmation of the authentication request/reject with the command 'show aaa-server'.  If you want to see what's going on at an authentication protocol level you can enable several debugs including "debug aaa authentication|common|internal' and protocol specific debugs such as 'debug radius user|session|all' or 'debug ldap'.
    Did this answer your question? If so, please mark it Answered!

  • IP Phone SSL VPN to ASA using AnyConnect

    I have a CUCM 7.1.5. We are using Phone proxy today. I wanted to upgrade to IP phone SSL VPN.
    I know in 8.x and 9.x the Proxy phone is not supported and Cisco supports SSL VPN.
    However, The question is: if CUCM 7.1.5 supports Phone SSL VPN.
    Lastly,
    I hear about Collaboration Edge in CUCM 10.x
    If CUCM 10.x is deployed then how the ASA concept plays a role here.
    What type of license I would need for Collaboration Edge to register the endpoints\phones from outside of network. 
    I cant find any information about the Colaboration Edge on the Internet...
    Message was edited by: Sean Poure

    The embargo/NDA is being lifted. The ASA is not involved. Here's the jump page with info:
    http://www.cisco.com/en/US/netsol/ns1246/index.html
    PS- Jason could have found out details in advance since DiData has partner NDA status.
    Please remember to rate helpful responses and identify helpful or correct answers.

  • Jabber client and IP Phone SSL VPN to ASA using AnyConnect

    Also for Jabber 9.1 can the Jabber for X softphone client (CUCM) can fireup a SSL VPN direct to ASA, similar to how 7965s can? Anyone aware if Jabber 10 or next version will support Jabber client with ASA? I have this delpoyed with 7965s and certificates but I have to manually start a AnyConnect session for Jabber for Windows on my laptop.
    https://supportforums.cisco.com/docs/DOC-9124

    The embargo/NDA is being lifted. The ASA is not involved. Here's the jump page with info:
    http://www.cisco.com/en/US/netsol/ns1246/index.html
    PS- Jason could have found out details in advance since DiData has partner NDA status.
    Please remember to rate helpful responses and identify helpful or correct answers.

  • IP Phone SSL VPN - Licenses required.

    Hi,
    Can someone confirm the linceses required for me to get this working. I understand that it needs the 'AnyConnect for Cisco VPN Phone' license but do I also need to have anyconnec essentials? This is for ASA version 8.2 and the a license info below is for the ASA i intend to delpoy this on.
    Thanks
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited
    Maximum VLANs                  : 250
    Inside Hosts                   : Unlimited
    Failover                       : Active/Active
    VPN-DES                        : Enabled
    VPN-3DES-AES                   : Enabled
    Security Contexts              : 2
    GTP/GPRS                       : Disabled
    SSL VPN Peers                  : 2
    Total VPN Peers                : 5000
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled
    AnyConnect for Cisco VPN Phone : Disabled
    AnyConnect Essentials          : Disabled
    Advanced Endpoint Assessment   : Disabled
    UC Phone Proxy Sessions        : 2
    Total UC Proxy Sessions        : 2
    Botnet Traffic Filter          : Disabled
    This platform has an ASA 5550 VPN Premium license.

    Hi,
    You would need Anyconnect Premium license along with Cisco Ip phone feature enabled on ASA for Cisco IP phone to use anyconnect vpn feature.
    You can find more details from following link:
    http://www.cisco.com/en/US/products/ps12726/products_qanda_item09186a0080bf292f.shtml
    Regards,
    Varinder
    P.S. Please mark this post as 'Answered' if you find the above information helpful so that it brings goodness to other community users

  • IP phone SSL VPN configuration issue

    Hello,
    I am trying to configure the SSL VPN for the IP phone.
    I am using the CM8.0.2 and 7975.
    - I configured ASA and tested with my PC. PC can ping the CM.
    - I uploaded the ASA cert as a Phone-VPN-trust
    - I uploaded the CA root cert. Tried both, Phone-VPN-trust and Phone-trust. Which one is correct?
    - I created a VPN gateway and typed URL and selected the cert
    - I created the VPN group and added the VPN gateway to it.
    - I created the VPN profile and added the VPN group to it.
    - I disabled the Host ID check
    - I configured the Common Phone Profile with VPN group and VPN profile and added it to a 7975 phone.
    When I go into the phone settings, the VPN option is disabled and the Enable soft button is greyed out.
    What is missing? What am I doing wrong?

    Hi,
    If you're not using certificates in client authentication then the SSL handshake will complete before the user is requested to authenticate with username/password.  If this authentication request fails you will see the SSL session terminated immediately following this failure (as in the logs you provided).  Notice the 5 seconds between the SSL session establishment and termination, this is most likely when the user is being authenticated against the aaa server.  If the phone is failing authentication against an external aaa-server you'll want to investigate the logs on that server to determine the root cause of the failure.  The ASA can also provide confirmation of the authentication request/reject with the command 'show aaa-server'.  If you want to see what's going on at an authentication protocol level you can enable several debugs including "debug aaa authentication|common|internal' and protocol specific debugs such as 'debug radius user|session|all' or 'debug ldap'.
    Did this answer your question? If so, please mark it Answered!

  • Why does SSL VPN require client for full functionality?So What's the point?

    I was interested in SSL VPN because I thought that I could have the same functionality I have when connecting via Cisco VPN 3000 concentrator (IPSec with AH and ESP enabled), but without the hassle to deploy and maintain client VPN's for thousands of users.
    However, to my disappointment, based on the information below from www.cisco.com (and I believe that it is the case from other vendors, right?) SSL VPN offers limited functionality if deployed clientless. Why is like that?
    Imagine I have a VPN (IPSec) solution functional today. If I deploy SSL VPN (clientless) what lack in functionality should I experience? Why a VPN client is required if SSL VPN can successfully establish the tunnel? I don't get it.
    "...SSL VPNs provide two different types of access: clientless access and full network access. Clientless access requires no specialized VPN software on the user desktop; all VPN traffic is transmitted and delivered through a standard Web browser. Because all applications and network resources are accessed through a browser, only Web-enabled and some client-server applications-such as intranets, applications with Web interfaces, e-mail, calendaring, and file servers-can be accessed using a clientless connection. This limited access is suitable for partners or contractors that should be provided access to a limited set of resources on the network. And because no special-purpose VPN software has to be delivered to the user desktop, provisioning and support concerns are minimized."

    Hi,
    Clientless SSL VPN only able to access application through browser (i.e. HTTP and HTTPS). If you need to acces other application like RDC, you need full SSL client.
    Full SSL Client is deployed automatically depends on how you configure the SSL VPN box (temporary or permanently);
    1. From the SSL VPN box, you can configure it to download and be installed to user PC permanently (500KB+). When the user successfully authenticated by the SSL VNP box, it will download the client and install automatically/permanently without any help from the network administrator. The user need to login on his/her PC with administrator priviledge.
    2. From the SSL VPN box, you can configure it to download and be installed to user PC temporary (500KB+). When the user successfully authenticated by the SSL VPN box, it will download the client and install temporary without any help from the network administrator. The user need to login on his/her PC with administrator priviledge.
    In one of my deployment, I have 1000+ SSL VPN user. I just need to create a 10 page User Manual/Guide complete with troubleshooting on their own. I use the first option which is automatically download and permanently install in their PC. Patching the SSL VPN Full Client need to upload the new client in the SSL VPN box only and it will automatically patch the client in user PC.
    Dandy

  • IP Phone SSL VPN and Split tunneling

    Hi Team,
    I went throught the following document which is very useful:
    https://supportforums.cisco.com/docs/DOC-9124
    The only things i'm not sure about split-tunneling point:
    Group-policy must not be configured with split tunnel or split exclude.  Only tunnel all is the supported tunneling policy
    I could see many implementation when they used split-tunneling, like one of my customer:
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    banner value This system is only for Authorized users.
    dns-server value 10.64.10.13 10.64.10.14
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split-tunnel
    default-domain value prod.mobily.lan
    address-pools value SSLClientPool
    webvpn
      anyconnect keep-installer installed
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask none default anyconnect
    username manager-max password XTEsn4mfYvPwC5af encrypted privilege 15
    username manager-max attributes
    vpn-group-policy GroupPolicy1
    tunnel-group PhoneVPN type remote-access
    tunnel-group PhoneVPN general-attributes
    address-pool SSLClientPool
    authentication-server-group AD
    default-group-policy GroupPolicy1
    tunnel-group PhoneVPN webvpn-attributes
    group-url https://84.23.107.10 enable
    ip local pool SSLClientPool 10.200.18.1-10.200.18.254 mask 255.255.254.0
    access-list split-tunnel remark split-tunnel network list
    access-list split-tunnel standard permit 10.0.0.0 255.0.0.0
    It is working for them w/o any issue.
    My question would be
    - is the limitation about split-tunneling still valid? If yes, why it is not recommended?
    Thanks!
    Eva

    Hi,
    If you're not using certificates in client authentication then the SSL handshake will complete before the user is requested to authenticate with username/password.  If this authentication request fails you will see the SSL session terminated immediately following this failure (as in the logs you provided).  Notice the 5 seconds between the SSL session establishment and termination, this is most likely when the user is being authenticated against the aaa server.  If the phone is failing authentication against an external aaa-server you'll want to investigate the logs on that server to determine the root cause of the failure.  The ASA can also provide confirmation of the authentication request/reject with the command 'show aaa-server'.  If you want to see what's going on at an authentication protocol level you can enable several debugs including "debug aaa authentication|common|internal' and protocol specific debugs such as 'debug radius user|session|all' or 'debug ldap'.
    Did this answer your question? If so, please mark it Answered!

  • Cisco 1841 SSL VPN and Anyconnect Help

    I am pretty new to Cisco programming and am trying to get an SSL VPN set up  for remote access using a web browser and using Anyconnect version 3.1.04509. If I try to  connect via a web browser I get an error telling me the security  certificate is not secure. If I try to connect via Anyconnect I get an  error saying "Untrusted VPN Server Blocked." If I change the Anyconnect  settings to allow connections to untrusted servers, I get two errors  that say"Certificate does not match the server name" and "Certificate is  malformed." Below is the running config in the router at this time.  There is another Site-to-Site VPN tunnel that is up and working properly  on this device. Any help would be greatly appreciated. Thanks
    Current configuration : 7741 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname buchanan1841
    boot-start-marker
    boot-end-marker
    logging message-counter syslog
    no logging buffered
    enable secret 5 XXXXXXX
    enable password XXXX
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authentication login ciscocp_vpn_xauth_ml_2 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa session-id common
    crypto pki trustpoint buchanan_Certificate
    enrollment selfsigned
    revocation-check crl
    rsakeypair buchanan_rsakey_pairname
    crypto pki certificate chain buchanan_Certificate
    certificate self-signed 01
      30820197 30820141 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      1D311B30 1906092A 864886F7 0D010902 160C6275 6368616E 616E3138 3431301E
      170D3133 30373038 32323330 33335A17 0D323030 31303130 30303030 305A301D
      311B3019 06092A86 4886F70D 01090216 0C627563 68616E61 6E313834 31305C30
      0D06092A 864886F7 0D010101 0500034B 00304802 4100C76B D94BABC2 6D7FB1F1
      AF9AA76F E631B841 7CFEA806 1F52420B 9C83D754 D58393B1 EC02FCA8 BFBE82D6
      79645A32 4ECEDB43 8AEB1590 9CCC309E 17E70061 86150203 010001A3 6C306A30
      0F060355 1D130101 FF040530 030101FF 30170603 551D1104 10300E82 0C627563
      68616E61 6E313834 31301F06 03551D23 04183016 8014AF2E 3FCF66AF C8A43F5F
      97DFABA9 C74371FD 127A301D 0603551D 0E041604 14AF2E3F CF66AFC8 A43F5F97
      DFABA9C7 4371FD12 7A300D06 092A8648 86F70D01 01040500 034100C1 47D2E8B0
      4AC15F69 E8CBE141 E8EE96C5 7BF1EE51 102278B8 ED525185 9F112FA6 0D51F7A6
      3382DB09 8692EEE7 200471B3 BF12FBD0 223EB549 4A352049 513F4B
            quit
    dot11 syslog
    ip source-route
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    username buchanan privilege 15 password 0 XXXXX
    username cybera password 0 cybera
    username skapple privilege 15 secret 5 XXXXXXXXXX
    username buckys secret 5 XXXXXXXXXXX
    crypto isakmp policy 1
    encr 3des
    hash md5
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp key p2uprEswaspus address XXXXXX
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set cybera esp-3des esp-md5-hmac
    crypto ipsec profile cybera
    set transform-set cybera
    archive
    log config
      hidekeys
    ip ssh version 1
    interface Tunnel0
    description Cybera WAN - IPSEC Tunnel
    ip address x.x.x.x 255.255.255.252
    ip virtual-reassembly
    tunnel source x.x.x.x
    tunnel destination x.x.x.x
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile cybera
    interface FastEthernet0/0
    description LAN Connection
    ip address 192.168.1.254 255.255.255.0
    ip helper-address 192.168.1.2
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    no mop enabled
    interface FastEthernet0/1
    description WAN Connection
    ip address x.x.x.x 255.255.255.224
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    interface ATM0/0/0
    no ip address
    shutdown
    atm restart timer 300
    no atm ilmi-keepalive
    interface Virtual-Template2
    ip unnumbered FastEthernet0/0
    ip local pool SDM_POOL_1 192.168.2.1 192.168.2.254
    ip local pool LAN_POOL 192.168.1.50 192.168.1.99
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 x.x.x.x
    ip route 4.71.21.0 255.255.255.224 x.x.x.x
    ip route 10.4.0.0 255.255.0.0 x.x.x.x
    ip route 10.5.0.0 255.255.0.0 x.x.x.x
    ip route x.x.x.x 255.255.240.0 x.x.x.x
    ip route x.x.x.x 255.255.255.255 x.x.x.x
    ip route x.x.x.x 255.255.255.255 x.x.x.x
    ip http server
    no ip http secure-server
    ip nat inside source list 1 interface FastEthernet0/1 overload
    ip nat inside source static tcp 192.168.1.201 22 x.x.x.x 22 extendable
    ip nat inside source static tcp 192.168.1.202 23 x.x.x.x 23 extendable
    access-list 1 permit 192.168.1.0 0.0.0.255
    control-plane
    line con 0
    line aux 0
    line vty 0 4
    password xxxxx
    transport input telnet ssh
    scheduler allocate 20000 1000
    webvpn gateway gateway_1
    ip address x.x.x.x port 443
    http-redirect port 80
    ssl trustpoint buchanan_Certificate
    inservice
    webvpn install svc flash:/webvpn/anyconnect-w
    in-3.1.04059-k9.pkg sequence 1
    webvpn context employees
    secondary-color white
    title-color #CCCC66
    text-color black
    ssl authenticate verify all
    policy group policy_1
       functions svc-enabled
       svc address-pool "LAN_POOL"
       svc default-domain "buchanan.local"
       svc keep-client-installed
       svc dns-server primary 192.168.1.2
       svc wins-server primary 192.168.1.2
    virtual-template 2
    default-group-policy policy_1
    aaa authentication list ciscocp_vpn_xauth_ml_2
    gateway gateway_1
    max-users 10
    inservice
    endbuchanan1841#

    Perhaps you have changed the host-/domainname after the certificate was created?
    I'd generate a new one ...
    Michael
    Please rate all helpful posts

  • ASA license for Cisco IP Phone over VPN

    Hi,
    Are there special licenses required on the ASA to use Cisco IP Phones (Hard phone) over SSL VPN connection?
    Thanks

    Hi,
    You can purchase the phone proxy license. This elimiates the need to build a VPN tunnel for voice traffic.
    It is not mandatory to purchase this license however.
    From the ASA configuration guide:
    http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/unified_comm_phoneproxy.html#wp1144845
    "The  Cisco Phone Proxy on the adaptive security  appliance bridges IP  telephony between the corporate IP telephony  network and the Internet  in a secure manner by forcing data from remote  phones on an untrusted  network to be encrypted. "
    Don't forget to rate all posts that are helpful.

  • ASA 5505 WebVPN - It has taken a while for SSL VPN Relay to load. You need to verify Java is enabled in your browser

    ASA 5505
    ASA Version 9.0.(2)
    Suddently on the webvpn Interface when i click on my web bookmarks (and java launches in browser) i get this fail in Chrome and FF 'It has take a while for SSL VPN Relay til load. You need to verify Java is enabled in your browser' and nothing happens...
    Java IS enabled and running. Tried this in both 7.45 and 7.51
    No problem in IE 11 and java 7.45 and 7.51
    I've googled alot but have not been able to find any suggetions
    Hope you have a solution
    Best Regards.

    Any resolution on this?  Firefox/Chrome my cifs work but smart tunnel RDP doesn't, and in IE my shares don't work but RDP smart tunnel does....
    Cisco, if you're not going to do something good, just don't do it.  The SSL VPN is a hack job.

  • Include multiple sub-interfaces in Cisco ASA for VPN tunnel

    I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
    Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
    Inside, int0/1 : 10.1.1.0/24
    DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
    Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
    Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
    And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
    So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
    Additional settings:
    Have ACL to allow all sub interfaces to access outsite ( lower security level)
    NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet. 
    I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site.

    I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
    Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
    Inside, int0/1 : 10.1.1.0/24
    DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
    Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
    Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
    And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
    So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
    Additional settings:
    Have ACL to allow all sub interfaces to access outsite ( lower security level)
    NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet. 
    I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site.

  • ASA 5505 SSL VPN LOG failed

    %ASA-6-725001: Starting SSL handshake with client outside:58.211.122.212/3293 for TLSv1 session.
    %ASA-6-725003: SSL client outside:58.211.122.212/3293 request to resume previous session.
    %ASA-6-725002: Device completed SSL handshake with client outside:58.211.122.212/3293
    %ASA-6-113012: AAA user authentication Successful : local database : user = admin
    %ASA-6-113009: AAA retrieved default group policy (SSLCLientPolicy) for user = admin
    %ASA-6-113008: AAA transaction status ACCEPT : user = admin
    %ASA-7-734003: DAP: User admin, Addr 58.211.122.212: Session Attribute aaa.cisco.grouppolicy = SSLCLientPolicy
    %ASA-7-734003: DAP: User admin, Addr 58.211.122.212: Session Attribute aaa.cisco.username = admin
    %ASA-7-734003: DAP: User admin, Addr 58.211.122.212: Session Attribute aaa.cisco.tunnelgroup = SSLClientProfile
    %ASA-6-734001: DAP: User admin, Addr 58.211.122.212, Connection Clientless: The following DAP records were selected for this connection: DfltAccessPolicy
    %ASA-4-716023: Group <SSLCLientPolicy> User <admin> IP <58.211.122.212> Session could not be established: session limit of 2 reached.
    %ASA-4-716007: Group <SSLCLientPolicy> User <admin> IP <58.211.122.212> WebVPN Unable to create session.
    %ASA-6-302013: Built inbound TCP connection 137616 for outside:58.211.122.212/3294 (58.211.122.212/3294) to identity:61.155.55.66/443 (61.155.55.66/443)
    %ASA-6-302013: Built inbound TCP connection 137617 for outside:58.211.122.212/3295 (58.211.122.212/3295) to identity:61.155.55.66/443 (61.155.55.66/443)
    %ASA-6-725001: Starting SSL handshake with client outside:58.211.122.212/3294 for TLSv1 session.
    %ASA-6-725003: SSL client outside:58.211.122.212/3294 request to resume previous session.
    %ASA-6-725001: Starting SSL handshake with client outside:58.211.122.212/3295 for TLSv1 session.
    %ASA-6-725003: SSL client outside:58.211.122.212/3295 request to resume previous session.
    Red error what is the reason? Only appears in the window 2003 server.

    ciscoasa# show   activation-key 
    Serial Number:  JMX1314Z1UV
    Running Activation Key: 0x9625fa6a 0x68e90200 0x38c3adac 0xaa0448d0 0x4b3815b6
    Licensed features for this platform:
    Maximum Physical Interfaces    : 8        
    VLANs                          : 3, DMZ Restricted
    Inside Hosts                   : 10       
    Failover                       : Disabled
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 10       
    Dual ISPs                      : Disabled 
    VLAN Trunk Ports               : 0        
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          : Disabled 
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled 
    This platform has a Base license.
    The flash activation key is the SAME as the running key.
    ciscoasa#
    Sure ？it was licence question？

  • IP Phone Over SSL VPN Registering Issue

    I have a Cisco 7945G phone that I have setup with a VPN profile so it can be used remotely.  This device was configured properly, tested at multiple locations and implemented.  This device worked fine for several months but recently the end user has moved into a new house and now has a new service provider (Verizon FIOS).  Now for some reason the phone will not get past the Registering process and doesn't prompt her for her VPN credentials.  Nothing has changed with the phone so I am assuming it is either her new ISP or the Modem/Router they provided her.  The device gets an IP address via DHCP from her home network but then just sits as the registering screen.  She is able to use the Anyconnect client on her laptop to connect to our SSL VPN that way so I don't think the provider is blocking VPN traffic; but there is something that is stoping the phone from getting out.            

    Honestly best thing you could try is download the console logs from the phone and review the VPN bootup process. Check if it's able to establish a TCP connection to the URL of the VPN.
    Maybe their DHCP doesn't give it a DNS server, and phone is unable to resolve your VPN URL? (a shoot in the dark)
    If the phone console logs don't reveal a lot of info, your best shot is a capture at the user site, so we could review the process.

  • Ssl vpn and soft phone

    Does the ASA or IOS support an SSL VPN that includes the Cisco softphone like it does say RDP, SSH, etc?  I'm trying to determine if I can have a user connect a soft phone to our parent company's SSL VPN so they can use their Cisco phone system, while simultaneously having a remote access vpn tunnel to our division's data network.  In short, our employees need to use phones that don't exist on our network while having access to our data network.  I've been able to test having an SSL vpn session open at the same time as an IPSec remote access session, but the softphone is not an option in my current code of 8.4 on the ASA.  I thought I heard it might be available in 9.0.  It seems like it would work in reverse, i.e. having my users connect to my SSL VPN to use my data network and then IPSec to our parent company for the client's locally installed soft phone, but that's not an option for me.  The link below seems to suggest it's possible in IOS at least, but I haven't been able to find any details beyond the sales pitch it offers.
    http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6657/white_paper_securing_voice_traffic_with_cisco_ios_ssl_vpn.html
    thank you

    Following links may help you
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00806ea271.shtml
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008072462a.shtml

Maybe you are looking for