VOIP over VPN IPSEC

[#1]

Hello, I' ve configured VPN properly between fortigate & Cisco ASA & I want to allow our Nortel i2002 phone to connect to VOIP gateway through VOIP . Any special configuration needed to allow VOIP ? thanks

[emnoc]

emnoc , sorry can you explain please how to investigate what is wrong exactly ?

Here' s what I would; Do a packet capture to ensure you have the right protocol and ports between phone2phone and phone2pbx e.g diag sniffer packet lan ' iphone-addr and bcm-addr' Then define a policy at the top of your policy list for that traffic for the ipsec interface ( don' t forget you have a voice and control channel ) Next, craft a traffic shaper. Here' s what I did for one SoHo office and my single nortel i2002 phone; config firewall shaper traffic-shaper edit " VoIP" set guaranteed-bandwidth 90 set maximum-bandwidth 120 next end Apply the shaper to your fwpolicy. And that' s all that you need & all should work. VoIP quality was great and everything one 100% functional back to our corpHQ office and teh BCM/pbx that my phone registered to. IIRC, I did not need any special dhcp-option or any tricks with dhcp and serve my address for the phone locally and dynamic. So once you have identify the port(s)/protocol and have the appropiate rules, all should work. I never fully research the code type nor bandwidth consumption, but I have a hunch it' s 80k or so per call. Hope this helps.

[#3]

Thank you emnoc so much , I Nortel i2002 is connected now but when I try to make a call I just hear the ring after that didn' t hear any voice . I got these errors 2010-12-28 10:03:38 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1 rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR 2 2010-12-28 10:03:30 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR 3 2010-12-28 10:03:22 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1 rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR so why I can just dial any number but cannot hear any voice when anyone hang up the handset ?

[emnoc]

Will that looks like a vpn p2 error if I had to guess. Have you checked the following; is the vpn tunnel establish? ( diag vpn ike status and followed by a diag vpn ike gate ) and on the cisco " show crypto ike sa" , " show crypto ipsec sa" iirc Do you have a phase2 SA established ? ( diag vpn tunnel stat or list , are you defining correct IPs for the left & right networks ? ) and for the cisco " show crypto ipsec sa " Have you valid connectivity over the ipsec-tunnel ? ( ping the remote subnet the phone is and from both ways ) Do you have the correct firewall rules to allow traffic? ( I would do a general rule first and then narrow down the policy if required permit phone_net to remote_phone-net ) Lastly, what does the VoIP PBX see? ( are the instrument registered, do you see call setup or establishment ,softwitch diagnostics , etc...) if your having ASA issues, a packet trace would be helpful and tell you alot, ASAcodset 7.2 or higher ; " packet input " interface-name" " protocol" udp " src_net" + " port" " dst_net" + " port detail" Good luck.

[#5]

Finally everything is working properly , thank you emnoc so much for your support & help.