Cisco VXC VPN. Cisco VXC Requirements. Cisco VXC Firmware

Transcription

1 Cisco VXC Requirements, page 1 Set Up, page 3 Limitations and Restrictions, page 7 Cisco VXC Requirements The feature provides integrated VPN functionality for Cisco Virtualization Experience Clients (Cisco VXC) 2111 and The feature enables VPN tunneling for the Cisco VXC 2111 and Cisco VXC 2112 clients when they attach to a Cisco Unified IP Phone 8961, 9951, or You can set up the and the phone VPN to use the same tunnel or separate tunnels in the following configurations: One tunnel for both traffic and phone VPN traffic Two tunnels that use the same access credentials (one for traffic and another for phone VPN traffic) Two tunnels that use different access credentials (one for traffic and another for phone VPN traffic). This configuration is only supported when a one-time password is applied. You can configure the feature to prompt the user only once for access credentials (in the Phone VPN Sign In window), or once each for the phone VPN (in the Phone VPN Sign In window) and for the (in the VXC VPN Sign In window). Cisco VXC Firmware To support the VXC VPN feature, the Cisco VXC clients must be running the following minimum firmware releases: Cisco VXC 2112: ICA Firmware Release 7.1_118 Cisco VXC 2111: PCoIP Firmware Release 4.0 (Q3CY12) Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager

2 Cisco Unified Communications Manager for Cisco Unified Communications Manager for The following Cisco Unified Communications Manager configuration is required to support the Cisco VXC VPN: PC Port Enabled You must set the PC Port to Enabled. If the PC port is disabled, the Cisco VXC cannot access the network. The phone provides no enforcement of this configuration. Span to PC Port Disabled You must set the Span to PC Port option to Disabled. The Cisco VXC does not require this feature. You can set the preceding parameters in Cisco Unified Communications Manager Administration by using any of the following configuration windows: Phone Configuration window (Device > Phone) Common Phone Profile Configuration window (Device > Device Settings > Common Phone Profile) Enterprise Phone Configuration window (System > Enterprise Phone Configuration) VPN Concentrator for The recommended VPN concentrator for use with this feature is the Cisco ASA 5500 Series Adaptive Security Appliance. To support the, you must set up the ASA for multisession support so that the phone can establish two tunnels that use the same credentials. Network Guidelines for The following network guidelines exist for the feature implementation: The MTU size in the phone VPN profile is a configurable value. The default value is The maximum MTU value on the phone itself is hardcoded at The MTU value must be no greater than 1406, but it should not be less than 576, because some IIS and virtualization servers do not accept values less than 576. You must set up the firewall to allow the MTU value that you specify in the phone VPN profile. If the phone cannot download the certificate file or the phone configuration file, check for the allowed packet size in the network. If the cannot establish a tunnel, then ping the VPN concentrator IP address with a packet size (load) to match the MTU value that the VPN profile specifies. If the ping fails, try another ping that specifies no load. If the ping still fails without the load, check the routing configuration. If the ping fails only with the load included, check the firewall to ensure that it is configured to allow the required MTU. 2 Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 10.0

3 Set Up Perform a traceroute to the VPN concentrator IP address, and then ping each route with the load to determine the source of the issue. Ensure the Don t Fragment (DF) bit is not set on the server, network, or IP phone VPN tunnel. Set Up You must enter the Alternate TFTP and TFTP server fields when you configure an off-premises phone for SSL VPN to ASA using a built-in client. Note The Cisco VXC clients require no configuration to support the VPN. All VPN configuration is performed for the phone only. Procedure Step 1 Step 2 To set up the feature, set up the VPN feature for the attached IP phone in Cisco Unified Communications Manager Administration. Use the submenus in Advanced Features > VPN. To enable the feature, populate the Enable VXC VPN for MAC field using one of the following configuration windows: Phone Configuration window (Device > Phone) Common Phone Profile window (Device > Device Settings > Common Phone Profile) Enterprise Phone Configuration window (System > Enterprise Phone Configuration) Descriptions The following table describes the fields. Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager

4 Descriptions Table 1: Fields Parameter Name Enable VXC VPN for MAC Parameter Description This field enables or disables the feature. When you populate this field, the phone allows traffic from the device with the specified MAC address and that connects to the phone PC Port to access the tunnel. When this field is blank, the phone does not establish a Cisco VXC VPN tunnel. When this field specifies one broadcast MAC address (FFFFFFFFFFFF), the phone establishes the tunnel and allows any connected Cisco VXC 2111/2112 device to access the tunnel. When this field specifies one nonbroadcast MAC address, the phone establishes the tunnel and allows only the Cisco VXC device with the specified MAC address to access the tunnel. By default, this field is blank. VXC VPN Option This field indicates the type of VXC VPN support. Dual Tunnel: The phone establishes two VPN tunnels, one for the phone and another for the Cisco VXC device. To ensure the highest quality of service for the phone voice and video services, Cisco recommends the Dual Tunnel setting, which is the default setting. With two VPN tunnels, the host Cisco Unified IP Phone can provide prioritization of CPU and memory resources to the data that associates with the phone voice and with video functions over the data that associates with the tunnel. This approach requires two manual login entries, depending on security parameters: one for the phone VPN and another for the Cisco VXC VPN. The two-tunnel approach also requires two VPN concentrator ports and two IP addresses. Single Tunnel: The phone establishes only one VPN tunnel for the phone and the Cisco VXC device to share. For customers who are willing to trade off potential voice and video quality for a simplified operating model, the single VPN tunnel option is available. All data travels over a single VPN tunnel by sharing the available phone processor and memory resources across the voice, video, and Cisco VXC services. The IP phone does not prioritize data handing of one service over another. As a result, possible performance degradation of the IP phone voice and video media handling and UI functions may occur due to IP phone CPU loading. Default: Dual Tunnel 4 Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 10.0

5 Descriptions Parameter Name VXC challenge VXC-M Servers Parameter Description This field indicates whether or not to challenge the user for a password for the. 1 Challenge: The phone challenges the user for a password to enable the. 2 No Challenge: The phone does not challenge the user for a password for the. Default: Challenge Note If the phone uses only a certificate for authentication, the Sign In windows do not display. This field indicates the Cisco VXC Manager Server IP address list, where each entry is separated by commas. Maximum length: 255 (character length) Default: blank Note VXC-M Servers is an IP address list which includes VXC-M servers and repository servers (if present). The phone considers the first IP address in this string as the VXC-M server and offers this information to VXC devices. Therefore, after you configure VXC-M Servers, make sure that the IP addresses of any VXC-M servers are placed in front of the IP addresses of the repository servers. The following table describes how the VXC VPN Option and Challenge field settings alter the operation of the feature. Table 2: operation as determined by VXC VPN Option and Challenge settings VXC VPN Option setting Dual Tunnel (default) VXC Challenge setting Challenge (default) Result after enabling the VXC VPN feature (with Cisco VXC connected to the phone) The phone displays the VXC VPN Sign In window to prompt the user to enter a password. If one-time password is configured on the VPN concentrator (that is, a new password is always required to reauthenticate the tunnel), the user must enter a password for the Cisco VXC VPN that differs from the password that was used for the phone VPN tunnel. Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager

6 Descriptions VXC VPN Option setting Dual Tunnel (default) Single Tunnel Single Tunnel VXC Challenge setting No Challenge Challenge No Challenge Result after enabling the VXC VPN feature (with Cisco VXC connected to the phone) The phone attempts to reuse the phone VPN credentials for the tunnel. Note that if the VPN concentrator is configured for one-time passwords, the attempt fails, and the phone displays the VXC VPN Sign In window for the user to enter a different password from the phone VPN password. The phone disconnects the phone VPN tunnel, and then displays the Phone VPN Sign In window to prompt the user to enter a password and reestablish the phone VPN tunnel. If the user is on an active call, the phone waits until the call ends before tearing down the tunnel. Cisco VXC traffic receives silent permission to go over the phone VPN with no challenge. The following table describes how a change in the VXC VPN Option setting alters the operation of the VXC VPN feature when the feature is already enabled. Table 3: operation as determined by VXC VPN Option change VXC VPN action Change from Dual Tunnel to Single Tunnel Change from Single Tunnel to Dual Tunnel Result The phone disconnects the VXC VPN tunnel and leaves the phone VPN tunnel intact. Cisco VXC traffic receives permission to go over the phone VPN tunnel. The phone attempts to reuse the phone VPN credentials for the tunnel silently without considering the VXC Challenge field. If the VPN concentrator is configured for one-time password, the attempt fails and the phone displays the VXC VPN Sign In window, which prompts the user to enter a different password. 6 Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 10.0

7 Limitations and Restrictions Limitations and Restrictions The following limitations and restrictions apply: Only Layer 3 packets are tunneled. The feature does not support Layer 2 tunneling. Therefore any Layer 2 capabilities are lost if the Cisco VXC connects through VPN. The VPN client supports only IPv4 addresses. The tunnel cannot be established over a Wi-Fi interface. The Enable VXC VPN for MAC feature option is configurable only after you set up the phone VPN parameters, including VPN Group and VPN Profile. This restriction exists because the can share the same VPN parameters as the phone VPN. All existing limitations and restrictions that apply to the phone VPN support apply to the Cisco VXC VPN as well. Note Do not turn on the VPN before a downgrade to a load previous to 9.2(3), or the phone will be unregistered. Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager

8 Limitations and Restrictions 8 Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 10.0