topic Re: IPSec VPN Setup for Avaya Phone in General Topics

IPSec VPN Setup for Avaya Phone

mario11584 — Fri, 07 Dec 2012 23:24:17 GMT

I am attempting to setup an IPSec VPN tunnel to connect to remote Avaya phones. I am not sure if I am doing it correctly. I've set up a new IPSec tunnel and configured it to use dynamic IP for remote peers. I am not sure if this is correct or not. It seems to me this would be for a site-to-site VPN. I believe I am looking for more of a client VPN tunnel to connect the Avaya phone to. Any thoughts or ideas would be appreciated.

Re: IPSec VPN Setup for Avaya Phone

apasupulati — Wed, 12 Dec 2012 07:01:15 GMT

Hello,

Yes, you probably may test the site-to-site VPN by configuring the PAN to use dynamic peer IP, but I'm not sure it will work since I haven't tested this. To be able to connect as a client VPN, we don't support the VPN client on the Avaya phones via Global Protect yet.

You may refer to 'Section 10' of this document: Troubleshooting GlobalProtect, PAN-OS 4.1

Hope that helps!

Thanks,

Aditi

Re: IPSec VPN Setup for Avaya Phone

mario11584 — Wed, 12 Dec 2012 16:52:38 GMT

Thank you,

I understand you may not support it yet but the concept should be the same if I am connecting via the built in IPSec client on the Avaya phone versus the PA IPSec client. It's the same protocol, using the same encryption and authentication methods. I do think you answered my question though. If I am attempting to connect multiple remote devices to the PA over an IPsec VPN connection then Global Protect is the way to go. Correct? I will attempt to get this working using the PA client. Once I confirm that is working I will move over to the Avaya phone and see if I can get that working.

Thanks again!

Re: IPSec VPN Setup for Avaya Phone

JorgeGarza — Fri, 18 Jan 2013 03:06:54 GMT

where you able to get this working? I am trying to setup up multiple avaya phone but the vpn keeps droppig

Re: IPSec VPN Setup for Avaya Phone

mario11584 — Fri, 18 Jan 2013 15:37:53 GMT

Unfortunately, I have not. I have mostly given up on it for the time being. We have another firewall that actually supports the Avaya phones (although it's not an ideal setup). I couldn't even get the phone to connect to the VPN. Which method are you trying? GlobalProtect or IPSec tunnels? If you can get the tunnel working but have disconnect issues maybe I'll give it another try and see what we can figure out.

Re: IPSec VPN Setup for Avaya Phone

JorgeGarza — Fri, 18 Jan 2013 17:11:41 GMT

I am using traditional IPSec tunnels. I will continue to troubleshoot and if I find anything I will let you know.

Re: IPSec VPN Setup for Avaya Phone

mario11584 — Thu, 25 Apr 2013 20:46:02 GMT

I finally got this working and then it stopped working. I used it connected to the GP Portal for a while. I reset it to make sure it would reconnect and it didn't....hmmm...but I did get it to connect!! That's progress!!

On the Palo Alto side under the Client Configuration > Tunnel Settings I enabled IPSec and XAuth Support (of course, I have LDAP up and running). I have the Group Name and Group password configured.

On my Avaya 9602L model phone I have the following configs:

GENERAL menu

VPN: Enabled

VPN Vendor: Other

Gateway Address...

(your GP Gateway IP address here)

External Phone IP Address...

(pulled via DHCP)

External Router...

(pulled via DHCP)

External Subnet Mask...

(pulled via DHCP)

External DNS Server...

(pulled via DHCP)

Encapsulation: RFC(500-500)

Copy TOS: NO

AUTH. TYPE menu

Auth. Type: PSK

IKE PSK menu

IKE ID (Group Name)...

(your group name goes here)

Pre-Shared Key (PSK)...

(your group password goes here)

IKE PHASE 1 menu

*Used Avaya phone defaults

(Make sure IKE Xchg Mode is aggressive)

IKE PHASE 2 menu

*Used Avaya phone defaults

IKE Over TCP menu

*Used the Avaya phone default (never)

Re: IPSec VPN Setup for Avaya Phone

ericgearhart — Wed, 12 Jun 2013 02:21:27 GMT

did you try configuring a tunnel monitor for the device? I noticed that tunnels would go down and not come back up on PA devices I was configuring IPsec tunnels on when I didn't configure a tunnel monitor. I guess for the tunnel monitor you might try configuring only one IP address for the phone itself inside the tunnel, and then for the tunnel monitor plug in the phone's only IP address as the IP to 'monitor'.

The big clue that the issue was specifically related to tunnel monitoring was that I could clear the IPSec/IKE SAs on the PA CLI and then the tunnel would come back in... maybe the issue is basically the same for you?

Re: IPSec VPN Setup for Avaya Phone

Retired Member — Fri, 20 Dec 2013 03:22:51 GMT

Hi - did you try disabling "Skip Auth on IKE Rekey" under the Gateway --> Client Configuration --> Tunnel Settings

Re: IPSec VPN Setup for Avaya Phone

mario11584 — Fri, 20 Dec 2013 15:30:49 GMT

Egearhart, thanks for the response and sorry for my late response. Apparently I missed your reply. The short answer to your question is I tried this. I've tried removing the tunnels and rebuilding literally dozens of times with dozens of different configurations. I could never get it to come back up.

Re: IPSec VPN Setup for Avaya Phone

mario11584 — Fri, 20 Dec 2013 15:36:22 GMT

Angelo, thank you as well for your response. Yes, I've tried this. Honestly, I gave up on trying to do this with the PAs. We just bought a different firewall for the phones. We still use the PAs for our primary firewalls because I love them. This is the only problem I've had with them, although, I probably can't consider it a problem because they've said they don't support Avaya...yet. If they release firmware that supports them I'll probably switch back to the PAs. Then I can kick the other firewall to the curb because those I don't love.

Re: IPSec VPN Setup for Avaya Phone

pperrotta — Thu, 15 May 2014 16:41:27 GMT

Anybody know if this is now supported on the 6.0 PA firewalls?

Re: IPSec VPN Setup for Avaya Phone

OrazioMuccitelli — Fri, 02 Oct 2015 11:38:41 GMT

I'm facing as well issues setting up remote Avaya ip_Phones to work over the PA.

Have anybody ever managed to have this up and running?

Re: IPSec VPN Setup for Avaya Phone

dbrenipc — Tue, 26 Jul 2016 19:13:54 GMT

I am also having the same issue, did anyone ever get it setup ?

regards,

Don

Re: IPSec VPN Setup for Avaya Phone

googol — Thu, 28 Jul 2016 20:41:21 GMT

Nope, told it was not supported by Palo Alto and that it is a feature request. From my understanding, bunch of people have voted for it.

Feature request #1844 --- Avaya IP Phones and VPN with PAN

Have your SE vote for it everyone!!

Re: IPSec VPN Setup for Avaya Phone

PradeepKumarMall — Thu, 20 Apr 2023 12:20:24 GMT

Hi,

To setup VPN Tunnel for Avaya IP Phones, you just need to configure RemoteVPN (GlobalProtect) and need to enable x-auth, thats it. X-Auth is the feature which is must to connect the Avaya IP Phones (as it considered as 3rd party vpn client). You dont need to have GlobalProtect license as Avaya IP Phones Operating Systems dont fall in Mobile/Tablet devices.

I just implemented in April 1st Week. I was migrating all Avaya IP Phones VPNs from Cisco ASA to PaloAlto firewalls and it worked without any issues.

Re: IPSec VPN Setup for Avaya Phone

PradeepKumarMall — Thu, 20 Apr 2023 12:33:20 GMT

I can say, YES we support VPN for Avaya IP Phones. We just need to enabled "x-auth" option. No additional configurations/setting required. Not even GlobalProtect License required for setting up VPN Tunnel for Avaya IP Phones.