<div dir="ltr"><div>Ok, I just had an 'a-ha' moment.</div><div>�</div><div>If I turn off auto network detect and set the VPN setting in the phone to 'On' it will always connect, provided it can reach the internet and the ASA is reachable.� No proxy arp problems and no worries about the user's home network.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Nov 1, 2013 at 12:50 PM, Erick Wellnitz <span dir="ltr"><<a href="mailto:ewellnitzvoip@gmail.com" target="_blank">ewellnitzvoip@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Auto Network Detect is indeed enabled.� According to the following link, the phone pings the TFTP server.� If there is no response the phone should initiate the VPN connection.� I'm not very familiar with proxy arp so does that mean the router would respond to pings to my TFTP server?</div>
<div>�</div><div>Alternate TFTP is also set.� </div><div>�</div><div>The problem with turning off Auto Network Detect is that many of the intended users of the phone vpn are non-technical so it needs to be plug and play.� Is there a knowledge base of some of the routers that work well with phone VPN?</div>
<div>�</div><div>�</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Nov 1, 2013 at 8:32 AM, Brian Meade (brmeade) <span dir="ltr"><<a href="mailto:brmeade@cisco.com" target="_blank">brmeade@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div lang="EN-US" vlink="purple" link="blue">
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Erick,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u>�<u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">That should be the only way the CAPF.pem is able to be regenerated.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u>�<u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Do you have Auto Network Detect enabled on the VPN profile?� If so, you might want to try creating a new profile for that user with it turned off.� Auto Network
Detect doesn�t work well with some home routers due to proxy ARP.� Do you have the Alternate TFTP hard set on the phone as well?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u>�<u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Brian<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u>�<u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">From:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt"> Erick Wellnitz [mailto:<a href="mailto:ewellnitzvoip@gmail.com" target="_blank">ewellnitzvoip@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, October 31, 2013 6:01 PM<br>
<b>To:</b> Brian Meade (brmeade)<br>
<b>Cc:</b> cisco-voip<br>
<b>Subject:</b> Re: [cisco-voip] phone hardware / LSC question - 8945<u></u><u></u></span></p>
<p class="MsoNormal"><u></u>�<u></u></p>
<div>
<div>
<p class="MsoNormal">LSC shows as installed.� The VPN wouldn't even try to connect and it wouldn't allow us to turn VP Non in the settings.� Nothing had changed prior to when it stopped working.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">�<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The only way CAPF.pem would get regenerated is by doing so through certificate management, correct?<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u>�<u></u></p>
<div>
<p class="MsoNormal">On Thu, Oct 31, 2013 at 4:50 PM, Brian Meade (brmeade) <<a href="mailto:brmeade@cisco.com" target="_blank">brmeade@cisco.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">It should be saved on the built-in flash just like the MIC.� Does the phone show the LSC as being
installed?� </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">�</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">The console logs are really good for VPN issues.� It should print out exactly why the VPN connection
is failing with the new LSC.� Has your CAPF.pem been regenerated on the publisher since the last time you issued phone VPN LSCs?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">�</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Brian</span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">From:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Erick Wellnitz<br>
<b>Sent:</b> Thursday, October 31, 2013 5:16 PM<br>
<b>To:</b> cisco-voip<br>
<b>Subject:</b> [cisco-voip] phone hardware / LSC question - 8945</span><u></u><u></u></p>
<p class="MsoNormal">�<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Phone hardware question.� Does the LSC get stored somewhere other than the same place the firmware image gets stored on the phone?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">�<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The reason I ask is we had a VPN phone lose power a few days back (probably not connected to a surge protector).� Had the user bring the phone into the office to reinstall the LSC
and it still could not connect to the VPN.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">�<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Anyone ever encountered something like this?<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u>�<u></u></p>
</div>
</div>
</div>
</blockquote></div><br></div>
</blockquote></div><br></div>