<div dir="ltr"><div>Ok, I just had an 'a-ha' moment.</div><div> </div><div>If I turn off auto network detect and set the VPN setting in the phone to 'On' it will always connect, provided it can reach the internet and the ASA is reachable. No proxy arp problems and no worries about the user's home network.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Nov 1, 2013 at 12:50 PM, Erick Wellnitz <span dir="ltr"><<a href="mailto:ewellnitzvoip@gmail.com" target="_blank">ewellnitzvoip@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Auto Network Detect is indeed enabled. According to the following link, the phone pings the TFTP server. If there is no response the phone should initiate the VPN connection. I'm not very familiar with proxy arp so does that mean the router would respond to pings to my TFTP server?</div>
<div> </div><div>Alternate TFTP is also set. </div><div> </div><div>The problem with turning off Auto Network Detect is that many of the intended users of the phone vpn are non-technical so it needs to be plug and play. Is there a knowledge base of some of the routers that work well with phone VPN?</div>
<div> </div><div> </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Nov 1, 2013 at 8:32 AM, Brian Meade (brmeade) <span dir="ltr"><<a href="mailto:brmeade@cisco.com" target="_blank">brmeade@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div lang="EN-US" vlink="purple" link="blue">
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Erick,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">That should be the only way the CAPF.pem is able to be regenerated.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Do you have Auto Network Detect enabled on the VPN profile? If so, you might want to try creating a new profile for that user with it turned off. Auto Network
Detect doesn’t work well with some home routers due to proxy ARP. Do you have the Alternate TFTP hard set on the phone as well?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Brian<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">From:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt"> Erick Wellnitz [mailto:<a href="mailto:ewellnitzvoip@gmail.com" target="_blank">ewellnitzvoip@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, October 31, 2013 6:01 PM<br>
<b>To:</b> Brian Meade (brmeade)<br>
<b>Cc:</b> cisco-voip<br>
<b>Subject:</b> Re: [cisco-voip] phone hardware / LSC question - 8945<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">LSC shows as installed. The VPN wouldn't even try to connect and it wouldn't allow us to turn VP Non in the settings. Nothing had changed prior to when it stopped working.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The only way CAPF.pem would get regenerated is by doing so through certificate management, correct?<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Oct 31, 2013 at 4:50 PM, Brian Meade (brmeade) <<a href="mailto:brmeade@cisco.com" target="_blank">brmeade@cisco.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">It should be saved on the built-in flash just like the MIC. Does the phone show the LSC as being
installed? </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">The console logs are really good for VPN issues. It should print out exactly why the VPN connection
is failing with the new LSC. Has your CAPF.pem been regenerated on the publisher since the last time you issued phone VPN LSCs?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:"Calibri","sans-serif";font-size:11pt">Brian</span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Tahoma","sans-serif";font-size:10pt">From:</span></b><span style="font-family:"Tahoma","sans-serif";font-size:10pt"> cisco-voip [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On Behalf Of </b>Erick Wellnitz<br>
<b>Sent:</b> Thursday, October 31, 2013 5:16 PM<br>
<b>To:</b> cisco-voip<br>
<b>Subject:</b> [cisco-voip] phone hardware / LSC question - 8945</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Phone hardware question. Does the LSC get stored somewhere other than the same place the firmware image gets stored on the phone?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The reason I ask is we had a VPN phone lose power a few days back (probably not connected to a surge protector). Had the user bring the phone into the office to reinstall the LSC
and it still could not connect to the VPN.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Anyone ever encountered something like this?<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote></div><br></div>
</blockquote></div><br></div>