ASA Phone Proxy

[tolya]

I'm trying to setup this feature on ASA 5505 and phone can successfully download a configuration file, but it can't register to CUCM server.

I can see the following message from debug inspection tls-proxy:

TLSP d5087d20: Using trust point '_internal_myctl_SAST_0' with the Client, RT proxy d5491f90

TLSP d5087d20: Waiting for SSL handshake from Client outside:192.168.1.5/52067.

TLSP d5087d20: --> Proxy Rx 52 bytes

TLSP d5087d20: <== Proxy Tx 7 bytes

TLSP d5087d20: new event: KILL_FLOW

TLSP d5087d20: new event: KILL_FLOW

TLSP d5087d20: Tear down proxy for Client outside:192.168.1.5/52067.

TLSP d5087d20: Tear down proxy for Server inside:172.48.155.233/2000.

Config attached.

[gogasca]

Under CUCM server is the CUCM with an IP address or using name and DNS suffix configured?

Is the Cisco UCM Cluster secure or non-secure?

what is the message displayed in the IP Phone when attempting to register?

What is the message for Phone status messages?

Which Phone model?

Thanks

[tolya]

CUCM is configured with IP address only. It's working in non-secure mode.

Message displayed on the IP phone is "Registering"

Status messages show that Phone successfully downloaded CTL file, configuration file and Locale, but nothing more.

Phone model is 7962 and I've tried it with 7941 with the same result..

[tolya]

Any thoughts?

[ezerangue]

I see the 192.168 is outside, and 172.22 is inside? You show the callmanager ip's to be

record-entry cucm-tftp trustpoint tftp_server address 192.168.1.11

record-entry cucm trustpoint sec_cucm address 192.168.1.12

record-entry cucm trustpoint pri_cucm address 192.168.1.11

Are these the actual ip address of Callmanager?

[tolya]

These IPs are NAT translated addresses. Should they be real IP addresses?

[redrobish]

Hi Tolya,

I'm on the same boat as you are. Hope you can share your config when you successfully done it...

thnks