Cisco 7965 phone connecting via VPN to XG135

Question

i am trying to have cisco 7965 phones to connect via VPN to our XG firewall to no avail 
 Tried every single article I found and no dice. 
 Anyone tried this or have any suggestions?

emmosophos · Answer

Hello Kevin, Thank you for contacting the Sophos Community. Are you using what type of VPN? I would think it is IPsec (site-to-site VPN) but please confirm. I would check first if you are seeing traffic from the phones arriving to the XG on port 5060 on the Advanced Shell (5>3) #tcpdump -nei ipsec0 port 5060 #tcpdump -nei ipsec0 host and host grep 4) console> drop-packet-capture 'host or host regards,

JasP · Answer

You are going to have to give a lot more info about your setup to get any meaningful suggestions and even then I suspect there is probably not a lot of people with Cisco voice knowledge on this forum. 
 We do have a 7975 (SCCP) working over a site to site VPN between Sophos XG (Cisco CME) and a Cisco router (handset). I don't remember any particular issues getting it working. Authentication failures are often because of TFTP issues. However the handset gets its IP, it will need to have option 150 set. I would start with debugging on your Cisco voice solution to try and find what is failing and work from there. If you are using CME you can try "debug ephone detail" and "debug tftp events". You can also try downloading files via TFTP (using putty) from the CME/CUCM at the client end to check that is working.