This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM SSL VPN and GrandStream Phones

GrandStream phones have an OpenVPN client built in but they only allow the .ca. crt. key to be uploaded to the phone as well as putting inthe VPN server IP, port and protocol. It doesn't allow a login/password field. Contacting Grandstream support they just tell me not to use a login/password. Is this even possible with the UTM. Keeping in mine I have about 150 VPN users so making a major change to the SSL VPN isn't an option because those 150 would need to redownload configs.

Can you make a local user who is cert based only?

all our others users are AD/Radius backend sync

This thread was automatically locked due to age.

Parents

0 BAlfson over 8 years ago

If they don't have a builtin user and password, you're out of luck with the UTM's implementation of OpenVPN. There's no way to create a blank user with a blank password.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 8 years ago in reply to BAlfson

That is what I was afraid of. And they are telling me to just turn off the login/pass option on the OpenVPN server and just use certs.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 8 years ago in reply to JayMan

I made headway. It is now with the devs.
Cancel
Vote Up 0 Vote Down

Cancel
0 Emile Belcourt over 8 years ago in reply to JayMan

Hi JayMan,

That's great news! Tbh, I would love to use the Grandstream phones that I've deployed to our company in an SSL VPN fashion as that means I can hand a salesperson who switches locations regularly a phone which has ACLs that they can do premium rate calls only from HO IPs, atm I have to allow them to do anything from anywhere.

Would love to hear how it goes!

Emile
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

JayMan said:

I made headway. It is now with the devs.

Hey this is great to hear. Have you had any update from Grandstream Devs?

I also have Remote workers and hate the fact that I have to but a RED for people that have Public Dynamic IP's and having to create rules for those that have Statics.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

Not a peep. I say put in a ticket like I did.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

Well now here is some breaking news. The newest beta firmware for the GrandStream 21xxx models has a LOGIN AND PASSWORD option for OpenVPN. I was able to get it working on my UTM today with very little effort.

Just download the Linux openvpn files from the UTM and upload the crts and the key and away you go. You do need to make sure compression is enabled on the UTM for the OpenVPN/SSL Options.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

Holy CRAP something actually worked.....

Just attached my 2160 to a XG135... Now to do some serious testing...

Good eye on the firmware, to be honest I gave up on this months ago.

Are you running UTM or XG? I didnt see any compression settings in my XG but in all the excitement I could have overlooked it.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

UTM and it is under the VPN settings.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

Hmm ok. Im running XG.

Did some basic testing and was able to get the phone connected to the remote network but not to my PBX.

So I still have some work to do. setting up a VOIP ssl vpn group and apply rules to route them to a specific Vlan.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

I may have to setup a firewall rule or even ACL's outside of the UTM to say the VPN DHCP Pool can reach your PBX.

Also on the phone I had to set Nat Transverse to VPN or I just got one sided audio.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

I found an issue. Every 3600 seconds during the TLS resync will cause the phones to blip out for 1-2 seconds. I need to be able to change this option on the VPN to fix it. I don't know if it is a server or client side option --reneg-sec n
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JayMan over 7 years ago in reply to Chris Monnich

I found an issue. Every 3600 seconds during the TLS resync will cause the phones to blip out for 1-2 seconds. I need to be able to change this option on the VPN to fix it. I don't know if it is a server or client side option --reneg-sec n
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 brunomc over 7 years ago in reply to JayMan

JayMan see my reply here and disregard the firmware comment community.sophos.com/.../openvpn-option-for---reneg-sec-n
Cancel
Vote Up 0 Vote Down

Cancel