This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM SSL VPN and GrandStream Phones

GrandStream phones have an OpenVPN client built in but they only allow the .ca. crt. key to be uploaded to the phone as well as putting inthe VPN server IP, port and protocol. It doesn't allow a login/password field. Contacting Grandstream support they just tell me not to use a login/password. Is this even possible with the UTM. Keeping in mine I have about 150 VPN users so making a major change to the SSL VPN isn't an option because those 150 would need to redownload configs.

Can you make a local user who is cert based only?

all our others users are AD/Radius backend sync

This thread was automatically locked due to age.

Parents

0 BAlfson over 7 years ago

If they don't have a builtin user and password, you're out of luck with the UTM's implementation of OpenVPN. There's no way to create a blank user with a blank password.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to BAlfson

That is what I was afraid of. And they are telling me to just turn off the login/pass option on the OpenVPN server and just use certs.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

JayMan said:

I made headway. It is now with the devs.

Hey this is great to hear. Have you had any update from Grandstream Devs?

I also have Remote workers and hate the fact that I have to but a RED for people that have Public Dynamic IP's and having to create rules for those that have Statics.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

Not a peep. I say put in a ticket like I did.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

Well now here is some breaking news. The newest beta firmware for the GrandStream 21xxx models has a LOGIN AND PASSWORD option for OpenVPN. I was able to get it working on my UTM today with very little effort.

Just download the Linux openvpn files from the UTM and upload the crts and the key and away you go. You do need to make sure compression is enabled on the UTM for the OpenVPN/SSL Options.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

Holy CRAP something actually worked.....

Just attached my 2160 to a XG135... Now to do some serious testing...

Good eye on the firmware, to be honest I gave up on this months ago.

Are you running UTM or XG? I didnt see any compression settings in my XG but in all the excitement I could have overlooked it.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

UTM and it is under the VPN settings.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Monnich over 7 years ago in reply to JayMan

Hmm ok. Im running XG.

Did some basic testing and was able to get the phone connected to the remote network but not to my PBX.

So I still have some work to do. setting up a VOIP ssl vpn group and apply rules to route them to a specific Vlan.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

I may have to setup a firewall rule or even ACL's outside of the UTM to say the VPN DHCP Pool can reach your PBX.

Also on the phone I had to set Nat Transverse to VPN or I just got one sided audio.
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 7 years ago in reply to Chris Monnich

I found an issue. Every 3600 seconds during the TLS resync will cause the phones to blip out for 1-2 seconds. I need to be able to change this option on the VPN to fix it. I don't know if it is a server or client side option --reneg-sec n
Cancel
Vote Up 0 Vote Down

Cancel
0 brunomc over 7 years ago in reply to JayMan

JayMan see my reply here and disregard the firmware comment community.sophos.com/.../openvpn-option-for---reneg-sec-n
Cancel
Vote Up 0 Vote Down

Cancel
0 JayMan over 6 years ago in reply to Emile Belcourt

FYI it all works now on the newer grandstreams even the latest beta firmware came out with a field to put in openvpn options to solve for the 3600 SSL regen issue.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JayMan over 6 years ago in reply to Emile Belcourt

FYI it all works now on the newer grandstreams even the latest beta firmware came out with a field to put in openvpn options to solve for the 3600 SSL regen issue.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data