Year: 2025

Most Cisco SIP Phones support connecting to a VPN server directly which makes it easy to connect phones which are outside the usual network. When connecting to a VPN they utilize Ciscos’ AnyConnect protocol, which usually requires a costly license to be used. However, due to the efforts of the team behind the OpenConnect VPN Server that is no longer the case (and has been for quite a while now). In this guide, I want to show you how to set up your server and phone to be able to properly communicate. There are a few bits of information and discussion out there, however, I was unable to find something like a complete guide. So let’s get started!

Requirements

A few components are required to get this up-and-running. I also assume that the reader has basic understanding of network and the usage of linux.

• Cisco SIP Phone (I used an 8851 on MPP firmware)
• PBX Server (for the phone to log into, I used FreePBX)
• VM/Server to run OcServ
• Public domain with SSL certificate

Preparations

I recommend you first build a simple setup to evaulate if the SIP itself works before introducing more complexity. This however is out of scope for this article as there are many guides on the internet on how to setup FreePBX and Cisco Phones.

This guide is based on Debian systems. This leads to one issue: the ocserv version currently shipped with Debian is outdated and won’t work with the Cisco Phones, for that reason, we need to compile a newer version of ocServ. For this guide4 we will use ocServ 1.3.0. Here’s how:

1. Grab the Tarball “Package” file from the official ocServ gitlab
2. Unpack it on your VPN server (tar -xvf ocserv-1.3.0.tar.xz)
3. Enter the newly unpacked directory (cd ocserv-1.3.0)
4. Follow the basic compilation instructions (./configure && make)
5. Run sudo make install to install the ocserv package

Configuring ocServ

In most cases you want to run OcServ as a service, meaning it will restart on failure and start on bootup. For my setup, I use this Systemd service file in /etc/systemd/system/ocserv.service

[Unit]
Description=OpenConnect SSL VPN server
Documentation=man:ocserv(8)
After=network-online.target

[Service]
PrivateTmp=true
PIDFile=/run/ocserv.pid
Type=simple
ExecStart=/usr/local/sbin/ocserv --log-stderr --foreground --pid-file /run/ocserv.pid --config /etc/ocserv/ocserv.conf
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

It is also recommended to create a service user for ocserv to use (which I already had, because I previsuouly tried to use the apt-shipped version of ocserv).

After setting ocserv up as a service we need to change it’s configuration file found in /etc/ocserv/ocserv.conf.

First of all, you have to decide on an authentication strategy, for most test cases “plain” is fine. If you want to run a more complete and productive setup it is however recommended you use PAM, radius or similar services. For this guide, I will use plain auth due to its simplicity. That’s why I enable this line in the config:

auth = "plain[passwd=/etc/ocserv/ocpasswd]"

If you created a service user beforehand it is recommended to set run-as-group and run-as-user:

run-as-user = ocserv
run-as-group = ocserv

As mentioned you need a valid TLS certificate to be able to properly run the server. How you get this heavily depends on your setup and is out-of-scope for this guide. A good starting point might be Let’s Encrypt. Your certificates need to be configured as well, just like your domain:

server-cert = /opt/certs/example.org/fullchain.pem
server-key = /opt/certs/example.org/privkey.pem
default-domain = vpn.example.org

Make sure the network configuration fits in with your own setup, which requires setting ipv4-network to an address space for clients to use. You also need to configure a valid DNS-server and routes which will allow connection to your PBX server.

There are also a few phone-specific changes you should make. First of all: turn compression off, as it might mess with latency. You also need to enable cisco-client-compat.

compression = false
cisco-client-compat = true

Now restart and enable the ocserv service and your OpenConnect server is ready to go:

sudo systemctl enable ocserv && systemctl restart ocserv

Setting up a user

To create a plaintext user run the command ocpasswd USERNAME and enter your password when prompted.

Testing the connection

If you want to make sure that you properly set up your server and certificate you can use the openconnect utility (the one from apt works well here). Simply type your server address in and you should see a user prompt:

Setting up the phone

This section might differ from model to model and MPP / non-MPP firmware. At the time of writing this I run my CP-8851 on the MPP firmware 12.0.7.

As a very first step, we need to upload a custom CA to the phone, as the default CAs shipped with the current firmware almost exclusively include Cisco CAs. (A complete list can be found here). Which CA you need to upload depends on your root certificate. For Let’s Encrypt you need either ISRG Root X1 or X2. These root CAs can be downloaded from the Let’s Encrypt website here. You need to get them in the “pem” format:

Getting them on the phone can be a little tricky, I used the Windows utility tftpd64 which has proved itself useful in the past. You simply need to place the .pem file into the “Current Directory” folder (1) and select the proper server interface (2) from the dropdown.

Now we need to tell the phone where to find a new CA. Visit https://yourphoneip/admin/advanced then go to Voice > Provisioning > CA Settings. Then enter tftp://yourpcip/isrg-root-x1-cross-signed.pem (or isrg-root-x2-cross-signed.pem). After clicking the phone should pull a new certificate from your tftp server. To confirm a successful download you can head to Info > Download Status and check for “Custom CA Status”. The Custom CA Info should read something like: Installed - /C=US/O=Internet Security Research Group/CN=ISRG Root X1

Now, that the CA is properly setup, configureing the VPN is a breeze. Head to Voice > System > VPN Settings and enter your server domain, username and password. After configuring these settings press .

First test flight

On your Cisco Phone, press the applications button , then select 5 Network Configuration > VPN settings. Then scroll down to “Enable VPN connection” and press the naviagation cluster (big round button). The phone should then connect to the VPN and restart. After rebooting a globe with lock icon should be shown in the top right corner which indicates a proper connection.

Conclusion

You successfully setup a connection to your own VPN, congratulations! If you want to connect to your VPN on phone startup, you should enable that option.

If you want to learn more about FreePBX and Asterisk I recommend you check out my other posts on the topic: