Preparations<\/h2>\n\n\n\n
I recommend you first build a simple setup to evaulate if the SIP itself works before introducing more complexity. This however is out of scope for this article as there are many guides on the internet on how to setup FreePBX and Cisco Phones.<\/p>\n\n\n\n
This guide is based on Debian systems. This leads to one issue: the ocserv version currently shipped with Debian is outdated and won’t work with the Cisco Phones, for that reason, we need to compile a newer version of ocServ. For this guide4 we will use ocServ 1.3.0. Here’s how:<\/p>\n\n\n\n
- \n
- Grab the Tarball “Package” file from the official ocServ gitlab<\/a><\/li>\n\n\n\n
- Unpack it on your VPN server (
tar -xvf ocserv-1.3.0.tar.xz<\/code>)<\/li>\n\n\n\n- Enter the newly unpacked directory (
cd ocserv-1.3.0<\/code>)<\/li>\n\n\n\n- Follow the basic compilation instructions<\/a> (
.\/configure && make<\/code>)<\/li>\n\n\n\n- Run
sudo make install<\/code> to install the ocserv package<\/li>\n<\/ol>\n\n\n\nConfiguring ocServ<\/h2>\n\n\n\n
In most cases you want to run OcServ as a service, meaning it will restart on failure and start on bootup. For my setup, I use this Systemd service file in
\/etc\/systemd\/system\/ocserv.service<\/code><\/p>\n\n\n\n[Unit]\nDescription=OpenConnect SSL VPN server\nDocumentation=man:ocserv(8)\nAfter=network-online.target\n\n[Service]\nPrivateTmp=true\nPIDFile=\/run\/ocserv.pid\nType=simple\nExecStart=\/usr\/local\/sbin\/ocserv --log-stderr --foreground --pid-file \/run\/ocserv.pid --config \/etc\/ocserv\/ocserv.conf\nExecReload=\/bin\/kill -HUP $MAINPID\n\n[Install]\nWantedBy=multi-user.target<\/code><\/pre>\n\n\n\nIt is also recommended to create a service user for ocserv to use (which I already had, because I previsuouly tried to use the apt-shipped version of ocserv). <\/p>\n\n\n\n
After setting ocserv up as a service we need to change it’s configuration file found in
\/etc\/ocserv\/ocserv.conf<\/code>.<\/p>\n\n\n\nFirst of all, you have to decide on an authentication strategy, for most test cases “plain” is fine. If you want to run a more complete and productive setup it is however recommended you use PAM, radius or similar services. For this guide, I will use plain auth due to its simplicity. That’s why I enable this line in the config:<\/p>\n\n\n\n
auth = \"plain[passwd=\/etc\/ocserv\/ocpasswd]\"<\/code><\/pre>\n\n\n\nIf you created a service user beforehand it is recommended to set run-as-group and run-as-user:<\/p>\n\n\n\n
run-as-user = ocserv\nrun-as-group = ocserv<\/code><\/pre>\n\n\n\nAs mentioned you need a valid TLS certificate to be able to properly run the server. How you get this heavily depends on your setup and is out-of-scope for this guide. A good starting point might be Let’s Encrypt. Your certificates need to be configured as well, just like your domain:<\/p>\n\n\n\n
server-cert = \/opt\/certs\/example.org\/fullchain.pem\nserver-key = \/opt\/certs\/example.org\/privkey.pem\ndefault-domain = vpn.example.org<\/code><\/pre>\n\n\n\nMake sure the network configuration fits in with your own setup, which requires setting
ipv4-network<\/code> to an address space for clients to use. You also need to configure a valid DNS-server and routes which will allow connection to your PBX server.<\/p>\n\n\n\nThere are also a few phone-specific changes you should make. First of all: turn compression off, as it might mess with latency. You also need to enable
cisco-client-compat<\/code>.<\/p>\n\n\n\ncompression = false\ncisco-client-compat = true<\/code><\/pre>\n\n\n\nNow restart and enable the ocserv service and your OpenConnect server is ready to go:<\/p>\n\n\n\n
sudo systemctl enable ocserv && systemctl restart ocserv<\/code><\/pre>\n\n\n\nSetting up a user<\/h3>\n\n\n\n
To create a plaintext user run the command
ocpasswd USERNAME<\/code> and enter your password when prompted.<\/p>\n\n\n\n![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-27-17-a7cd4dc7-0aab-4efb-a787-35145b14c9ef.png\")
<\/figure>\n<\/div>\n\n\nTesting the connection<\/h3>\n\n\n\n
If you want to make sure that you properly set up your server and certificate you can use the openconnect utility (the one from apt works well here). Simply type your server address in and you should see a user prompt:<\/p>\n\n\n\n
![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-00-39-30c6ae4a-f66d-454e-8502-8f2d14375aca-1024x146.png\")
<\/figure>\n\n\n\nSetting up the phone<\/h2>\n\n\n\n
This section might differ from model to model and MPP \/ non-MPP firmware. At the time of writing this I run my CP-8851 on the MPP firmware 12.0.7.<\/p>\n\n\n\n
As a very first step, we need to upload a custom CA to the phone, as the default CAs shipped with the current firmware almost exclusively include Cisco CAs. (A complete list can be found here<\/a>). Which CA you need to upload depends on your root certificate. For Let’s Encrypt you need either ISRG Root X1 or X2. These root CAs can be downloaded from the Let’s Encrypt website here<\/a>. You need to get them in the “pem” format:<\/p>\n\n\n\n
![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-08-34-5d3f3260-97aa-4e97-916d-eaafc8403fe2.png\")
<\/figure>\n\n\n\n - Unpack it on your VPN server (
![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-10-59-3fb36e64-c2ac-4d09-8a74-05d2678b3f07.png\")
<\/figure>\n\n\n\n![\"Submit](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-15-34-560ced46-a417-49bb-971b-8acccd167138.png\")
the phone should pull a new certificate from your tftp server. To confirm a successful download you can head to Info > Download Status and check for “Custom CA Status”. The Custom CA Info should read something like: ![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-13-39-2a8adf14-ef83-4d44-a290-a67d1fbb856c-1024x515.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-19-15-fcd1a6c0-fc33-4f21-bb8b-2eea4b056dfb-1024x514.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/2025-02-15_15-21-59-39d9a25c-f1f9-4cf0-aff9-564699b9e932.png\")
, then select 5 Network Configuration > VPN settings. Then scroll down to “Enable VPN connection” and press the naviagation cluster (big round button). The phone should then connect to the VPN and restart. After rebooting a globe with lock icon should be shown in the top right corner which indicates a proper connection.<\/p>\n\n\n\n![\"Courtesy](\"https:\/\/thegreydiamond.de\/blog\/wp-content\/uploads\/2025\/02\/ciscoPhoneVPN-1024x585.webp\")
\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t