Cisco 8861 Deployment Manual page 116

A VPN profile must be configured, which specifies which type of client authentication will be utilized as well as other
parameters.
Once the VPN group and profile have been configured, they can then be applied to a Common Phone Profile, which in turn can
be applied to a specific device.
If the Cisco IP Phone 8861 or 8865 is currently connected to a network and is unable to connect to the Cisco Unified
Communications Manager then it can attempt to establish a VPN session automatically if a VPN profile is configured.
Cisco IP Phone 8861 and 8865 Wireless LAN Deployment Guide
116