background image

 

Configuration Examples - Page 53 

Part 3 VoIP Configuration 

Once a VPN connection is established and working, VoIP configuration can be applied. 
For this reason it is important to have full IP connectivity before beginning VoIP 
configuration. 
Because the VoIP configuration is transparent to the means of IP connectivity, the 
configuration procedure described here can be applied to any of the examples shown in 
earlier sections (see pages 34 and 37). However, for the sake of clarity, the following 
example is specific to the IP Office to IP Office via Logical LAN example shown on 
page 37.  
On completion of the steps detailed in the table below it will be possible make calls 
between Site A and Site B using the IP hard phones, the IP soft phones and the on-
switch phones. 

Task Description 

Step 1 

Check that the IPSec Tunnel is established 
between the two systems (see page 37). 
 
  

Before beginning the VoIP configurations of 
this example it must be possible to perform the 
following tasks: 
Ping between the Internal LANs (through the 
established IPSec tunnel). 
Ping the remote internal system IP address and 
confirm that the resulting packet exchanges are 
shown using the SysMonitor/Interface decode 
options. 
Do not proceed until all tests are successful. 
 

Step 2

 

Within Manager, for Office A create an IP 
Line and apply the following parameters. 
Using the Line tab of the IP Line form: 

• 

Line Number = 2 

• 

OutGoing Group ID = 2 

 

The IP Line is used to configure the VoIP 
Gateway for IP Office. 
IP Line number provides a discriminator to 
other line groups. No two line groups can share 
the same line number 
The Line Group ID as an absolute reference to 
a IP Line. It is permissible for 2 IP Lines to 
share the same Line ID in the case where 
redundancy is required. The IP Line number 
cannot exceed 240. 
 

Step 3

 

Within Manager, for IP Office B create an IP 
Line and apply the following parameters. 
Using the Line tab of the IP Line form: 

• 

Line Number = 3 

• 

OutGoing Group ID = 3 

 

Step 4 

For IP Office A and IP Office B, apply the 
bandwidth restrictions using the Line tab of 
the IP Line forms. 

• 

Number of Channels = 5 

• 

Outgoing Channels = 5  

• 

Voice Channels =5 

• 

Data Channels = 5 

This must be done on 

both 

IP Office A and 

IP Office B 

Under the IP Office (3.0+) implementation, the 
maximum bandwidth that can be used for 
IPSec encrypted VoIP calls is limited to either 
512 (IP412) or 256Kbps (SMO, IP401, IP403, 
IP406). This is enough to allow up to five G729 
calls. 
 
As the total bandwidth between the two xDSL 
lines is 512Kbps this will allow for 256Kbps 
(50%) for non-voice traffic between the two 
locations 
 

 

 

IP Office (R3.0) Virtual Private Networking 

Configuration Examples - Page 53 

40DHB0002UKER Issue 3 (4th February 2005) 

Part 3 VoIP Configuration 

Summary of Contents for IP Office (R3.0)

Page 1: ...IP Office R3 0 Virtual Private Networking 40DHB0002UKER Issue 3 4th February 2005...

Page 2: ...ient VPN 18 Guidelines 18 VPN and VoIP 19 Bandwidth Calculation Variables 20 Bandwidth Requirement Calculation 21 Example 1 21 Example 2 22 Guidelines 22 Maximum Load 23 Configuration 24 IPSec Configu...

Page 3: ...ec Framework 6 Figure 3 LT2P Tunneling Modes 7 Figure 4 Inbound Unprotected Packet 9 Figure 5 Inbound Unprotected Packet Type Detection 10 Figure 6 L2TP Implementation 12 Figure 7 Logical LAN Implemen...

Page 4: ...s Telecommuter Telecommuter Home Home Offices Offices Internet Internet Remote Remote Offices Offices Branch Branch Offices Offices Business Business Partners Partners Mobile Mobile Access Access Main...

Page 5: ...nitor 3 0 Manager 3 0 Cisco IOS using pre shred mode only 12 2 NetScreen Remote VPN Client 10 0 General For secure VPNs the technologies that IP Office supports are IPSec L2TP Compulsory Voluntary opt...

Page 6: ...approach It is important to understand that each of these groups serve a specific purpose and work together to provide a modular solution to Internet security problems By breaking IPSec into these se...

Page 7: ...ol TCP IP L2TP tunneling encapsulates IP data packets in PPP for transmission through an IP network Upon receipt the IP and PPP headers are stripped away exposing the original IP data packet In this w...

Page 8: ...lish the control connection Each L2TP tunnel requires a control connection to be established before any other L2TP messages can be issued It includes an Assigned Tunnel ID that is used to identify the...

Page 9: ...f the inbound unprotected packet matches the condition on any configured IPSec form then a Security Association SA is formed with the specified Secure Gateway Once the SA is established the inbound pa...

Page 10: ...establish the tunnel and thereby form the SA 2 ESP used to carry the encrypted data If the received IPSec packet is an ESP addressed to the IP Office then IP Office will check for a valid SA If a vali...

Page 11: ...antages of IPSec L2TP and the symmetrical relationship between the two IPSec L2TP IPSec in L2TP L2TP Inside IPSec Advantages Encrypts data Disadvantages Packets must not be excessively re ordered in t...

Page 12: ...an L2TP destination Any packet Check Routing Table Forward outside L2TP tunnel Queue Packet or Use Remote Gateway address to establish tunnel Forward inside L2TP tunnel Is the L2TP tunnel established...

Page 13: ...on domain as the System LAN but uses a different MAC address and operates on a different subnet The Logical interface can be regarded as a secondary or a sub interface to the primary System LAN LAN1 i...

Page 14: ...e feature allows single LAN systems to operate external and internal IP subnets in support of VPN networking NAT functionality is applied to traffic from LAN1 using the IP address assigned to the Logi...

Page 15: ...re detailed in the diagram will be discussed with respect to the IP Office 3 0 VPN implementation The following elements will be discussed Public Access Public Interface IP Office VPN solutions Intern...

Page 16: ...sed in conjunction an xDSL or Internet Router Both the Logical or the Physical LAN2 interface dual LAN systems can be used to provide Public Interface functionality as described in the following secti...

Page 17: ...e physical LAN1 interface LAN2 X X The LAN2 is a second physical Ethernet interface NAT NAT allows multiple devices to communicate using a single IP address NAT Reverse Translation x x The function th...

Page 18: ...transparently Using MS Windows once the IPSec connection has been established an L2TP connection can then be established over the IPSec VPN The IP Office Phone Manger Pro application can be used in co...

Page 19: ...mechanism allow for QoS support on slow speed xDSL links for example For voice traffic IP Office performs concurrent call load restrictions on a per call basis and does not assume the bandwidth requir...

Page 20: ...HC 46 Payload Payload The number of bytes per sample Type Value VOIP G711 G723 G729 Net 8K 160 24 20 20 Fax 14400 12000 9600 7200 72 60 48 36 Sample Rate Payload_per_sec The number of samples per seco...

Page 21: ...t to the VoIP compression type that is to be used for G729 this value is 52 For L2TP the value is fixed for all compression types For the case where IPSec and L2TP are used in conjunction e g L2TP pro...

Page 22: ...s 1 IP Office running 3 0 has been limited to 1Mbps of throughput for all traffic types 2 IP Office running 3 0 does not support IPHC for VPN networking 3 IPSec performs IP fragmentation in order to a...

Page 23: ...ftware is because the IPsec encryption and decryption processing is now performed in hardware The encryption and decryption hardware for IPSec removes this processing overhead from the CPU In this way...

Page 24: ...tions to trigger a Security Association SA The IP Security Menu Access to this menu is 1 With the Manager application open click on Tunnel 2 Click the IPSec radio button and then click OK 3 The follow...

Page 25: ...dresses else the packet is discarded Local IP Address Mask defines the source IP address Remote IP Address defines destination IP address For any IP packet that is to be forwarded IP Office determines...

Page 26: ...s 192 168 42 1 Mask 255 255 255 255 b IP Address 192 168 42 0 Mask 255 255 255 0 4 A single condition in terms of addressing can be specified for a given SA The SA condition can be applied between two...

Page 27: ...rtant to understand the requirements in the detail of these tabs but it is however important that they are matched between two IPSec peers seeking to establish an SA During Phase 1 of negotiations IKE...

Page 28: ...hide the IDs of the communicating device ID is slower but does hide the IDs of the communicating device Encryption DES or 3DES Set the encryption method Authentication MD5 128 bit default SHA 160 bit...

Page 29: ...header Also authenticates the packet payload on a packet by packet basis AH No encryption encapsulation or confidentiality Only authentication and integrity Also authenticates portions of the IP head...

Page 30: ...Remote Configuration Account Name and Password Used to set the PPP authentication parameters The Local name is the username that is used in outgoing authentication The Remote name is the username that...

Page 31: ...Retransmission Interval Default 0 The time delay before retransmission Receive Window Size Default 4 The number of unacknowledged packest allowed Sequence numbers on Data Channel Default On When on ad...

Page 32: ...o wait for response to a PPP keep alive message The connection is terminated if the peer fails to respond to 3 LCP Echo Requests Increasing this value will increases the time IP Office takes to determ...

Page 33: ...Address of the next hop router see Guidelines below Gateway MAC Address The Ethernet MAC address of the next hop router see Guidelines below Firewall A Firewall Profile that is associated to this int...

Page 34: ...ows and Unix systems Ethereal provides real time analysis of network traffic and capture to disk The application is available for download at http www ethereal com Some of the examples include packet...

Page 35: ...N interface address Step 3 Within Manager right click the IP Route entity and create a new IP Route Add a default route for Internet access pointing to the Logical LAN interface IP Address un configur...

Page 36: ...16 IP Mask 255 255 255 248 DHCP Disabled Enable NAT selected Firewall Profile un configured Firewall is optional in this configuration This configuration uses the NAT functionality on LAN2 Without thi...

Page 37: ...ng for shared resources Internet access for corporate users Secure IP telephony between corporate sites Figure 19 IP Office to IP Office via Logical LAN The following step by step instructions describ...

Page 38: ...required for each IP Office system in an SA Make sure the IPSec licences are valid on both systems Licence name IPSec Tunneling Step 4 For IP Office A create an IPSec tunnel Main tab Name IPSec_Tunne...

Page 39: ...nnel The Gateway is the IPSec tunnel endpoint address Step 8 For IP Office B use the parameters shown in Steps 5 and 6 to complete the IKE and IPSec form configurations In order for an IPSec SA to be...

Page 40: ...rporate office IP412 IPO_CO is the central VPN terminator and the PABX data router for several remote branch offices equipped with IP Office Small Office Editions Figure 20 L2TP IPSec IP Office to IP...

Page 41: ...ion Step 2 For Branch No 1 create an L2TP tunnel and apply the same parameter values as in the previous step except for the parameter shown below Remote IP Address 217 37 65 126 The Remote IP Address...

Page 42: ...3 0 IP Mask 255 255 255 0 Gateway un configured Destination L2TP 2 IP Address un configured IP Mask un configured Gateway 217 37 69 118 Destination LAN2 These routing entries will allow the tunnel to...

Page 43: ...th tunnel endpoints must have the same shared secret Encryption set to DES Authentication set to MD5 Diffie Hellman Group Group 2 This is the time period before a new key is generated 86400 represents...

Page 44: ...ssages appear This Signifies that the IPSec Tunnel is up When passing data through the tunnel you should see ESP packets on the protocol analyser Use SysMonitor to view PPP packet exchanges PPP echo R...

Page 45: ...hed IPsec tunnel and is not be secured One of the key aspect to this application is that IP Office support Dynamic tunnels IP Office is able to create a Dynamic tunnel in the case were the IP address...

Page 46: ...l ID Type IP address 217 37 69 116 My Identity Pre shared Key password Select Certificate None ID Type IP Address Port All Virtual Adapter Disable Internet Interface Local _NIC_Card_Name IP Address 21...

Page 47: ...ocal IP Mask 255 255 255 0 Tunnel Endpoint IP Address LocalInterface Remote IP Address unconfigured Remote IP Mask unconfigured Tunnel Endpoint IP Address unconfigured A discrete name for the IPSec tu...

Page 48: ...o MD5 This is the time period before a new key is generated 86400 represents one day in seconds Step 7 Check connection Activate the Security Policy on the Windows PC by right clicking the SoftRemote...

Page 49: ...er Compression Mode unselected Multilink QoS unselected In support of numbered PPP interface mode add the following to IP tab of the WAN Service form Location A IP Address 10 10 20 1 IP Mask 255 255 2...

Page 50: ...0 10 20 2 Remote Configuration IP Address 192 168 42 0 IP Mask 255 255 255 0 Tunnel Endpoint IP Address 10 10 20 1 See notes in step 3 above The Local Tunnel Endpoint IP Address is the near end tunnel...

Page 51: ...ation A create an IPSec tunnel see The IP Security Menu on page 24 Main tab Local Configuration Name IPSec_Tunnel IP Address 192 168 42 0 IP Mask 255 255 255 0 Tunnel Endpoint IP Address 192 168 42 1...

Page 52: ...e LAN1 IP address of Location A Step 5 For both IP Office Location A and Location B perform the following IKE Polices tab Shared Secret password Exchange Type ID port Encryption DES Authentication MD5...

Page 53: ...Step 2 Within Manager for Office A create an IP Line and apply the following parameters Using the Line tab of the IP Line form Line Number 2 OutGoing Group ID 2 The IP Line is used to configure the V...

Page 54: ...or IP Office B set the destination VoIP Gateway to the IP address of the Internal interface address of IP Office B Use VoIP tab of the IP Line to set the following parameters Gateway IP Address 192 16...

Page 55: ...s Ensue the following parameters are configured Gatekeeper tab on the system form Auto Create Extension selected Gatekeeper Enable selected LAN1 tab on the System form DHCP Mode Server Ensure that the...

Page 56: ...hange Carrier and local telephone companies to their local subscribers ESP Encapsulating Security Payload Within the IPSec architecture the packet format for algorithms and general issues associated w...

Page 57: ...ame of the company which controls the US patent on the algorithm SA Security Association A relationship established between two or more entities to enable them to protect data they exchange The relati...

Page 58: ...es has been transferred or licensed to Avaya All trademarks identified by or TM are registered marks or trademarks respectively of Avaya Inc All other trademarks are the property of their respective o...

Reviews: