Watchguard SSL 1000, User Manual

Page: 69 / 198

Administration Guide 59
Improving Voice over IP Connections
To deny access to user groups without an ACL
1 Click the Global Cluster Policies tab.
2 Under Access Options , select Deny Access without ACL .
3 Click Submit .
Improving Voice over IP Connections
Real-time applications, such as voice and video, are implemented over UDP. TCP is not appropriate for
real-time traffic due to the delay introduced by acknowledgements and retransmission of lost packets. It
is more important to deliver packets in real time than to ensure that all packets are delivered. However,
with any tunneling technology over TCP, such real-time performances cannot be met.
The Firebox SSL VPN Gateway overcomes this issue by routing UDP packets over the secure tunnel as
special IP packets that do not require TCP acknowledgements. Even if the packets get lost in the net-
work, no attempt is made by either the client or the server applications to regenerate them, so real-time
(UDP like) performance is achieved over a secure TCP-based tunnel.
When the Firebox SSL VPN Gateway is installed as a stand alone appliance, and users connect using the
Secure Access Client, two-way communication is supported with the following voice over IP (VoIP) soft-
phones:
• Avaya IP Softphone
•
Nortel IP Softphone
•
Cisco IP Softphone
•
Cisco IP Communicator
Secure tunneling is supported between the manufacturer’s IP PBX and the softphone software running
on the client computer. To enable the VoIP traffic to traverse the secure tunnel, you must install the
Secure Access Client and one of the softphones listed above on the same system. When the VoIP traffic
is tunneled over the secure tunnel, the following softphone features are supported:
• Outgoing calls that are placed from the IP softphone
•
Incoming calls that are placed to the IP softphone
•
Bidirectional voice traffic
Enabling Improving Voice over IP Connections
Voice over IP (VoIP) traffic is carried over the UDP protocol. This kind of traffic is very sensitive to latency.
The Firebox SSL VPN Gateway tunnels the UDP traffic through SSL connections. If you experience
latency in your VoIP application, you can select the
Improving Voice over IP Connections setting to
minimize latency and improve the audio quality.
When you select this setting, the Firebox SSL VPN Gateway employs weaker encryption ciphers (56-bit).
These weaker ciphers are used for all traffic that is transmitted using the UDP protocol, not just the VoIP
traffic. Before selecting this option, you might want to consider the security implications of using these
weaker ciphers to encrypt the UDP traffic.
The specific ciphers used to encrypt the UDP traffic include
• RSA EXP 1024, RC4 56 Bit, MD5
•
RSA EXP 1024, RC4 56 Bit, SHA