Overview of Secure VPN Implementation - Page 19
VPN and VoIP
Telephony
IP Office incorporates many advance telephony features which can be used in
conjunction with VPN networking to provide secure speech over the Internet. Using
such features as Small Community Networking, it is possible to create a virtual PABX
that is transparent to the physical location.
VoIP
IP Office marks VPN packets with the DSCP value of the encapsulated VoIP packet.
Under normal condition this allows IPSec or L2TP encapsulated packets to be
distinguished and prioritized over non-voice traffic. Necessarily on slow speed links,
packets may be re-ordered or dropped in support of voice quality when running QoS
mechanisms. However, IPSec and LT2P packets cannot be excessively re-ordered
which is an issue when mixing IPSec with VoIP and non-VoIP traffic over a heavily
congested link.
IPSec is the primary VPN security protocol and is a licensable IP Office feature. To
support IPSec with VoIP and non-VoIP traffic IP Office running version 3.0+ software
employs a pre-emptive IPSec QoS mechanism that ensures that QoS is applied to
packets before the IPSec process. This way, IPSec packet loss and packet re-ordering
is significantly reduced.
The IPSec QoS feature is only available to IPSec. If it is a requirement to run L2TP with
a mix VoIP and non-VoIP traffic then L2TP must be encapsulated in IPSec.
Under link congestion the IPSec QoS works on a pre-emptive basis by controlling the
amount of packets that are sent to the IPSec engine and prioritizes VoIP traffic over
non-VoIP traffic. In this way packet discard, when it occurs, will be on the inbound
router interface. The provisions of the IPSec QoS mechanism allow for QoS support on
slow speed xDSL links for example.
For voice traffic, IP Office performs concurrent call load restrictions on a per call basis
and does not assume the bandwidth requirement. The IP line is used to configure
concurrent call restrictions and works on the basis of an “allowed number of calls”
irrespective of bandwidth. Hence, whilst IP Office is configured in terms of “an allowed
number of calls” and not bandwidth requirements, it is important to understand the
bandwidth requirement and calculations for any VoIP link. The bandwidth used by a
given compression type for a single VoIP stream over a given VPN technology can be
calculated using the formula shown below.
RTP Bandwidth:
(L2_ Tunneling _ VoIP_ Payload) X Payload_per_sec X Bit__conversion
For Fax traffic, the bandwidth used can be calculated using the formula shown below.
(L2_ Fax_ Payload) X Payload_per_sec
Notes
:
1. These calculations are strictly to estimate the "media" transport portion of the
bandwidth. Even for the Media transport, an implementation dependent additional
factor (e.g., 10%) should be considered to cover RTCP traffic, transitory effects,
etc. For example, even when header compression is used, it it not effective on
100% of the packets.
2. Separate bandwidth must be allocated for signaling, including call setup and small
community network signaling between systems. This traffic should be given a
separate "assured forwarding" queue treatment, rather than the expedited
forwarding required for RTP, but still must be given bandwidth needed.
An example of the Bandwidth Requirement Calculation is shown on page 21 and a
table of the Bandwidth Calculation Variables used in the formula is shown on page 20.
IP Office (R3.0) Virtual Private Networking
Overview of Secure VPN Implementation - Page 19
40DHB0002UKER Issue 3 (4th February 2005)
Typical VPN Deployment
