Situation: Need to provide better QoS for VoIP calls between offices travelling over VPN connected by DSL.
Details: I have one main corporate office and two remote offices all currently connected via site-to-site VPN connections using Cisco 837 routers. At our main site, we have a Tier 3 DSL connection with 1.5Mbps up and 768kbps down. The two remote sites both have SDSL connections at 512kbps up and down.
We have a VoIP phone system with about 5 users at each of the remote offices and 10 users at the main office. The calls work relatively well currently until someone starts some heavy download at the remote offices and the VoIP calls are stomped on.
What I need to know is, are there some better ways of providing QoS for the VoIP calls since they're travelling on a VPN through DSL connections?
Currently, I've tried using the priority queueing options (priority-list command) on the 837's for some of the VoIP ports. The problem with this is that the particular VoIP phone system I'm using (Altigen), uses UDP ports around the 49000 range for the phones, and it can use any one of like 250 ports which is not very effective to add to the priority-list.
So, any thoughts would be greatly appreciated. Thanks! Please let me know if you need further details.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
It would certainly be an option, but how would you do this on a Cisco 837 (that's where the VPN originates and terminates on each end)? By the way, the VoIP packets bandwidth are 6.3k per call. So yes, it is very low bandwidth. I just need to make sure that normal data traffic doesn't stomp on it. Please let me know how I would go about this. Thanks.
QoS is an end to end concept, so without switches that support 802.1q and 802.1p you may have limited success. However, the 837 does support low latency queuing (LLQ). Look at the following config for consideration (I have another method to try if this does not work well):
! DEFINE A CLASSIFICATION MAP CALLED "VOICE" AND ASSIGN 802.1P LEVEL 5 TO IT
class-map match-all voice
match ip precedence 5
!
! DEFINE A POLICY MAP NAMED "LLQ", ASSIGN CLASSIFICATIONS TO IT WITH A PRIORITY LEVEL.
! I USE A PRIORITY OF 300 (CLASS VOICE) TO SUPPORT TWO SIMULTANEOUS G.711 CALLS
! I USE WFQ (BEST EFFORT) FOR ALL NON-VOICE TRAFFIC
policy-map LLQ
class voice
priority 300
class class-default
fair-queue
!
! DEFINE A POLICY MAP FOR TRAFFIC SHAPING TO THE REMOTE SIDE WITH AVERAGE SET <TOTAL-VOICE
! DEFINE A SERVICE POLICY (LLQ) TO ASSOCIATE THE TWO POLICY MAPS TOGETHER
policy-map shape
class class-default
shape average 2250000
service-policy LLQ
!
! APPLY THE SERVICE POLICY MAP FOR SHAPING TO e1 ... ONLY e1 SUPPORTS THIS.
interface Ethernet1
ip address 192.168.1.101 255.255.255.0
service-policy output shape
A couple of things:
#1 - you must use the 'qos pre-classify' command on your crypto maps or the router will encrypt before it does any kind of qos
example:
crypto dynamic-map dnewmap 10
set transform-set transform2
match address 120
qos pre-classify
#2 Here is the access list that I use (I know that I went a little overboard on the 48000 to 50000, but I don't think that many other apps use that)
access-list 140 permit udp any any range 48000 50000
access-list 140 permit udp any range 48000 50000 any
access-list 140 permit tcp any any range 1718 1720
access-list 140 permit tcp any any eq 10025
access-list 140 permit tcp any any eq 10032
#3 if you want to use priority queueing:
priority-list 1 protocol ip high list 140
then apply the priority-group 1 to the interfaces
Rwotherspoon,
Sorry I haven't responded, it's been pretty crazy at our work.
With using the LLQ solution, how does the router recognize the VoIP traffic since it's not being originated by the Cisco itself? The VoIP traffic is originated out of our Altigen phone system. I just want to make sure that the router will even recognize the traffic.
By the way, I'm using Dell PowerConnect 2624 Switches which I believe supports 802.1p tags.
Please let me know if my thinking is correct on this or not. Thanks.
Sorry for the delayed response... Had a little storm blow through Orlando and only recently got power, internet, etc.
Best practicies to remember about distinguishing Voice from Data traffic on the LAN:
1. ALWAYS keep VOICE and DATA on unique subnets (VLANs)... do this to provide an initial distinction at Layer 2. Also helps with security if the phones have PC ports on them.
2. NEVER route between the VOICE and DATA Vlans UNLESS it is required by Unified messaging or PC softphones.
3. Try to avoid having voice traffic traverse a Layer 3 interface on a LAN ... this is not possible in your case though because your LAN extends to remote sites that are likely routed and certainly are connected via UDP port 500.
4. Assuming your VOICE endpoints are on their own subnet, apply the appropriate VLAN, tagging and classification information on the switchports to which the phones are plugged in.
5. IF you have many switches uplinked in a stack or to a core switch, make sure the uplink ports are configured as trunk ports with 802.1q encapsulation.
6. And finally, make sure the switchport connecting to the 837 is also an 802.1q trunk port and that e1 on the router has subinterfaces to support both the data and voice vlans. Also, e1 on the router must have the same Qos and classification settings as the downstream switchport on the LAN.
That is how the router knows the difference between voice and data traffic on e1.
Rwotherspoon,
Sorry to hear about your Charley experience. I actually just moved out of Orlando a few months ago to take an IT job here in Georgia and still have many friends and family down there.
I defintely believe you're taking me in the most appropriate direction and I'm accepting the last answer above. I do, however, have one more question of clarification or at least your expert advice... Please let me know if I need to re-post or what.
I currently do not have the VoIP traffic on a separate subnet but am planning on accomodating this. If I have my router at the edge and configure my ethernet interface with 2 IP's (a primary and a secondary), can I connect the router to the external inteface of my firewall and directly into the network switch and then connect the trusted interface of my firewall into that same switch? I was going to try to have my data traffic go over a separate VPN (and separate subnet) which terminates at the firewall and have the VoIP go over a VPN which terminates at the router. Since everything is on the same physical wire, I was going to try this. The other main reason that I'm doing this and not just letting everything sit on the external side of the firewall, is that the one firewall I'm using does not allow for NAT exceptions to be added and thus the traffic would be NAT'ed. If I deny the other subnets traffic from the data side, do you think this would work? Here's my best drawing of what I'm thinking:
Router
| |
| |
|---- ----|
Firewall Switch
| | |
|------------| To Workstations
Please let me know, thanks.
Business Accounts
Answer for Membership
by: kkpehlersPosted on 2004-07-24 at 01:27:44ID: 11627464
Can you on both ends of the VPN dedicate a certain amount of bandwidth to the site links for VOIP? Most VOIP packets comsume very low bandwidth approx. 87k.