Solved

ASA 5505 PIX 515e QoS issue

Posted on 2008-06-17
13
1,864 Views
Last Modified: 2013-11-16
Hi Experts,

I have a Cisco PIX 515E at our main site and we are using an ASA 5505 at our telecommuters site. I have set it so that VPN works fine and our user can access internal network, files, email etc. We use 7941 IP phones from Cisco, which is also working for our user. The issue I am having is that for every 3rd or 4th call the quality of the call deteriorates. Is there a way to set up QoS on the ASA so that call quality does not deteriorate? On the PIX I have version 7.0. ASA version is 7.2(3).

Thanks
0
Comment
Question by:abhijitm00
  • 7
  • 6
13 Comments
 
LVL 6

Accepted Solution

by:
raptorjb007 earned 500 total points
ID: 21809677
On the ASA you can configure a very basic form of QoS. Basically what the ASA can do is a simple priority queue, all traffic defined to be applied int he queue takes priority over all other traffic. This queue was designed to support exactly what you are trying to do.

You are going to need to know the ports your voice traffic uses, you can also go by IP but I will give you the command with a port based sample.

This involved creating a class-map to define the ports that you want add to the queue. Then assigning priority to these classes in a policy-map. Finally, you apply the policy-map to the outside interface and enable priority-queuing.

Start by enabling the priority queue feature on the outside interface.

priority-queue outside

Then Create a class map for each tcp or udp port the voice traffic uses

class-map classmapname
 match port tcp eq portnumber

Next, create a policy-map that adds each configured class to the prioity queue.

policy-map VOIP_Priority
 description Policy to Assign QoS Priority to VOIP Traffic
 class classmapname
  priority

Finally, apply the policy-map tot he outside interface.

service-policy VOIP_Priority interface outside

See code box for all the config lines together. Replace "classmapname" and "portnumber" with values appropriate to your config. Same goes for "VOIP_Priority" and its description text.
priority-queue outside
 

class-map classmapname

 match port tcp eq portnumber
 

policy-map VOIP_Priority

 description Policy to Assign QoS Priority to VOIP Traffic

 class classmapname

  priority
 

service-policy VOIP_Priority interface outside

Open in new window

0
 

Author Comment

by:abhijitm00
ID: 21813892
Thanks for getting back raptorjb007. I have a couple of questions:

1. How can I find out which port to use for voice? Is this determined on the PIX?
2. Based on the above code I do not need to apply anything on the PIX correct?

Thanks.
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21814105
The above code is a config sample from which you can modify it for your needs. Specifically you just need to create a class-map for each different port you need to apply QoS to, then add each class to the policy-map as listed in the sample. The rest should be ok without any editing.

The Ports you need depend on the products and.or protocols in use by your VOIP system. This may require a little bit of research on your end, or if the VOIP is provided by a vendor you should be able to get that information from them.

If you need help with the configuration, I can write the full config code for this QoS Policy for you, however you would need to tell me which ports are in use by the VOIP system.
0
 

Author Comment

by:abhijitm00
ID: 21815519
We use Cisco Call Manager 4.2, if that helps. I will try to find out and send you the info. Thanks once again.
0
 

Author Comment

by:abhijitm00
ID: 21815615
Would this give the port numbers, I got it from the Call Manager:

Ethernet Phone Port - 2000
Digital Port - 2001
Analog Port - 2002
MGCP Listen Port - 2427
MGCP Keep-alive Port - 2428
0
 

Author Comment

by:abhijitm00
ID: 21816457
Would the following work instead of the port number?

priority-queue outside

    class-map Voice
     match dscp ef

    policy-map Voicepolicy
     class Voice
      priority

    service-policy Voicepolicy interface outside

Thanks.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21817399
That's how the Cisco article configures it, it isn't checking voice traffic specifically but rather checking on its DSCP value. You can certainly give it a try, let me know how it goes. I rarely work with VOIP traffic.

You can use the "view priority-queue statistics Voicepolicy" command to verify that the policy is successfully assigning traffic to the LLQ.

LLQ is the priority queue, BE is the normal queue.
0
 

Author Comment

by:abhijitm00
ID: 21824111
Hi raptorjb007 I have applied the voicepolicy and the priority is being assigned correctly as shown below but there are still issues with quality. The other person cannot hear my user sometimes. Are there some commands I can run to see status on the call?

Priority-Queue Statistics interface outside

Queue Type         = BE
Tail Drops         = 0
Reset Drops        = 0
Packets Transmit   = 8052
Packets Enqueued   = 0
Current Q Length   = 0
Max Q Length       = 0

Queue Type         = LLQ
Tail Drops         = 0
Reset Drops        = 0
Packets Transmit   = 44119
Packets Enqueued   = 0
Current Q Length   = 0
Max Q Length       = 0
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21824524
The ASA is not processing the call itself, only inspecting the traffic to ensure it's following the firewall's rules. The output you provided tells me that your policy is operating, any traffic that matches your QoS policy will be delivered ahead of all other traffic. If uyou still have call quality issues it's possibly an issue with the VOIP system or an indication of general bandwidth over-utilization.
0
 

Author Comment

by:abhijitm00
ID: 21830639
Ok. I will check that. Currently our flow from end to end is ASA at client - Border Router - PIX - Switch. On the Border Router I have a policy which is like

policy-map VPN_POLICY
 class IPSEC_class
  priority percent 20
 class class-default
  fair-queue


Will this need to be modified in order to honor the policy on the ASA as only 20% of VPN traffic has priority? Thanks.
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21831213
If the router is applying QoS you would definitely want to experiment its settings. Perhaps increase the percentage or test removing the QoS on the router altogether. QoS is always so fun =)
0
 
LVL 6

Expert Comment

by:raptorjb007
ID: 21884368
Any luck?
0
 

Author Comment

by:abhijitm00
ID: 21924871
No nothing much has changed. We still have QoS issues on the calls. We applied QoS on the ASA, Border Router and PIX. We are going to keep testing it out for some time. Thanks for all your help.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now