Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

ASA 5505 PIX 515e QoS issue

Posted on 2008-06-17
13
1,871 Views
Last Modified: 2013-11-16
Hi Experts,

I have a Cisco PIX 515E at our main site and we are using an ASA 5505 at our telecommuters site. I have set it so that VPN works fine and our user can access internal network, files, email etc. We use 7941 IP phones from Cisco, which is also working for our user. The issue I am having is that for every 3rd or 4th call the quality of the call deteriorates. Is there a way to set up QoS on the ASA so that call quality does not deteriorate? On the PIX I have version 7.0. ASA version is 7.2(3).

Thanks
0
Comment
Question by:abhijitm00
  • 7
  • 6
13 Comments
 
LVL 6

Accepted Solution

by:
raptorjb007 earned 500 total points
ID: 21809677
On the ASA you can configure a very basic form of QoS. Basically what the ASA can do is a simple priority queue, all traffic defined to be applied int he queue takes priority over all other traffic. This queue was designed to support exactly what you are trying to do.

You are going to need to know the ports your voice traffic uses, you can also go by IP but I will give you the command with a port based sample.

This involved creating a class-map to define the ports that you want add to the queue. Then assigning priority to these classes in a policy-map. Finally, you apply the policy-map to the outside interface and enable priority-queuing.

Start by enabling the priority queue feature on the outside interface.

priority-queue outside

Then Create a class map for each tcp or udp port the voice traffic uses

class-map classmapname
 match port tcp eq portnumber

Next, create a policy-map that adds each configured class to the prioity queue.

policy-map VOIP_Priority
 description Policy to Assign QoS Priority to VOIP Traffic
 class classmapname
  priority

Finally, apply the policy-map tot he outside interface.

service-policy VOIP_Priority interface outside

See code box for all the config lines together. Replace "classmapname" and "portnumber" with values appropriate to your config. Same goes for "VOIP_Priority" and its description text.
priority-queue outside
 
class-map classmapname
 match port tcp eq portnumber
 
policy-map VOIP_Priority
 description Policy to Assign QoS Priority to VOIP Traffic
 class classmapname
  priority
 
service-policy VOIP_Priority interface outside

Open in new window

0
 

Author Comment

by:abhijitm00
ID: 21813892
Thanks for getting back raptorjb007. I have a couple of questions:

1. How can I find out which port to use for voice? Is this determined on the PIX?
2. Based on the above code I do not need to apply anything on the PIX correct?

Thanks.
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21814105
The above code is a config sample from which you can modify it for your needs. Specifically you just need to create a class-map for each different port you need to apply QoS to, then add each class to the policy-map as listed in the sample. The rest should be ok without any editing.

The Ports you need depend on the products and.or protocols in use by your VOIP system. This may require a little bit of research on your end, or if the VOIP is provided by a vendor you should be able to get that information from them.

If you need help with the configuration, I can write the full config code for this QoS Policy for you, however you would need to tell me which ports are in use by the VOIP system.
0
Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

 

Author Comment

by:abhijitm00
ID: 21815519
We use Cisco Call Manager 4.2, if that helps. I will try to find out and send you the info. Thanks once again.
0
 

Author Comment

by:abhijitm00
ID: 21815615
Would this give the port numbers, I got it from the Call Manager:

Ethernet Phone Port - 2000
Digital Port - 2001
Analog Port - 2002
MGCP Listen Port - 2427
MGCP Keep-alive Port - 2428
0
 

Author Comment

by:abhijitm00
ID: 21816457
Would the following work instead of the port number?

priority-queue outside

    class-map Voice
     match dscp ef

    policy-map Voicepolicy
     class Voice
      priority

    service-policy Voicepolicy interface outside

Thanks.
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21817399
That's how the Cisco article configures it, it isn't checking voice traffic specifically but rather checking on its DSCP value. You can certainly give it a try, let me know how it goes. I rarely work with VOIP traffic.

You can use the "view priority-queue statistics Voicepolicy" command to verify that the policy is successfully assigning traffic to the LLQ.

LLQ is the priority queue, BE is the normal queue.
0
 

Author Comment

by:abhijitm00
ID: 21824111
Hi raptorjb007 I have applied the voicepolicy and the priority is being assigned correctly as shown below but there are still issues with quality. The other person cannot hear my user sometimes. Are there some commands I can run to see status on the call?

Priority-Queue Statistics interface outside

Queue Type         = BE
Tail Drops         = 0
Reset Drops        = 0
Packets Transmit   = 8052
Packets Enqueued   = 0
Current Q Length   = 0
Max Q Length       = 0

Queue Type         = LLQ
Tail Drops         = 0
Reset Drops        = 0
Packets Transmit   = 44119
Packets Enqueued   = 0
Current Q Length   = 0
Max Q Length       = 0
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21824524
The ASA is not processing the call itself, only inspecting the traffic to ensure it's following the firewall's rules. The output you provided tells me that your policy is operating, any traffic that matches your QoS policy will be delivered ahead of all other traffic. If uyou still have call quality issues it's possibly an issue with the VOIP system or an indication of general bandwidth over-utilization.
0
 

Author Comment

by:abhijitm00
ID: 21830639
Ok. I will check that. Currently our flow from end to end is ASA at client - Border Router - PIX - Switch. On the Border Router I have a policy which is like

policy-map VPN_POLICY
 class IPSEC_class
  priority percent 20
 class class-default
  fair-queue


Will this need to be modified in order to honor the policy on the ASA as only 20% of VPN traffic has priority? Thanks.
0
 
LVL 6

Assisted Solution

by:raptorjb007
raptorjb007 earned 500 total points
ID: 21831213
If the router is applying QoS you would definitely want to experiment its settings. Perhaps increase the percentage or test removing the QoS on the router altogether. QoS is always so fun =)
0
 
LVL 6

Expert Comment

by:raptorjb007
ID: 21884368
Any luck?
0
 

Author Comment

by:abhijitm00
ID: 21924871
No nothing much has changed. We still have QoS issues on the calls. We applied QoS on the ASA, Border Router and PIX. We are going to keep testing it out for some time. Thanks for all your help.
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question