VPN routing (Office Communications Server 2007 R2)

Hi, my current network setup is:

Main HQ connected to single branch office via 1 VPN tunnel.

At HQ we have SDSL 2mbit up/down
At Branch we have ADSL2+ 12mbit down / 768k up

We use Office Communications server internally. hosted at HQ

We have a coms PC at both sites, with Wide Angle webcams, for conferencing between the sites. We have had continued problems with packet loss, lag. Webcam freezing etc..

I've tried quite a lot to settle this down, used different PC's, used different webcams, replaced network cables/cards. gone as far as purchasing 2 brand new PC's to act as coms pc's at each end.  Still to no avail.

The quality is perfect. I can confirm that on the HQ router there is no "MAIN" network traffic coming in or out (or very little, 10-15k) over the VPN tunnel I can see TX and RX of approx 50-60k a sec. Which seems about right for webcam use.

Now. combined that puts the overall upload out of the SDSL at say, 100k/sec, Receive of the SDSL at the same, say 100 maybe 120k.

this doesn't come close to capping either the TX or RX available on our line.

The connection at the branch site isn't taxed in the slightest on receive, but is at about 70-80% of maximum upload.

Sitting at HQ, we see the branch office webcam feed perfectly, no crackles, no lag, audio perfect, it's exactly as we'd expect it to be... however, branch site only see's a frozen screen or very laggy, they can however hear us perfectly. so audio is causing no problems.

I'm pulling my hair out!

I am waiting for a call back from our ISP as we speak because I was going to put in an addition ADSL2+ 8MB line at HQ, was going to use RRAS to route and data not intended for the VPN tunnels using the new 8MB line. Which would leave the SDSL line dedicated to serving the Branch site. Even this i'm not 100% sure will sort the problem though.

I was looking for some input on wether it was possible to route through different VPN tunnels to the same network... By that, I mean configuring a 2nd VPN tunnel from the new ADSL2+ line (also to the branch site.)

I would have 2 VPN tunnels into the same router at the branch, configured basically the same. firstly, is that even possible...

secondly, my intention was to specifically route traffic based on what actual PC the traffic is going too..

However, I would probably prefer to route traffic based on which port is being used to send the traffic.

as an example, for OCS, if I initiate a webcam conversation i'd want to try and send port 5061 out via ADSL2+ as opposed to SDSL.

Basically, I would very much like to use the SDSL line as a dedicated 24/7 backup line for transferring any backup data, SQL-T logs, serving files to branch etc, then use the ADSL2+ line at HQ for any downloads, WSUS updates, and potentially OCS communications.

I'm not even sure if this is a common question. I couldn't really find any viable information on multiple visits to google.

I want to be in a situation where we can have flawless webcam communications between HQ and Branch. I want to dedicate the SDSL line to more of a backup transport line, sending through file server backups overnight, etc.

Can anyone offer me some insight on this issue?

Thankyou, and sorry for the waffle of a post. Please ask if you need clarifcation on anything.

Who is Participating?
Rob WilliamsConnect With a Mentor Commented:
The limitation is the "768k up". At very best your VPN will functioning at about 1/100th th of the LAN speed. It is very difficult to have streaming media via a VPN.

An alternative others often try is RDP. It is also very difficult to use RDP to access the video even without the overhead of a VPN using a remote desktop scenario. This has actually just been recently addressed with major performance enhancements with SP1 for Server 2008 R2 and Win7. Still in the beta phase but with that you can use the enhanced RDP feature remote FX which advertises good streaming media. To do so you would need to install a 2008 R2 server to act as a terminal server. Not sure if you could use Win7 and remote FX to do the same.

Out of curiosity when you ping a remote device over the VPN what do you get for a res pose time? Is it less than 50ms? It needs to be at least that.

To address your other question you can have multiple VPN tunnels between sites, there are even some routers designed to do so and offer fail-over between the two tunnels, but you cannot aggregate the connection to improve the performance of a single connection. i.e. your video will not be split over the two tunnels. You can use them for fail-over or route traffic destined for specific IP's or subnets through specific tunnels. The routing is IP/subnet based, not service based,

It's not a lot of help, but "food for thought".
What kind of routers are you using? Is it possible implement QoS on both ends to prioritize your interesting traffic?
tbsjsyAuthor Commented:
Hello, in response to bgoering, at main office we're using a Draytek 3100 (looking at getting this upgraded to a Cisco 878 K9 very soon) - at the branch office we're using a Draytek 2710n.

Implementing QoS might be an idea. Could you give me some clarification as to wether QoS would actually take affect over a VPN ? I was under the impression it was for inbound and outbound only, whereas the VPN is technically an extension on our lan?

In response to RobWill, I got my figures slightly wrong, the branch site has a 20mb download and 1.2mb upload. I can transfer from a branch site server at approx 130 KB/sec

I realise this still isn't ideal, but it does almost double the upload bandwidth i thought we had, which actually makes me scratch head even more!!

When I ping 1 of the servers at the branch site I get a response time of 39-45 ms constantly. with the occasion "Blip" to 150ms, very randomly and not often at all.

Not so sure if those responses will open up any kind of additional thought processes :)


bgoeringConnect With a Mentor Commented:
I know that on Cisco you can apply a QoS policy to whatever traffic you wish - not sure on how Draytek wwould work. I will leave it to a Draytek expert to answer that.

good luck
Rob WilliamsCommented:
Hi tbsjsy. I really don't know if 130 KB/sec is sufficient to supoort streaming video, but I am doubtful when you consider that is ony 2.5 times the spead of dial up. I am currently on a remote 100K 3G connection which definately will not support it.
As for the ping responce times they will definately need to stay under 50ms. I am surprised they are as high as they are. I just checked a couple of sites with 1MB upload speeds and their ping response time over site to site VPN's is 18-23ms. Keep in mind a VPN is bidirectional and the limiting factor is lower the upload speed of the two sites.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.