VoIP over VPN

[timpotter]

Question for you all. I'm proposing a VPN network for our company that would also support voice and video.

In a nutshell I was thinking this:

Main Sites (that need redundancy). Two ISP's with a BGP configuration for redundancy. These two lines would connect to two routers that would funnel into our Internet router which would be connected to a PIX 515. Hanging off the PIX 515 DMZ would be a VPN 3015 or 3030.

This scenario would provide backup should either internet connection go down (T1's at the major sites). The VPN would always be accesable.

Our major sites have 150-225 people. We have about 3 of those, then several sites around the 50 user mark and many around the 5-10 users mark. About 800 users in all.

Smaller sites would have Frac T1's (down to 128K) and possibly DSL with Cisco 3002 VPN boxes.

Would this provide a workable VoIP over VPN? Assuming the ISP provide a good SLA?

Any concerns? VON throughput? Firewall throughput? Any recommended hardware requirements for the PIX, routers or VPN boxes?

Also, what needs to be included for the VoIP equipment and where should it be placed? DMZ? Private network? etc.

I appreciate any input and can provide more details if you need something specific.

-Tim

[s-doyle]

As you’ve outlined it, it looks pretty good, but you should really have a Cisco SE go over your design and certify it for your needs.

[s-minana]

Tim,

It depend on the tuneling prtocols you are using, I know that there is some issues on QOS with IPsec. If you encrypt the ip header where the qos parameters are stored there is some issues withcopying into the new header.

did you as well look at overhead due to tunneling/encryption? Your network traffic should be rightly dimensionned in order to:

-prioritize voice traffic

-reserve bandwidth for voice

-perform all kind of compression (including header) to save bdth

...

Hope this gives you some food for thoughts

Stephane

INS