We have an ASA 5505 configured to an integrated T1 that also provide VoIP through Unity Express. The firewall also hosts a L2L vpn with a second site. The problem is that when users download files from the second site, the T1 inbound becomes fully saturated and Unity users experiences voice breakage and difficult to hear on both ends. I understand that an inbound police policy can be set to police all inbound traffic, but it will also affect overall inbound throughput which defeats the purpose of a link balancer that provides additional inbound bandwidth for non-critical traffic. A brief layout of the network is below:
Unity ---> Switch ---> ASA 5505 ---> Link Balancer ---> T1, DSL1, DSL2
ASA 5505 is configured with T1 IP scheme.
IPSec tunnels are created by the ASA 5505 and flows through unbalanced. Some suggested why not remove the ASA 5505 entirely and use the LB as the perimeter firewall/vpn terminal; the reason is because there are problems with Unity when a non-Cisco firewall is used. A lot of examples I've seen only include prioritizing VoIP that needs go through a tunnel, but our VoIP doesn't. I've added the following QoS policing config, but not sure if it is any help, but still see the T1 pipe fully saturated during file transfers.
priority-queue inside
priority-queue outside
class-map voice_non_marked
match rtp 16384 16383
class-map site_vpn
match flow ip destination-address
match tunnel-group xx.xx.xx.xx
class-map voice_marked
match dscp ef
policy-map voip
class voice_non_marked
priority
class voice_marked
priority
class site_vpn
police output 100000
service-policy voip interface inside
service-policy voip interface outside
