V3PN or VoIP in P2P GRE in IPSec

[Wilson Samuel]

Hi All,

I have been curious enough that can we achieve the same levels of the QoS in a IPSec VPN that we could easily in a Leased Line.

My concern is that, what actually happens when a VoIP Packet is encapsulated in a IPSec Packet and then being routed into Internet?

Can we really deploy such cutting edge factors and cut the costs and make the whole transaction secure also.

Kind Regards,

Wilson Samuel

[mheusinger]

Hi Samuel,

IPSec standard mandates to copy the DSCP field from the original header into the new IP header. As VoIP is usually marked with DSCP EF (decimal 46), your IPSec packets would also be marked.

Now all the marking has no influence whatsoever, if no QoS config is in place. So on your side you could enable LLQ to prioritize voice (do not forget signalling!) - auto-qos voip would be sufficient for that purpose.

The tricky thing is the internet. As long as you stay with one ISP you might get SLAs for VoIP. If more than one ISP is involved, it is unlikely to get SLAs and more unlikely to proove to one ISPs that he does not meet the SLAs (typical "finger pointing problem").

If you have no SLAs, then you might encounter VoIP problems ANY time - from degradation to one-way voice and so on.

A solution some customers picked is to interconnect sites through a MPLS VPN including VoIP SLAs. Whether you use IPSec or not over MPLS VPNs does not matter to the ISP.

My 2 cents.

Regards, Martin

[Wilson Samuel]

Hi Martin,

Thanks a lot for the clarification over the matter.

So now, how does Cisco is aggressively marketing on their V3PN??

Are they having any special tie-ups with ISPs?

Regards,

Wilson Samuel

[tom.shiba]

The most that can be done is on the traffic leaving each site using priority queueuing and shaping. This will resolve outbound traffic starving voip towards your remote site. But then again once it leaves from your domain the DSCP bits are not honored on the internet. Surprisingly though as chaotic as the internet is we have a bunch of teleworkers which work great. It takes a lot of configuration though as you have to determine their uplink at the worst time and shape around 70-80%. Sometimes but rarely it clips but it's pretty rare and people expect that.