Forgive me if this question is horribly misguided. I'm primarily a developer, but my company has asked me to work on setting up their network for data and voip connections in a sensible way (I do have at least a basic understanding of networking). We currently have two locations connected by a VPN. We are a video processing company so occasionally we need to move a large file across this line. We are planning on switching over our telephone system to a (remote) Asterisk-based system and want the ip phones to run on the same router/switches we have in place already. From what I've gathered, it seems to make sense to create 2 VLANs at each location -- one for data and one for phones -- and use QoS on the router to prioritize packets on the voip VLAN incase a huge video file is being moved across the VPN. Still, I want to allow computers on the data VLAN in location 1 to be able to "see" computers on the data VLAN in location 2. How might this be accomplished? I had thought that maybe having both locations under the same subnet might work, but it sounds like this is actually a bad (or impossible) idea? Any help or direction would be much appreciated.

  • Can you describe your current topography? When you say VPN are you talking about an IPSEC VPN, or something more along the lines of MPLS? What network equipment do you currently have? – paulos Oct 5 '11 at 14:46
  • Sure thing. At each location we have a linksys 2 WAN router with VPN capabilities (this hosts our internet connection at each location). These two routers are connected to each other through (I believe) an IPsec VPN setup. Connected to the router at each location is an HP ProCurve switch which currently all our machines are connected to (workstations, printers, etc.). What we want is to be able to use our IP phones on the same switch without fearing that they're going to stop functioning when a large file is being moved across the VPN. – Sean Oct 5 '11 at 14:54

You are correct in what you say.

You need to create a new vlan for VOIP at both sites. The VOIP lan at each site should not be the same vlan, or the same subnet. They ought to be routed between sites. You will need an extra interface on your router that is on the VOIP subnet (this can be a dot1q tagged interface if your router is capable of that). The new VOIP subnets will also need adding to the encryption domains of their respective routers.

I've never used a Linksys wan router but my gut feeling is that it won't be capable of doing QOS. I'm perfectly willing to be corrected there, but as a general rule I've found Linksys to be lacking when it comes to more sophisticated features - probably so they can sell more Cisco badged gear. But I digress.

The fact that your site to site link uses an IPSEC tunnel suggests that they are linked over the internet. With that being the case you will have to apply QOS to your internet traffic, and to your data traffic in order to prioritise VOIP.

  • Thanks for the info. It looks like the route will do simple QoS based on the port (e.g., one LAN port can be "high" priority and the others can be "normal"). I think I can connect one "normal" LAN port to a port on the switch used in the Data VLAN and another "high" priority LAN port to a port on the switch used in the VOIP VLAN to prioritize voice traffic. Could be wrong though... – Sean Oct 5 '11 at 15:52

The problem is you are not routing, add a router to the trunk in which all the vlan's you want to be able to communicate with eachother are present. Also add as default gateway your router.

If you want you can manage this with level 3 switches instead of having a seperate router and switch.

(Your VPN needs to be transparent, so if encryption happens at layer 2, this won't have an impact on my solution)

  • The VPN is set up through the router/default gateway at each location. Is this what you mean? – Sean Oct 5 '11 at 15:07

Remember here that your WAN connections will tend to be expensive and narrow. You want to play defense against sending unnecessary traffic through them.

With that in mind, you want a total of 4 vlans: separate voip and data at each site. This will keep broadcast traffic on either end from ever traversing your VPN link. Then you also need to make sure your router knows how to route both voip vlans between each other and to your remote asterisk, and also knows how to route both data lans to each other.

  • Cool. This was more or less what I thought I should do. So maybe my question then is: how do I set this up on my router? The whole concept of VLANs is new to me, so my apologies if this is overly-simplistic or too broad to be answered concretely. – Sean Oct 5 '11 at 15:05

The really crucial part of your setup are not the VLANs (although they might help management matters), but the QoS for your VoIP traffic.

You should check with the router's docs what kind of QoS is done there. The switch port-based kind you describe is usually only used for ethernet-only QoS. Your main concern would be QoS over your VPN link, since even high-bandwidth transfers over the local network are really unlikely to deteriorate the voice stream quality for RTP. The VPN link on the other hand will give you high and varying (which is even worse than simply "high") latencies when congested, leading to dropped voice packets and thus significant audio signal distortion for your VoIP users.

You also should be aware that a simple claim of "QoS" will not necessarily give you the results you are wishing for. A VoIP transmission would typically need only little bandwidth (around 100 Kbps symmetric with G.711 / uncompressed), but the link should have a rather low RTT of < 150 ms at any given time. There are many QoS algorithms and implementations which are unable to achieve this in the field - you would have to benchmark yourself to see if your routers will be able to deliver.

Others already have commented on the routing issue - you will need to correctly set up the routing between your two VPN sites - once this is done, your hosts will be able to communicate with each other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.