This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QOS of Site-to-Site VPN Tunnels

Thanks for your help.

We have a backup application running from one site to another. Both sides are connected via ASG 110 and ASG 120 IPSec site-to-site (s2s) VPN. We have QOS running successfully for our normal traffic (i.e. http to web, smtp to web, etc.). However, I am having difficulty applying QOS rules to the s2s VPN. I am not sure how to structure them. I have read that QOS is applied to outbound traffic, but apparently the traffic is encrypted prior to hitting the QOS. How exactly should I go about configuring the box to apply QOS to all s2s traffic? How would I do it for specific (i.e. Http) traffic inside the s2s tunnel. Is there something I am missing?

Any help is appreciated!

Thanks.

This thread was automatically locked due to age.

Parents

0 BAlfson over 13 years ago

Question. My traffic selectors target IPSec traffic across phone networks, not VoIP traffic, because we use IPSec VPN, and VoIP is "wrapped" as IPSec when it reaches the External Interface. I don't believe we have the ability to prioritize VoIP in this scenario? Why do we care about ports included in the Astaro "VoIP Protocols" group?

You're exactly right.  For some reason, I was thinking that packets were being dropped, but they're just being lost.

The phone system is Avaya IP Office 500, and the phones are connected by regular telephone cable with their Control Units (2 of them, one per site).

I glanced at the documentation on the Avaya site.  I get the impression that the Control Units are just specialized switches and that they and the phones are on the same TCP/IP network with the PCs.  Further, that the PCs and phones all get DHCP from the same server - that would make it difficult to assign IP addresses in separate spaces for data and VoIP.

I still think you should talk to the phone supplier.  They will understand how to get all of the VoIP devices into subnets disjoint from the data devices.  They should know the right questions to ask to get the easy answers.

Best of luck!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 13 years ago

Question. My traffic selectors target IPSec traffic across phone networks, not VoIP traffic, because we use IPSec VPN, and VoIP is "wrapped" as IPSec when it reaches the External Interface. I don't believe we have the ability to prioritize VoIP in this scenario? Why do we care about ports included in the Astaro "VoIP Protocols" group?

You're exactly right.  For some reason, I was thinking that packets were being dropped, but they're just being lost.

The phone system is Avaya IP Office 500, and the phones are connected by regular telephone cable with their Control Units (2 of them, one per site).

I glanced at the documentation on the Avaya site.  I get the impression that the Control Units are just specialized switches and that they and the phones are on the same TCP/IP network with the PCs.  Further, that the PCs and phones all get DHCP from the same server - that would make it difficult to assign IP addresses in separate spaces for data and VoIP.

I still think you should talk to the phone supplier.  They will understand how to get all of the VoIP devices into subnets disjoint from the data devices.  They should know the right questions to ask to get the easy answers.

Best of luck!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data