Disclaimer
• The views presented here are mine. Some topics are simplified where an overly technical conversation might ensue with Network Engineers wanting to dissect this. It is my desire to write this for the novice user in order to provide a general understanding of how to get things working in short order. I’m a student of Voice Over IP myself so I welcome any comments or corrections.
Prerequisites
1. Turn off Intrusion Detection on the Astaro Sophos UTM, at least temporarily. Once the configuration is completed and tested ok, you can turn it back on and see what might need to be adjusted here.
2. You must set the proper QOS bandwidth on the External interface of the Astaro Sophos UTM in order for some QOS calculations to work properly. This setting is found under ‘Interfaces and Routing’ --> ‘Quality of Service (Qos)’. By default, on more modern Sophos installs, the bandwidth on the External interface will be set for 1000 Mbits/second (1000 Megabits). The proper setting is the amount of bandwidth that you are paying for from your ISP, for both up and down. For example, if you are paying for 20Mbps of Internet speed up and down, you would set this value to 20Mbits/sec in both directions up and down. (NOTE: This is not to be confused with setting the Interface Hardware speed under Interfaces --> Hardware which is set to Auto by default)
EDIT: 9/13/2017 - Sophos has changed two things about the way bandwidth is displayed on today's UTM. What I am showing above is the new correct way. In the past, Sophos improperly used the 1024 scale instead of the 1000 scale. Secondly, they also changed the display from kilobits to mbits. Let's take the example above where you might be trying to change your QOS on the external interface to 20 Megabits. In the past, Sophos would have you put in 20480 kilobits. When the system changed to Mbits, your setting was auto converted to 20.4. But then a further change occurred in a later patch that recognized a megabit as 1000 instead of 1024, but your system might still show 20.4 where it should be updated to 20. Hopefully that makes sense.
Considerations
1. QOS stands for Quality of Service. Why do we need to set QOS for VOIP? The answer is because voice protocols are Real Time Protocols that will suffer if a packet is dropped or not assembled back in sequence. For example, let’s assume you are downloading a file from the Internet. The party you are downloading the file from has a higher bandwidth capability than you do. They might be trying to send the file at 100 Megabits, but you only have a 10 megabit service to receive the file. So what happens? Packets might get dropped because you cannot receive these packets as fast as they can be sent, and you are likely maxing out your 10 megabit connection. Do you notice these dropped packets while downloading the file? No. The sending party simply resends the dropped packet and it is eventually reassembled back in to order on your side behind the scenes. But, what would happen if voice packets are dropped or assembled out of order? You would definitely notice this in the sound quality of the call. The sound would drop out at random times making for garbled, static, or even dropped calls. In short, if everyone had unlimited bandwidth, there would be no need for QOS. Another thing that can happen is that your bandwidth is always consumed to the maximum limit. This could happen if you have a lot of people in the office all downloading files and you just don’t have enough bandwidth to service everyone’s needs, it’s always bumping the maximum service level. This would have the same effect on voice quality.
2. Where is the PBX and voip phones in relation to the Astaro Sophos UTM? This makes a difference in how things are setup. For example, you might be purchasing your SIP trunk minutes from a provider at an unknown location, your pbx might reside at your data center, and your phones are installed at the office or other locations. In this scenario, we have 3 locations to consider for proper QOS settings. In order to work properly, one must understand that QOS is an end-to-end solution and may require modifications to devices and locations other than your Astaro Sophos UTM.
3. A single voip phone call can take up approximately 80 Kilobits of bandwidth uncompressed once headers are included in the packet. Many voip systems are able to compress voice calls using “codecs”. You will need to find out what, if any, codecs might be in use on your phones or phone system to know your theoretical maximum amount of simultaneous phone calls on your network. The most popular voip codec is G.729. This codec will enable calls that take up only about 35 Kilobits of bandwidth each call. But, there is a tradeoff. The voice quality can suffer a small amount and sound “tinny” or cell phone like with compression. If you are using a voip service to host your phone system, it is likely they are compressing voice in order to save themselves bandwidth and expense. Some people don’t notice the loss of quality though, it depends what you have become used to. In short, if you have the end-to-end bandwidth to run without compression, that is ideal. The codec to run uncompressed is called G.711u.
4. QOS is generally considered to be a “one way” direction - outbound. In order to have full QOS, you have to set your QOS to work outbound, the network on the other end(s) sets their QOS to also work outbound. If all parties set their QOS properly, you should have a full QOS solution. If the other party cannot set QOS outbound, then you only have a partial solution. However, there is a trick we can do to set your Astaro Sophos UTM to work in both directions if needed. To further complicate matters, some ISP’s strip off certain QOS tags once the packet reaches the ISP’s router. In this case, a vpn could be considered to preserve certain QOS tags or a special type of Internet service could be purchased such as MPLS which is out of the scope of this document. On the flip side, some ISP’s do preserve certain QOS tagging making your voice quality very good in some locations.
5. When applying QOS rules outbound, the QOS rules are applied to the External interface of the Astaro Sophos UTM only. The reason for this is because you cannot apply QOS rules for what arrives on an interface, only what leaves it. If you need to employ the “trick” from number 4 above because the party on the other side of the network connection cannot apply QOS rules outbound, you can create a QOS rule for inbound traffic on the Astaro Sophos UTM, but you apply it to the Inside interface of the UTM, not the External interface (prior to version 9). Although this can be done, it is not ideal as it contributes to the load of the UTM device. Also, be very careful with your rule selection. A rule placed to limit traffic on an inside interface can have ramifications on traffic coming from other internal interfaces. On version 9 of the UTM, a new inbound technology is introduced. We'll look at this closer in the configuration section.
6. QOS is a general umbrella term. On the Astaro Sophos UTM, there are two main concepts of QOS to consider before starting your configuration, policing and shaping. When you think of policing, think about a “hard” cutoff. When the amount of traffic reaches the set policing policy level, any additional packets are dropped. We might consider policing for all traffic except voice thereby carving out a section of your bandwidth for voice only. When you think of shaping, think of packets going into a Queue which are prioritized for delivery where voice gets a higher priority. In Astaro Sophos UTM, under the QOS Bandwidth Pools tab, shaping outbound is referred to as ‘Bandwidth (kbit/s)’ . Policing outbound is referred to as ‘Specify upper bandwidth limit – Limit (kbit/s)’ on the same tab. On version 9 of the UTM, policing inbound can be more easily set on a new tab called 'Download Throttling'.
In an ideal world, we would simply use traffic shaping only and you should start with this. As mentioned, shaping is a queuing method where we can prioritize voice over all other traffic. The other packets are not dropped; they are simply queued and prioritized for later delivery. Other benefits include your full purchased bandwidth remains available to other network services when no voice calls are present. It only “kicks in” when a voice call is in progress. But shaping is a memory intensive process on the Astaro Sophos UTM. If you are making or receiving a lot of phone calls and you have limited bandwidth from your ISP or limited memory on your UTM, you might have to consider traffic policing or even a second Internet connection dedicated to voice only.
Policing would generally be applied to traffic other than voice. For example, we might conclude we want to police web traffic and downloads on ports 80 and 443, or even police all TCP traffic for that matter (real time voice is UDP) to a certain level thereby reserving the remaining bandwidth to voice protocols or ports. The benefits of policing are that it is not memory intensive to the UTM, but the drawback is we are carving out a slice of bandwidth that cannot ever be used by any other service other than voice, whether a phone call is active or not.
7. What exactly will we be classifying in QOS? That question can only be answered based on where the Astaro Sophos UTM sits in relation to your voice equipment. Another consideration is how much bandwidth do we have to work with at locations? Here are some possible setup scenarios.
a. Your PBX and phones sit behind the Astaro Sophos UTM
b. Only your phones sit behind the Astaro Sophos UTM, the pbx is at your datacenter
c. You don’t have a pbx, you have phones and a cloud service
d. You have more than one pbx in multiple locations with varying Internet connections
e. You have phones or softphones, but all are located in different remote locations for remote people
We’ve mentioned Policing and Shaping. We have some ability to control how packets are prioritized and leave our equipment. But what happens after the packet leaves our equipment? The answer to that question depends on your bandwidth solution. If the voice packet leaves your equipment and travels on the open Internet, chances are the prioritization is now lost. If we have a point-to-point connection, an MPLS solution, or possibly even a vpn connection over the open Internet, we may be able to preserve some of this prioritization.
This leads us to a discussion about QOS tagging.
You might have noticed a section on the Astaro Sophos UTM in QOS called TOS bits and DSCP bits. Setting these bits on your voice traffic can add to your QOS. It is important to note though that turning these on happens on your phone system or phones, not on the UTM. Although it is shown on the UTM, it is important to understand that it is a UTM setting asking if you want to base your QOS on these sent bits only, not to somehow turn them on and make use of them. Again, these bits are turned on from your voice devices.
Why are turning these on important? Some Internet Service Providers may carry them across the Internet for you, helping with your voice prioritization on the receiving end of the network. Most providers do not though. They charge an extra dollar amount for solution such as MPLS.
8. I am a big fan of the Astaro Sophos UTM. I’ve used the product since the beginning, sometimes I have loved it and sometimes I have hated it. I have watched the product line develop over the years in to the fabulous product it is today. One major drawback to the product line is the lack of QOS monitoring, evaluating, and logging on the system. There just is no way to see how your QOS settings and changes are working. Hopefully, this will be addressed in a future update to Astaro Sophos UTM.
Configuration
So let’s implement QOS policies for voice as far as the Astaro Sophos UTM is concerned. In my particular case, the PBX sits behind the UTM and nothing else. We buy our minutes from a third party SIP trunk provider and all the phones are on desks in people’s home offices. In my case, QOS is not an end to end solution at all. But, it is what it is and I’ll turn it on to hopefully get some benefit.
My phone system is an open source Asterisk variant. The following firewall ports need to be open on my UTM. TCP/UDP 5060 inbound to the IP of the phone system and UDP ports 10000-20000 inbound to the IP of the phone system. Port 5060 represents the SIP signaling and control protocols and ports 10000-20000 represent the Real Time Voice protocols.
Just a quick note on my terminology- Below, when I say "outbound", I mean traffic that leaves your internal server, passes through the UTM, and travels to something out on the Internet. This might also be known as "upload". When I say "inbound", I mean traffic coming from the Internet, passing through your UTM, and arriving on an internal server. This might also be know as "download". Having said this, I think its best to shy away from the terms upload and download as they are confusing depending on whose perspective we are talking about. For example, if I am on my server and downloading a file from the Internet, it is a download to me and inbound. However, if there is someone out on the Internet who wants to give me a file to this same server, it is an upload to him, but a download to me. But in either case it is inbound to me and I think this terminology is easier to deal with. It's definitely something to keep in mind when you are dealing with the new "Download Throttling" tab in Sophos QOS which will be shown below. Maybe they should have called it Inbound Throttling.
Go to ‘Interfaces and Routing’ and then to ‘QOS’.
First, be sure to set the proper bandwidth number as outlined in prerequisites #2 under the status tab.
Next, go to the Traffic Selectors tab. Create a selector for RTP ports and another selector for SIP. You can call them something like 'RTP Outbound' and 'SIP Outbound'.
The source for RTP should be the internal IP address of your PBX. The Service should be RTP ports (you may have to create this). The destination can be Any. I’ve left the advanced setting alone.
The source for SIP should be the internal IP address of your PBX. The Service should be SIP. The destination can be Any. Again, I have left the advanced settings alone.
Next on to the Bandwidth Pools tab.
First, you must select which Interface to bind to before clicking the New Bandwidth Pool button. Select the External interface from the drop down menu. Now click the button to create a New Bandwidth Pool.
Give the pool a name such as Voice Outbound. Under ‘Bandwidth (kbit/s)’ select the number of kilobits you want to shape for voice. Keep in mind the simultaneous calls calculation from Considerations #3 above. You cannot shape more than 90% of your actual bandwidth. I personally believe that no more than 30% of your bandwidth should be shaped under most situations or you may need to purchase more bandwidth. This number is subject to many opinions. I have a 10Megabit connection in the Datacenter. I entered 1000 in this box, or 1 megabit. This should allow for approximately 12 uncompressed simultaneous calls to be shaped outbound. Place check marks in the SIP and RTP boxes. Save and then activate your rule.
Do you want / need to take it a step further and police outbound? This is an optional step and may not be required, see Considerations #6.
Go back to the traffic selectors and create new selectors for protocols other than voice that you want to limit outbound such as web services (port 80 and 443 browsing and downloads) and/or ftp services (ports 20 and 21). Call them something like 'Web Outbound' and 'FTP Outbound'. Go to the 'Bandwidth Pools' tab, select External Interface from the drop down, and create a new Bandwidth Pool. Name it something like 'Limit Non Voice Outbound'. Check the 'Specify Upper Bandwidth Limit' box. Enter a 'Limit (kbit/s)' figure. You could subtract your Voice Outbound kilobits number you created from above from your total bandwidth. For example, I have a 10 Megabit connection (10000 kbits) and have created a shaping policy to prioritize voice in the amount of 1 Megabit (1000 kbits). I could enter 9000 kbits in this box (9 Megabits). Select traffic position number 1. We want this policy to be first. Select the web services and/or ftp services check boxes. Save then activate.
In Astaro Sophos UTM version 9, we now also have the ability to police traffic inbound as well without applying the trick from Considerations section 5. This step is also optional but I recommend it if you are on Version 9. There is a new tab called 'Download Throttling'. This is where you will set your inbound policing. Before we go to this tab, let's first create 3 new traffic selectors as follows.
'SIP Inbound' --> Source 'Internet IPV4' --> Service 'SIP' --> Destination 'Any (or your pbx internal ip)'
'RTP Inbound' --> Source 'Internet IPV4' --> Service 'RTP Ports' --> Destination 'Any (or your pbx internal ip)'
'Any Inbound' --> Source 'Internet IPV4' --> 'Any' --> 'Any'
Now go to the 'Download Throttling' tab. Select the External Interface from the drop down menu. Next, click the 'New Download Throttling Rule' button. We want to ensure that VOIP is not policed inbound so we will create the voip rules first. We are going to set the bandwidth higher than what we actually have. For example, if we have 10megabits of bandwidth, we'll set 100megabits for these first two rules as follows. This will ensure voip is not throttled.
'No voip throttling Inbound' --> Limit (kbit/s) 100000 --> Shared --> select the RTP and SIP inbound selectors
Next rule, again select the External interface from the dropdown.
'Limit all non voip traffic Inbound' --> Limit (kbit/s) 9000 --> Shared --> select the 'Any Inbound' selector.
Be sure the position of this rule is at the bottom, we want this read last.
Activate your new rules.
You are pretty much done, but do remember, the idea behind QOS is that it is generally recognized as an outbound technology for the most part. It should be turned on outbound anywhere else you have voice equipment that needs to connect to each other in order to get the broadest QOS coverage. But, QOS can also be a cumulative approach, you might find you need to implement all the steps listed here.
.
This thread was automatically locked due to age.
