Prioritize VOIP Over Everything Else

drwebster93

Thanks for the replies. Let me clarify my setup a little bit. I am using two pfsense boxes with an IPSEC site to site VPN. I have an Avaya IP office phone system on one end, and five Avaya IP phones on the other end. The IP phones connect to the phone system box over the VPN. Does the traffic shaper wizard still work for this setup?

Thanks!

drwebster93

Ok. Here is what I have done so far:

-Went through the wizard on each end.
-I told it to prioritize voip (I left the provider on generic and the address blank)
-I was told by our phone tech that the phones would use a maximum of 128 kbps on a call, so I multiplied that by our 5 ip phones and set the upload and download to 640 kbps.
-The only other setting I changed in the wizard was to give IPSEC tunnels higher prioritization.
-I then created a layer 7 container that sends H323 protocol data (which is what I was told our phones use) to the qVoIP queue.

So my questions are:

-Will this setup work for me (see previous post for how our network is setup)?
-Is the layer 7 container necessary?

Thanks!

podilarius

There is a queue monitor. If you make a phone call and you don't see traffic in there, then it is probably not working. Given your setup though, you need to prioritize IPSEC traffic just as high as VOIP since the voip setup is dependent on it. JMO.

drwebster93

@podilarius:

There is a queue monitor. If you make a phone call and you don't see traffic in there, then it is probably not working. Given your setup though, you need to prioritize IPSEC traffic just as high as VOIP since the voip setup is dependent on it. JMO.

Right now, IPSEC traffic is supposed to be going to the qOthersHigh queue (the wizard set that up). However, I hardly ever see any traffic going through it on the queue status page. I opened up the traffic graph for IPSEC and confirmed that there IS traffic going over the VPN, but it doesn't seem to be going through the queue it is set to. I haven't changed the settings except giving IPSEC higher priority through the wizard, is there any additional configuration (create some additional rules?) that needs to be done to prioritize site to site IPSEC traffic?

drwebster93

I have come across a post on this forum recommending that the IP addresses of the IP phones could be used to prioritize the traffic. I have looked through the setup pages and help documentation, but I cannot seem to figure out how to prioritize by IP address. Any suggestions?

Thanks!

podilarius

In the floating rules there is a source and a destination. Just specify the IP range of the phone as the source for outgoing connections and the destination for inbound queue.

drwebster93

@podilarius:

In the floating rules there is a source and a destination. Just specify the IP range of the phone as the source for outgoing connections and the destination for inbound queue.

That would work for one phone, but how would I do this with five IP phones?

Thanks!

kyu

@drwebster93:

@podilarius:

In the floating rules there is a source and a destination. Just specify the IP range of the phone as the source for outgoing connections and the destination for inbound queue.

That would work for one phone, but how would I do this with five IP phones?

Thanks!

Create an Alias, and input the IPs of the phones inside the Alias.
In the floating rule, specify the alias instead of IP.

podilarius

I created a subnet just for phones off another interface and used VLANs to separate phone from all other traffic. Before that, I used a subnet for the rule, like 10.0.0.184/29. That covers the range from 184-191 which is more that enough for my phones. The phone where handed out a reserved IP within this range by DHCP.

dhatz

@drwebster93:

Thanks for the replies. Let me clarify my setup a little bit. I am using two pfsense boxes with an IPSEC site to site VPN. I have an Avaya IP office phone system on one end, and five Avaya IP phones on the other end. The IP phones connect to the phone system box over the VPN. Does the traffic shaper wizard still work for this setup?

iirc pfsense can't shape traffic inside an IPsec tunnel, at least not "directly" – you'd need to shape the ESP packets on WAN if (search forum for previous posts on the subject).

drwebster93

@kyu:

@drwebster93:

@podilarius:

In the floating rules there is a source and a destination. Just specify the IP range of the phone as the source for outgoing connections and the destination for inbound queue.

That would work for one phone, but how would I do this with five IP phones?

Thanks!

Create an Alias, and input the IPs of the phones inside the Alias.
In the floating rule, specify the alias instead of IP.

kyu, thanks for the tip on the Alias!

So I made an alias, and put that in for the VOIP adapter in the traffic shaping wizard. I have been monitoring my queues though, and it doesn't seem to be doing much. If I monitor my queues on the pfsense box on the side with our phone system, I see around 50 kb/s per call in the qVoIP on WAN queue. But at the same time, on the pfsense box on the side with the 5 IP phones, I am only seeing around 900 b/s per call. The only difference in configuration is that I used the IP address of our phone system for the VOIP adapter in the wizard on the side with the phone system, and an alias with the IP addresses of the 5 IP phones on the side with the IP phones. Any ideas?

Thanks!