atcomsystems.ca/forum Forums VOIP Phones & IP PBX Networking VPN QUESTIONS

@hot.sandwichz - Excellent 10,000 foot view explanation. You clearly know what you're talking about.

@dtmf - Thank you. We all have holes in our knowledge.

@emmitt2727 - Indeed. I've kept a strong foothold on both voice and data islands as convergence of the two has been developing for decades.

/rant begin/

Though I'm all for it, I'm concerned that VoIP security has still not been fully addressed. I predict that the next "bomb" on our country won't be suffered by a weapons-grade plutionium/uranium explosive, but rather with a well-planned cyber attack on our communications devices. Given the number of machines attached to both the public internet and (for example) our electric grid, banking system, central offices and such, it's easy to see just how catastrophic such an attack could be. I'm not down on VoIP or ANY kind of data that's sent using packet-switched technology...I just think that the payload for such stuff is horribly insecure. Security and reliability is what so many of "those old Bell-heads" might just be talking about if one listens carefully. Be the best computer guy you can be, but don't forget about "five nines", the days when techs would work through the night to restore service and all the well-thought science (from voltage, twists/inch, wire oxidation, etc) that continues to provide things like very high-speed data over 150+ year old technology.

/rant end/

I hate VPN's. All too often I see them used as the poor-admin's attempt at security instead of addressing the issue properly to begin with. They do serve a purpose and I enjoy their site-to-site capabilities, but using them as an end-user is such a pain.

All that being said, SIP is a horribly insecure protocol. So much so that it does make sense to use something like an IPSEC on port 5060 where possible. If you can't do that, you should try to use IP ACL (access control list), and limit connectivity by IP. This of course becomes an issue when you want to have road-warriors. At that point IPSEC is the way to go.

Encrypting the audio is a bit much in my opinion. It just add's overhead to an already bloated and high bandwidth requirement. Plus a lot of VPN routers don't handle the audio load that well. Most of the smaller SOHO type of VPN routers are really designed for encrypting EMAIL and stuff to the server. The CPUs that they use are kind of underpowered most of the time.

If you are looking at a VPN device, try to find out what it's VPN Packets Per Second rate is. Every SIP conversation/channel/trunk/etc is going to send 100-pps (Packets Per Second). So, take your estimated number of simultaneous phone conversations (NOT to be confused with number of endpoints), and multiply by 100. That's how many packets per second (pps) you will need.

And another tip, if the router vendor won't tell you packets per second, just divide their VPN throughput number by 1544-bytes. Don't forget to convert the routers MegaBytes or KiloBytes into just bytes first! This will give you the ballpark PPS that they will do. Why 1544 you ask? Cause that's the standard max payload size for TCP/IP packets, and consequently, the payload size that almost every router vendor uses when putting together their marketing propaganda.

Well said ..... if we (or the IT guys) are doing it for ourselves then it is no big deal ... if we (or the IT guys) are doing it for a customer and billing them then we (or the IT guys) shouldn't accept the work ... it is not in the customers, or the vendors, best interest. :thumb:

Like Dag said......

The lines of distinction between telephone guys and data guys are turning from sharp to blurry...

Like it or not, the two technologies are merging for better or for worse. I too am trying to be one of those guys who can do both.

In my case I just need single machines to be able to access the network remotely. Doesn't Windows have a built in VPN client?