VoIP for Dummies 2005

130 Part II: Taking VoIP to Your Network

This chapter discusses two primary issues related to VoIP and the Internet. First, it discusses using VoIP over the Internet, particularly the quality of the VoIP connection over the Internet. The second issue is related to security: connecting your VoIP-enabled network to the Internet and still ensuring the safety of your servers and data.

Network Options Affect

Quality of Service

Running VoIP over the Internet is an option, but it is clearly not the best option for most companies. The goal of any VoIP implementation is quality of service, and the key to achieving that quality is figuring out what is best for your specific network configuration.

Most companies install an intranet to facilitate internal access to applications and data. An intranet is a network that uses the same protocols and tools as those used on the larger Internet, such as e-mail, Web browsers, and instant messaging. The difference between an intranet and the Internet is that an intranet is private, typically created for the access of employees and selected vendors or customers, whereas the Internet is public and open to anyone.

You do not need a connection between an intranet and the Internet, but if your company chooses to create a connection, it uses a firewall with a gateway at the connection point. These allow a company to monitor and secure traffic over the connection. With a firewall and gateway in place, a company protects itself against Web-related traffic affecting their private, dedicated network — including their VoIP network.

Some small, single-location companies that cannot afford their own private wide area network use the Internet as a medium for transferring VoIP traffic from their LAN to the outside world. If voice communications are critical to this business, I don’t recommend running VoIP this way because the quality of the voice calls is at the mercy of factors out of the company’s control. It is better (and more secure) to use a VoIP hosting company. This separates VoIP traffic from all other Internet traffic while keeping the rest of the network in place.

Large companies with many sites often use private, dedicated transport lines to ensure the requisite quality for their VoIP traffic. The network uses highbandwidth connections between major company facilities, with smallerbandwidth connections to the smaller company sites. In companies with a myriad of site locations, it is common to establish large regional hubs for their networks. Each smaller site connects to its respective regional hub using dedicated transport lines, sized according to their bandwidth needs.

Chapter 9: Using VoIP on the Internet 131

Provided that the company’s dedicated network has enough bandwidth, intranet traffic can also be run over the same connections. If Internet access is needed over the company’s network, they often establish an Internet connection at one of their facilities (such as company headquarters) and then use that connection to provide Internet access to remote sites on the company network. This type of access plan provides a way for companies to limit the number of firewalls and gateways necessary, as well as minimize Internet access fees.

Figure 9-1 illustrates a typical regional hub for a company running both VoIP and an intranet. VoIP calls get carried on the private dedicated network. The private network is physically separated from the corporate Internet connections and, therefore, the actual Internet. Notice that the firewall controls all traffic from the Internet for security purposes. It also controls access for nonemployees accessing the corporate intranet through the public Internet. (Firewalls are discussed later in this chapter.)

132 Part II: Taking VoIP to Your Network

Internet Protocols and Quality of Service

As discussed in Chapter 1, TCP/IP uses a layered approach to networking. When VoIP is the network transport service, the UDP protocol is substituted for the TCP protocol. UDP (user datagram protocol) is one of the many protocols included in TCP/IP, so VoIP can be made to run on any network type.

The Internet is not the only network that supports VoIP. Any network — private or public — that runs the TCP/IP protocol suite can run VoIP. Quality of service varies from network type to network type, and the ISP you choose can affect the QoS you experience.

ISPs make the Internet go round

An Internet service provider (ISP) is a company in the business of providing Internet access to consumers and businesses. It is common to rank the quality of ISPs based on their tier level (see Figure 9-2). Tier-0 is a logical ring formed by all the Tier-1 ISPs. Tier-1 ISPs are considered the largest and usually the best type of Internet access because there is only one “hop” between the tier-1 ISP network and the end-user’s network.

Global Internet

T3 Line

Private network

134 Part II: Taking VoIP to Your Network

Because VoIP packets are constructed pretty much the same way as data packets, VoIP can run on any type of data network that utilizes TCP/IP. Because most corporate networks already handle TCP/IP traffic, the fact that VoIP packets can travel on the same network means that converting to VoIP can be relatively painless.

Firewalls for Security

Many of the security measures devised since the early 1990s have been centered on protecting private networks from the public Internet. Today the larger corporate networks use a firewall when connecting their private networks to the Internet. They then can run VoIP on their private network without threat from the Internet.

In the same way, smaller companies with fewer than four or five locations can elect to go with a private network in a similar way. But depending on their business needs and total number of employees, it may make more sense to use a virtual private network (VPN). VPNs present interesting firewall security challenges. (More on VPNs in a virtual minute.)

Chapter 9: Using VoIP on the Internet 135

Consumer VoIP and firewalls

Most of the security measures utilized today read and inspect the packets that traverse the network. Security therefore comes down to deciding where in the network the packets will be examined and what type of systems you will use to monitor the packets. For most companies, the examination location is at the connection point to the Internet, as described earlier in this chapter.

Companies that implement a VPN require each location on that VPN to use a firewall to access the Internet. If the company is to run VoIP over the VPN with good QoS, each site must use private, dedicated transport lines to connect their respective locations to the Internet.

The firewall must be configured to support tunneling of VPN traffic. Tunneling is a method for ensuring that packets traverse the public Internet in a secure manner that prevents disruption. With this type of network infrastructure, each location’s LAN is secure from outside Internet threats and VoIP telephony traffic is carried over the Internet.

Three major categories of firewalls are available. Each comes with a different price tag and level of sophistication or complexity. Depending on the firewall, a company may need to have full-time skilled staff or corresponding contractors available to set up, program, and maintain the system.

The three types of firewalls follow:

Packet filter: This is a simple firewall that entails only nominal cost. Some are even free. Consumers, mobile users, and very small businesses use the low-end flavors that cost from $0 to $59. Some small companies use router devices that come preprogrammed with this level of firewall security and cost from $800 to $2500.

136 Part II: Taking VoIP to Your Network

Proxy server: Full-fledged proxy servers tend to be complex to establish and maintain. They are more suitable for use at a single location. Because they must first permit unwanted packets on the network before they can discard such traffic, they are controversial in multisite networks. Costs range from $5000 to $15,000.

Stateful event monitor (SEM): These firewalls are the most comprehensive and therefore the most complex. They are typically used in large networks that have an inside protected network that needs to be separated, at the physical layers of the network, from their public Internet access network and their semipublic intranet network. SEM firewalls can examine the entire contents of any packet it sees, make decisions based on any field contained in the packet, and, like any firewall, can reject any packet from access into the company’s protected network or even to its intranet. SEMs include extensive network management capabilities. Costs range from $24,000 to $35,000.

Figure 9-4 illustrates how a SEM firewall does its duties. This is the same type of firewall used in large networks, such as those shown in Figure 9-1. Most large corporate networks don’t use VoIP over the Internet. VoIP packets instead traverse the company’s private dedicated network and never even see the other side of the firewall.

Internet