• Broadband – install or verify you have a modem that can be put into a bridge or pass-through mode.
  • Best model modems usually provide one coax input and one or two
     
• Fiber – Ethernet handoff to the firewall
• DHCP/Static – this is a customer preference; our service will function with either setup. The firewall WAN interface should have a Public IP Address.
• ISP-provided equipment that contains or is equipped with Telephony or RJ-11 ports on the back of them for digital voice services will require replacement, or assistance from the ISP to remove functionality from those ports and services, in order to not to interfere with Crexendo Services.

• The download and upload speeds should be considered when adding VOIP or any additional services to your network.
• Network administrators should allocate enough bandwidth (download/upload) for data services and for VOIP traffic.
• VoIP Traffic takes up approximately 100-120kbps per active call.

• Crexendo recommends that customers with 3 or more VoIP devices should consider installing a business/enterprise-grade firewall to ensure the best performance and security.
• A business-class firewall is required to provide proper SIP signaling, QoS, and traffic shaping.

• A business-class switch is required to provide best practice LAN configurations for VoIP and Data.
• POE is recommended to eliminate the need for power adaptors for phone devices.
• Managed Switch will allow a network administrator to configure VLANs, QoS, and security on the network

• Proper segmentation of network services is the best industry practice.
• Provide separate logical VLANs for your VoIP and Data traffic.
  • This will allow the network admin to use/share one Ethernet cable between a phone and a computer. This would logically segment the traffic by tagging the VoIP traffic to a specified VLAN and the Data traffic to its own/or Native VLAN.
     
• Provide separate physical Ethernet jacks for VoIP devices (on Voice VLAN) and for Data devices (on Data VLAN).

SIP ALG is a proxy function of firewalls that allows the firewall to translate and speak as a “proxy” to VoIP providers SBC and Endpoint servers. This communication on most firewalls tends to have difficulty making this translation (i.e., translating English to Greek, then Greek to English on its way back), the signaling may get malformed.

• We recommend on most firewalls to disable SIP ALG.
• Only on certain Cisco ASA models do we recommend enabling or keeping SIP ALG on:
  • IOS versions between 8.2 to 9.3
  • If the IOS version is 9.4 and above, disable SIP ALG (“no sip-inspect” within the policy-map global policy)

UDP timers come into play on networks with VoIP devices, where there is a registration cycle that keeps the session and pinholes open for communication between the VoIP device and Crexendo VIP servers.

Depending on your firewall’s default setting, we recommend raising the UDP Timers to ensure the session and port are not torn down.

• UDP Timer or UDP Inactivity Timers
  • Set to anything above 60 seconds, we typically use 80 seconds as a standard.
    business-class
• Cisco ASA and ISR models, we use the following CLI commands to update:
  • timeout xlate 3:00:00
  • timeouts conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  • timeoutsunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcppat 0:05:00
  • timeoutsip 1:10:00 sip media 0:10:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  • timeoutsip-provisional-media 0:02:00 uauth 0:05:00 absolute

ACLs are security lists that allow or deny specified traffic flow within and through a firewall or router. Depending on your network design and setup, some instances require very specific traffic to be allowed through a firewall, while simpler designs may already have all traffic allowed. ACLs also help with adding QoS services, UDP timers, and bandwidth management rules to be applied to, in our case, specified VoIP traffic.

• Outbound ACL’s
  • Allow VoIP-defined traffic (see table above) by ports and IP addresses.
  • Allow NTP traffic for the devices on this subnet.
  • Allow DNS lookup for the devices on this subnet.
     
• Inbound ACL’s
  • Allow inbound traffic from the IP addresses defined in the table below (Crexendo VIP traffic IP Addresses, URLs, and Ports section) to the VoIP device subnet.

Quality of Service allows the firewall to prioritize the VoIP traffic over normal data traffic. The QoS can be identified based on DIFF SRV tag (EF 46), ports, or destination IP addresses (see table below; Crexendo VIP traffic IP Addresses, URLs, and Ports section)

• Define the VoIP specified traffic to be “Priority” traffic when traversing the firewall.
• On a lot of firewalls, this can be done within the ACL rules, and ordering of the ACL rules, putting the more important traffic (VoIP) at the top of the list.

  NOTE: Typically, we can only control the outbound traffic’s priority.

   

Shaping or reserving of bandwidth allows a network administrator to allot a static or dynamic (depending on the firewall model) amount of bandwidth for VoIP traffic. Shaping goes hand in hand with QoS/Prioritizing VoIP traffic.

These features together help protect the quality of the voice traffic even on high transactional, high-volume firewalls, and in case of bandwidth saturation.

• Configure either traffic shaping or bandwidth reservation to allot for a minimum of half the number of VoIP devices on the network. Also, allowing bandwidth up to what is needed (infinite) or if all the VoIP devices were active at the same time.

  EXAMPLE: If 10 phones are on a network, I would set my minimum bandwidth limit to be at least 500kbps (5x100kbps) and a max of 1-1.5mbps.

   
• Some models use percentage % for the shaping; this can be calculated in the same way based on the upload bandwidth.

All business class firewall’s have many different security modules added to their software. We want to make sure that we “whitelist” or “exclude” all VoIP traffic from any of these types of services. The goal is to provide the VoIP traffic with the most efficient path in and out of your company’s firewall. 

Below are some services that you will want to disable or whitelist the VoIP traffic detailed in the table above:

• Antivirus
• DPI – Deep Packet Inspection
• Intrusion Prevention
• Content Filtering
• DHCP option 66
• PXE BOOT