Subject: [NEXTEL-1] CONTINUITY PLANNING FOR VOIP

From: Marcelrf <[email-masked]>
Date: Mon, 15 Mar 2004 15:02:33 -0500

CONTINUITY PLANNING FOR VOIP

Lawrence Imeish provides advice on how to harden and protect VoIP and IP
telephony networks.
As more organisations look to IP telephony and VoIP to boost
productivity and reduce overheads, business continuity managers should
re-evaluate their existing data networks to assess the new challenges
faced. Adding VoIP or IP telephony can be a relatively simple, or very
difficult process. Any VoIP integration specialist will tell you that
spending time planning the service, will produce a stable and readily
accepted system.  Adding voice to a data network magnifies the
importance and risks of the network. The integrated network becomes an
extremely critical piece of the business and should be well protected.
Imagine the loss in productivity and revenue when a network outage
affects not only the users’ ability to access network applications, but
their ability to make and receive calls.

Business continuity planning for IP telephony involves examining every
layer of the network and all its dependant components. The most
important part of any IP voice system is of course the IP. When adding
critical services such as voice to an IP network, be sure to understand
the service is only as good as the network that carries it. Many times
VoIP and IP telephony services fail due to lack of attention to basic IP
connectivity and IP QoS.

IP network link redundancy becomes vital when supporting an IP telephony
system. Most IP voice systems require centralised call processing; this
is where the call routing decisions are made based on dialled digits,
time of day, and network utilisation, etc.  Loss of connection to the
call routing service or application failure would lead to all IP phones
no longer able to make or receive any calls. For this reason, all WAN
links that carry voice or voice signalling should be made redundant with
shadowed circuits or at the very least ISDN backups. All backup links
should be tested on a regular basis during maintenance windows to
confirm they automatically cut over when the primary link fails.  The IP
routing protocols (OSPF, EIGRP) should also be optimised for fastest
possible convergence upon a network change and should recognise VoIP as
‘interesting traffic’ capable of initiating the backup link. It’s
beneficial to test the failover configuration and measure the time it
takes for calls to pass after a WAN Link failure.

In terms of IP and Ethernet redundancy, it’s best that each edge switch
have at least two links to the core switches. This will create
redundancy in the LAN even if one of the core switches fails. It is
difficult and expensive to cluster the edge switches, a secondary
solution is to have a cold unconfigured standby switch ready to deploy
in the event the edge switch fails.
VoIP and IP telephony systems can terminate calls in one of two places;
to another IP telephony device/endpoint or a VoIP gateway that
interfaces to the local PSTN. Call routing redundancy is often
overlooked when deploying or managing IP voice systems. If the
enterprise has multiple offices or multiple gateways, backup call
routing schemes should be devised so that outbound calls will make it to
the PSTN even if the preferred local gateway or PSTN service is down.
For example if there are two offices, one in New York and one in
Washington, and the local Washington gateway fails, all the users
outbound calls from Washington could be sent to the NY via a WAN
connection (leased line or internet VPN) and dialled back to Washington
using the NY gateway. This could be an expensive solution because during
the local outage, all outbound Washington calls would incur long
distance charges and the backup gateway would need to be designed to
handle the extra call capacity. Another backup option is to send the
organisation’s calls to an Internet telephony service provider for
termination; usually $0.02 - $0.05/min for North American calls. This
creates new security concerns but is a viable option for companies that
do not want to invest in the additional hardware costs.  A correctly
designed and managed redundant IP Voice system will take advantage of
IP’s inherent survivability/rerouting capabilities. This, plus VoIP’s
ability to make call routing decisions contingent on the IP network’s
status, makes for a robust and survivable voice communications system.

Each vendor has their solution for a high availability call routing
service, usually a central cluster or two, or nodes with decentralised
limited call routing services as backups (i.e. Cisco Call Manager and
Call Manager Express). When deploying voice services, take advantage of
the vendors’ clustering and redundancy solutions and integrate them in
the IP voice network, it will pay off exponentially in the event of a
hardware or application failure or outage.

An important IP voice design and management detail is the need to ensure
that every network element that carries IP voice has adequate UPS and
backup power. This extends to more than just the routers, switches and
gateways, to include any DSX panels, call managers, CSU/DSUs, Wireless
bridges, and even locally powered IP telephones. An effective design for
LAN IP phone redundancy is to use edge switch to power the IP phones,
this saves the need for a separate UPS for every phone set. If the
switch and phone support 802.3af (Power over Ethernet) it would be wise
to make use of it. It is helpful to create a flowchart that traces a
typical IP call and note each powered device at every ISO Layer that the
RTP Stream (the call) or call signalling traverse during the course of a
call, end point to end point and confirm they all have proper backup
power. If the power goes out to the office during an emergency the IP
phone may be the only means of calling for help, therefore it is crucial
that the phone and the whole IP voice system always function.

Finally security in an IP voice environment is also magnified; a hacker
in the network will not only steal or damage files, but could possibly
access the VoIP/PSTN gateways and prevent legitimate users from making
or receiving calls or even make thousands of dollars in unauthorised
calls. IP voice security is an extension of basic IP security; it is
assumed the network already has existing firewalls and other security
architecture. If it does not, then IP voice should not be deployed until
the IP security is hardened. IP voice has special requirements for
firewalls and user authentication. Depending on the protocol the system
uses - H.323, SIP, Skinny - the firewall may need to be configured to
allow incoming RTP traffic over a range of UDP ports, this can create a
security risk. The best solution is to use VPNs between sites connected
through the Internet and to ensure that those VPN devices have the
processor power required to pass the voice packets with minimal delay.
Another solution is the newer VoIP specific firewalls that actually work
with your call routing systems to dynamically open and close ports on a
per call basis.

Needless to say any calls (or data) crossing the public internet should
be encrypted. IP
voice also allows for real time call accounting and active toll fraud
detection, these
features should be activated if they came with the billing software

Although it may appear that VoIP creates a more complicated and
vulnerable network than traditional TDM based telephony, it is important
to point out its benefits. The strongest factor in deploying IP
telephony is the direct monthly cost savings reaped from a substantially
reduced telecoms bill. Enterprises have seen their phone bills slashed
by as much as 60 percent when deploying IP voice. There are other
factors such as improved worker productivity, faster customer response
times, and reduced cost of any moves, additions, or changes due to web
based user provisioning. The deployment of IP voice services also
provides an opportunity to unify your network and combine what were once
two separate systems into one manageable, integrated, redundant unit.
Finally IP telephony sets the stage for new applications and services.
Imagine having the power to access vital company data and applications
directly from an IP phone or a Wi-Fi IP phone handset while
making/receiving calls, or receiving your voicemail via e-mail and on a
web page. These new applications and services will make it very
difficult for anyone who has experienced IP voice to go back to legacy
PSTN. In fact, a properly planned and managed IP telephony or VoIP
network will give the enterprise as much if not more survivability and
availability as a comparable legacy system and still provide new
features and applications which the legacy system simply cannot.

Lawrence Imeish is a consultant specialising in IP telephony and VoIP
deployment. He
holds a CCIE, and has over 10 years planning, deploying and managing
enterprise
networks. He can be reached at [email-masked]

http://www.continuitycentral.com/feature069.htm
--
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

-- 
    "NEXTEL-1 IT'S NOT JUST NEXTEL"
  Note The New address 
Subscribe to Nextel-1: http://www.groups.yahoo.com/subscribe/NEXTEL-1

  "NEXTEL2 FOR iDEN SOFTWARE DEVELOPERS"
Subscribe to Nextel2: http://www.groups.yahoo.com/subscribe/NEXTEL2

  "WIRELESS FORUM HOMELAND SECURITY GROUP"
     The Complete Resource for Wireless Homeland Security.
Subscribe to WFHSG:  http://www.groups.yahoo.com/subscribe/WFHSG

Yahoo! Groups Links

<*> To visit your group on the web, go to:
     http://groups.yahoo.com/group/NEXTEL-1/

<*> To unsubscribe from this group, send an email to:
     [email-masked]

<*> Your use of Yahoo! Groups is subject to:
     http://docs.yahoo.com/info/terms/