Navigation

• Introduction
• Quick References
• General Best Practices
• Recommended Hardware Features
• Expanded Details
  • Bandwidth Considerations
  • Specific Firewall Configurations for VoIP Environments
  • Monitoring and Maintenance
  • Network Redundancy and Failover
  • Remote User Considerations
  • Disaster Recovery Planning
• Requirements
• Considerations
• QoS/Priority (8x8 DSCP / CoS Values Applied)
• 8x8 Outbound Datacenter Ports
• Applications Requiring Outbound Connections
• Applications Requiring Incoming Connections
• 8x8 Datacenter Domains
• 8x8 Datacenter IP Ranges

Network Best Practices

Introduction

Quick References

• Latency:
  • Target: Less than 150 milliseconds (ms) one-way delay for acceptable call quality.
  • Ideal Target: Less than 100 milliseconds (ms) for optimal call quality.
• Jitter:
  • Target: Less than 30 milliseconds (ms) of variation in packet arrival times.
  • Ideal Target: Less than 10 milliseconds (ms) for optimal call quality.
• Packet Loss:
  • Target: Less than 1% packet loss rate.
  • Ideal Target: Zero packet loss for optimal call quality.
• Delta (Difference in arrival time of RTP packets):
  • Target: Less than 30 milliseconds (ms) delta between consecutive packets.
  • Ideal Target: Consistent delta at 20 milliseconds (ms) for optimal call quality.
• Clock Drift:
  • Target: Clock drift should not exceed 1 millisecond (ms) per minute.
  • Ideal Target: Clock drift should be negligible, ideally staying within microseconds (µs) per minute.

General Best Practices

• Avoid Double-NATing
  • Double NATing UC services is problematic due to increased complexity, latency, and NAT traversal issues. It obscures visibility, complicates troubleshooting, and can lead to interoperability and security concerns. It's best to avoid double NATing and opt for single NAT configurations or alternative solutions for NAT traversal.
• Symmetric Route Paths
  • Ensuring symmetric route paths between UC endpoints and production facilities is vital for maintaining consistent network performance, reliability, and security. Symmetric routing ensures that traffic travels predictably in both directions, minimizing issues such as packet loss, latency, and asymmetric routing. It simplifies troubleshooting, supports optimal performance for real-time communication services, and facilitates uniform enforcement of security policies.
• Maintain Full-Duplex Communication
  • Maintaining full-duplex communication for UC services is essential for smooth, real-time interactions. It enables simultaneous transmission and reception of data, ensuring seamless conversations without interruptions or delays. This optimizes the performance and user experience of UC services.
• Avoid Active-Active Load Balancing
  • Active-active load balancing for UC services production traffic should be avoided. This setup, where traffic is evenly distributed across multiple paths, can lead to issues such as out-of-order packet delivery, jitter, and call quality degradation. Additionally, it can complicate network management and troubleshooting processes. Instead, active-passive or intelligent routing mechanisms should be considered to ensure consistent and reliable performance for UC services.
• Avoid WAN Accelerators
  • Avoid routing UC services production traffic through WAN accelerators. Doing so can introduce latency, packet loss, and jitter, adversely affecting the quality of voice and video calls. If unavoidable, whitelist UC traffic to bypass WAN accelerator interference and ensure optimal performance for UC services.
  Note: Troubleshooting UC services production traffic through a WAN accelerator may require physically removing the WAN accelerator from the traffic path.
• Quality of Service (QoS)
  • Consider enabling Quality of Service (QoS) enforcement for voice and video aspects of UC services. QoS prioritizes UC traffic, ensuring low latency and minimal packet loss, crucial for maintaining high-quality voice and video calls.
  • If QoS enforcement is in place, conduct packet captures to verify appropriate packet marking for both ingress and egress packets passing through the WAN, following service guidelines.
• Setup Voice / DATA VLANs
  • Competing network traffic can degrade voice communication. Voice packets may be lost if delayed by other data, leading to broken voice. To prevent this, separate voice onto its own VLAN for better control and priority. Providing clear names to VLAN IDs is recommended (VOICE, DATA).

Recommended Hardware Features

• Managed Switch or Router
  • The networking device must have GUI or CLI administrative capabilities for configuration. 8x8 advises against connecting non-managed switches or hubs to the network. If a non-managed switch is necessary, ensure that only the data VLAN is configured on the port with appropriate duplex settings to prevent network collisions.
• Power over Ethernet (PoE)
  • The device must support PoE with sufficient power for all connected IP phones simultaneously (applicable to access-layer switches only).
• LLDP and LLDP-MED Support
  • Required for edge data switches.
• VLAN Support
  • The device must support a minimum of two VLANs on all switches (one for voice, one for data) and trunking with 802.1Q VLAN tagging.
• Quality of Service (QoS)
  • The device must support QoS at layer 2 for edge devices and at layers 3 and 4 for core switches and routers, including queuing, shaping, selective-dropping, DSCP trust, and link-specific policies.
• High Availability and Advanced Routing (Optional)
  • The device should support protocols such as Rapid Spanning Tree, VTP, BGP, OSPF, HSRP, VRRP, or similar.
• Auto Negotiation
  • The device should support auto speed and duplex negotiation by default, with the option to manually configure individual port speed and duplex modes as needed.
• Port Status and Error Reporting
  • The device must provide individual-port speed and duplex mode indication, along with error and traffic statistics, which are essential for troubleshooting.

Expanded Details

Bandwidth Considerations

Challenges

• Imbalanced internet speeds: Asynchronous internet speeds, common in cable modem connections, can lead to voice quality issues due to insufficient upload bandwidth.
• Competition for internet resources: Bandwidth contention from other applications or users can degrade VoIP performance.
• Microbursting: Rapid bursts of data packets can overwhelm network buffers, causing voice quality deterioration.
• Propagation delay: Long distances between endpoints can introduce significant latency, affecting call quality.
• Double firewalls: Concurrent firewalls in office environments may impede VoIP traffic flow.
• Wi-Fi limitations: Wi-Fi connections, while convenient, can suffer from interference and bandwidth constraints.

Factors

• Local internet usage: Consider the demand from other applications sharing the bandwidth.
• ISP reliability and oversubscription: Ensure stable peering relationships and minimal oversubscription.
• Quality of Service implementation: Deploy QoS mechanisms to prioritize VoIP traffic.
• Connection type: Direct cable connections often offer superior performance compared to Wi-Fi.

Guidelines

• Single Home User: 30-50Mbps Down / 10Mbps UP (minimum)
• Small Office (<30 Users): 50Mbps Down / 20Mbps UP
• Medium Office (31 to 100 Users): 50-100Mbps (synchronous)
• Large Office (>100 Users): 100 to 500Mbps (synchronous) or consider SDWAN or MPLS.

Additional Notes

• Integrating Voice over Internet Protocol (VoIP) into a data network necessitates comprehensive Quality of Service (QoS) implementation across all network switches and routers. Mere augmentation of bandwidth often falls short in ensuring optimal voice quality. Internet link speed, typically the final bottleneck in a data network, does not inherently address issues like jitter, where non-prioritized data can disrupt VoIP packet intervals. With only one default queue available, data networks, initially not engineered for voice traffic, require specialized QoS mechanisms to uphold voice quality standards.

Specific Firewall Configurations for VoIP Environments

Required Ports

• SIP (Session Initiation Protocol): UDP/TCP 5060, 5061
• RTP (Real-Time Protocol): UDP 16384-32768 (or specific range used by the VoIP system)
• RTCP (Real-Time Control Protocol): UDP 16384-32768 (paired with RTP ports)
• HTTP/HTTPS for signaling and management: TCP 80, 443

Stateful Firewalls

• For communication sessions originating from VOIP phones, desktop applications, and mobile applications (over WLAN), connections are initiated from the respective devices to our data center.
• Typically, when these communication sessions pass through a stateful firewall, only specific ports need to be opened outbound, as outlined below.
• Inbound traffic from 8x8 / Fuze will access the network via ports opened by outbound sessions initiated by VOIP phones and desktop applications.
• Any inbound troubleshooting protocols, access, or visibility initiated from the VOIP provider will require inbound allowance into the network (e.g., ICMP traffic).
• The configuration specifics of these protocols may vary based on device, vendor, package, and firmware version.
• UDP timeouts, SIP/RTP timeouts, and/or Application-Level Gateways (ALGs) may require adjustment to align with VOIP service timeouts indicated below. For confirmation tailored to your exact hardware, revision, and configuration, it's recommended to reach out via support.

NAT Traversal

One-to-One NAT

• Configure one-to-one NAT for VoIP devices to avoid complications with multiple devices behind a single public IP. This ensures clear and direct routing of VoIP packets.

STUN/TURN Servers

• Use STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT) servers to facilitate NAT traversal for VoIP traffic. These servers help in correctly routing traffic through NAT devices.

Firewall Rules

Access Control Lists (ACLs)

• Create specific ACLs: Define ACLs that explicitly allow VoIP traffic while denying unnecessary traffic. This minimizes the attack surface and enhances security.
• Prioritize VoIP traffic: Use ACLs to prioritize VoIP traffic over less critical data traffic.

TCP / UDP Timeouts

• Port shuffling indicates that the assigned NAT ports are changing frequently. This is due to session time out on the firewall or router in use. For most business class firewalls this can be modified by changing the UDP timeout for non-SIP over TLS (non-SRTP) devices. In cases where SIP over TLS (SRTP) is in use, the TCP time out should be modified.
• These settings should be modified to match the registration timers on the phones, which call out to register every 11 minutes, or 660 seconds.

Monitoring and Maintenance

• Regular Monitoring
  • Implement continuous monitoring of network performance and UC service quality using tools that can provide real-time alerts and historical analysis. Key metrics to monitor include latency, jitter, packet loss, and call quality.
• Periodic Audits
  • Conduct regular network and security audits to identify and rectify potential vulnerabilities, misconfigurations, and performance bottlenecks.
• Capacity Planning
  • Regularly review network capacity and performance to anticipate future needs and plan for upgrades. Ensure that bandwidth, hardware, and configurations can handle expected growth in UC traffic.
• Incident Response Plan
  • Develop and maintain an incident response plan to address potential network and UC service disruptions. Ensure the plan includes procedures for rapid identification, containment, and resolution of issues.

Network Redundancy and Failover

• Redundant Links
  • Implement redundant network links to ensure high availability and minimize downtime. Use diverse paths for primary and backup connections to prevent single points of failure.
• Redundant Hardware
  • Deploy redundant hardware components such as switches, routers, and firewalls to enhance network resilience. Ensure that critical devices have failover capabilities to maintain continuity in case of hardware failure.
• Automatic Failover
  • Configure automatic failover mechanisms to detect link or hardware failures and switch to backup systems seamlessly. This helps maintain uninterrupted UC services during outages.
• Geographical Redundancy
  • For larger deployments, consider geographical redundancy by having duplicate data centers or cloud services in different locations. This can provide additional protection against regional outages and disasters.

Remote User Considerations

• VPN Access
  • Ensure remote users can securely access UC services via Virtual Private Networks (VPNs). Use strong encryption and authentication methods to protect traffic between remote users and the corporate network.
• Bandwidth Management
  • Monitor and manage bandwidth for remote users to ensure they receive sufficient resources for high-quality UC services. Implement QoS policies that prioritize UC traffic over less critical applications.
• Endpoint Configuration
  • Provide standardized configuration guidelines for remote endpoints to ensure compatibility and optimal performance. Regularly update and patch remote devices to maintain security and functionality.
• Support for Home Networks
  • Offer support and troubleshooting for common home network issues that remote users may encounter, such as Wi-Fi interference, router configurations, and ISP limitations.

Disaster Recovery Planning

• Backup Configurations
  • Maintain regular backups of all network device configurations, including switches, routers, and firewalls. Store these backups in secure, offsite locations for quick recovery in case of data loss.
• Recovery Procedures
  • Develop and document detailed recovery procedures for various disaster scenarios, including hardware failures, network outages, and data breaches. Ensure these procedures are tested and updated regularly.
• Communication Plan
  • Establish a communication plan to notify stakeholders and users during a disaster. Include contact information for key personnel, steps for initiating recovery processes, and methods for providing status updates.
• Regular Drills
  • Conduct regular disaster recovery drills to ensure all team members are familiar with recovery procedures and can respond quickly and effectively in a real disaster situation. Use the results of these drills to improve the disaster recovery plan.

Requirements

Considerations

QoS/Priority (8x8 DSCP / CoS Values Applied)

8x8 Outbound Datacenter Ports

Applications Requiring Outbound Connections

Applications Requiring Incoming Connections

8x8 Domains

8x8 IP Ranges