Voice over IP. VoIP is fast becoming a strategic business application. Compliments of

Transcription

1 Voice over IP VoIP is fast becoming a strategic business application Compliments of

2 Table of Contents Introduction... 3 VoIP goes mainstream VoIP trends VoIP rollouts are becoming mainstream... 4 Voice over IP IP softphones slowly gain speed... 8 Watch out for Wi-Fi phones...10 IP telephony deployments struggle with power/heat issues...11 Fixed-mobile convergence improves the economics of IP voice...13 Case studies Speaking the language of convergence...14 UC Berkeley upgrades voice...16 VoIP-based testing VoIP testing team ventures into new terrain...18 Session border controllers guide VoIP streams...20 VoIP security How to protect your VoIP network...26 Phishing leverages VoIP in new scam model...30 Secure SIP protects VoIP traffic...31 Researchers seek to save VoIP from security threats...32 Executive Guide

3 Introduction VoIP goes mainstream VoIP is moving past the pilot stage, busting out of the contact center and expanding beyond the branch office. It s becoming a mainstream enterprise application. Sales of IP PBXs surpassed TDM PBXs for the first time last year, and by 2009 IP PBXs are expected to account for 90% of the market. The question for IT execs today is not whether to move to VoIP, but how to do it efficiently, securely and cost effectively - and how to demonstrate ROI. This Executive Guide presents benchmarks for determining VoIP rollout costs and calculating ROI, advice from industry experts on VoIP security threats and countermeasures, plus cutting-edge user case studies, trends and testing. According to Nemertes Research, companies spent an average of 16 minutes per employee planning their VoIP rollouts in 2004, and that number skyrocketed to 64 minutes per user in Installation time and the amount of time spent troubleshooting VoIP rollouts doubled, according to the survey of more than 90 IT execs. The conclusion of Nemertes researchers is that today s VoIP rollouts are part of a strategic, enterprise-wide convergence effort that requires more planning across different departments. For example, Nemertes found that companies devoted an average of 12 people to convergence projects in 2004, but that number increased to 27 in When it comes to capital expenses, companies averaged $450,000 for their IP PBX equipment; $580,000 for IP handsets; $50,000 for voice mail or unified messaging; $182,000 for audioconferencing and $100,000 for management tools. But the largest expenditure was $1.4 million in network upgrades. On the payback side, a converged network can mean savings in staff costs - companies in the survey averaged $80,000 in personnel savings. Investments in IP videoconferencing have a payback period ranging from 12 to 38 months. And payback periods for audioconferencing are even more impressive - ranging from 1.4 to 5 months. Other cost savings can come from moves, adds and changes, and consolidating WAN links, reducing the need for cabling and increased productivity. Issues remain But deploying VoIP isn t easy. There are a variety of security, policy and management issues that need to be addressed. When it comes to VoIP security, there s a whole host of new threats. Hackers can attack VoIP endpoints with viruses and worms, conduct man-in-the-middle attacks to steal information or hijack a VoIP server, launch denial-of-service (DoS) attacks aimed at overwhelming VoIP gear, or disrupt VoIP conversations through jamming or broadcast storms. However, there are countermeasures you can take. VoIP is simply another type of IP traffic, so there are tried and true security tricks at your disposal. They include keeping patches up to date, requiring strong authentication, installing anti-dos tools and securely configuring VoIP applications. In addition, you can build an in-depth defense by segmenting your network so that VoIP servers sit on a different physical or virtual LAN from VoIP endpoints. Also, consider Session Initiation Protocol (SIP)-aware firewalls, application layer gateways, session border controllers (SBC) to manage VoIP traffic flows, and using IPSec or secure SIP to make sure that VoIP traffic is protected between endpoints. In a recent test of SBCs conduced by Miercom, a variety of products demonstrated that they can act as traffic cops, controlling VoIP traffic streams at the edge of the network. However, the testing also showed that setting up SBCs can be complex and costly. Interop ilabs tested whether multivendor VoIP interoperability is possible, and the results were encouraging. The testers determined that new QoS mechanisms introduced by the leading vendors do work effectively. On the other hand, there are some tricky aspects to a VoIP deployment, especially when you get into network access translation, which masks the identity of the endpoint, and voice over wireless. There are also issues that arise with a convergence project that you may have never even thought about. That s what happened when Butler University migrated from a hosted Centrex phone service to a Cisco CallManager VoIP system. Staffers from the voice, data and applications groups found that they didn t even speak the same language. For example, when somebody mentioned MACs, the voice people thought it meant moves, adds and changes, the data people thought it meant machine access control and the applications people thought it meant Apple laptops. Then there s something as simple as power and heating issues. Companies are finding that IP telephony equipment is causing serious heat issues in wiring closets and that Power over Ethernet switches are creating an issue in terms of backup power. Fortunately, there are solutions to all of these problems. This Executive Guide will provide guidance from the industry s top VoIP experts, cutting-edge research and product testing, and those who have gone through the rigors of a VoIP rollout. Executive Guide

4 Section 1 VoIP trends VoIP rollouts are becoming mainstream Voice over IP Nemertes study shows that as companies broaden their VoIP rollouts, setup costs increase - but so do savings. By Robin Gareiss, Network World When IT executives make the strategic decision to implement VoIP and other converged applications, cost savings is one of the key drivers. But is VoIP really a money saver? Based on a Nemertes Research survey of 90 IT executives, the answer is yes - over time. In other words, steep start-up costs will be offset in the long run by significant savings. One of the key findings in this year s study is that companies are spending more time and money on planning, installation and troubleshooting, compared with last year. The reason is that VoIP increasingly is being deployed as part of a strategic, enterprisewide convergence project, rather than as a pilot project or a technology deployed in a limited setting, such as a branch office or contact center. Another important finding of the study is that VoIP equipment generally costs about the same as TDM gear, with the exception of handsets. It pays to plan Since 2004, the amount of time spent planning a VoIP rollout has quadrupled. This is where participants spend most of their overall operational start-up time. They have learned from peers about the nightmares that result from a poorly planned deployment. Because VoIP is typically part of a larger convergence effort, organizations are spending more time upfront trying to identify steps in the project - and preparing the networks for them. Several early adopter IT executives who participated in the study said if they had spent more time planning, they would have had a smoother rollout and spent less time troubleshooting. Is your network ready? As part of planning, IT staffs should perform or hire someone to perform baseline network assessments, also known as network readiness tests. Companies typically spend $3,000 per location for small implementations (usually five or fewer sites) or an average of $63,500 for a comprehensive, multisite evaluation. Comprehensive evaluations range from $12,000 to $150,000. Management costs When measuring management cost per user by vendor, Nortel deployments are the most expensive to manage, primarily because many are hybrid, and customers still require staffs to maintain the TDM gear. Nortel costs $268 per user to operate in smaller rollouts, and $87 in larger rollouts. ShoreTel is the least expensive to operate, at $13 per user for smaller rollouts and $10 per user for larger rollouts. In reviewing total overall costs for maintaining a VoIP system, however, Cisco, at $256,750 per year, is the most expensive for Management costs When measuring management cost per user by vendor, Nortel deployments are the most expensive to manage, primarily because many are hybrid, and customers still require staffs to maintain the TDM gear. Nortel costs $268 per user to operate in smaller rollouts, and $87 in larger rollouts. ShoreTel is the least expensive to operate, at $13 per user for smaller rollouts and $10 per user for larger rollouts. In reviewing total overall costs for maintaining a VoIP system, however, Cisco, at $256,750 per year, is the most expensive for implementations with more than 1,000 units. and, at $124,266 per year, it s also the most costly for rollouts with fewer than 1,000 units. Those four vendors garnered enough statistical response to be broken out individually. Executive Guide

5 VoIP trends implementations with more than 1,000 units. and, at $124,266 per year, it s also the most costly for rollouts with fewer than 1,000 units. Those four vendors garnered enough statistical response to be broken out individually. As companies install VoIP in more branch offices and give handsets to more users (as opposed to simply IP-enabling a TDM PBX), the amount of time staffs spend installing the gear increases. Troubleshooting time also is increasing, but not at the same rate as planning and installation. Troubleshooting includes the time spent repairing problems after installation and until the system is considered full-production. Companies with higher-than-normal troubleshooting times typically devoted lower-than-normal time to planning. So it makes sense that as IT staffs spend more time upfront planning the rollout, troubleshooting time should grow more slowly. There are three primary reasons behind the increases in operational start-up time - and thus, cost. First, organizations are taking their VoIP projects more seriously because they are the first step of an overall convergence effort, and consequently need to devote more people from different disciplines (applications, security, voice, data) to the rollout. In 2004, companies devoted an average of 12 people to convergence projects, compared with 27 people by late Second, the salaries of IT staff working on convergence projects have increased. The average salary with benefits was $96,766 in 2004, compared with $98,621 in Third, companies are devoting more money to consulting costs related to design and implementation. The median consulting cost is $23,125, but the range is from $500 to $2 million, according to the survey. The goal is to take advantage of the experience of systems integrators and resellers, maintain flexibility with internal staffs, and improve the rate of project success. Management tools are key Management tools often are an unplanned expense, but they re key to the success of a VoIP project. Only about 15% of organizations actually budget for such tools upfront, but more than half seek specialty tools within 12 to 18 months of their rollouts. The amount organizations budgeting for or buying third-party management tools are willing to spend has increased in the past year. This is primarily because they recognize they need solid tools - and a new class of tools - to manage a converged network effectively. Based on that, the recommended management budget has increased slightly this year. (See Benchmarks for VoIP deployments. ) Training is another often-overlooked area. IT executives cited training as one of their key recommendations to peers based on lessons learned in their own projects. Value-added resellers and vendors often will include training as part of the deal. But several IT executives suggest that vendors invest more in consistent, nationwide training programs - even if they must charge for them. Part of the problem is finding training, says the CTO of a healthcare company. We don t have a $2,000-per-engineer budget, but we do provide training piecemeal. In fact, the amount organizations are spending on training has decreased since For example, small companies were spending about $2,500 per person on training in 2004, and they re now spending closer to $2,000. Nemertes recommends internal IT staffs train users on the new handsets and features whenever possible. The best approach is to schedule 20- to 30-minute sessions with small groups of users and teach them the basics. Rather than trying to force all users to use all features and applications at the same time, companies that have installed additional features (for example, unified messaging or real-time communications dashboards) should solicit tech-friendly trial users who will build consensus among their peers. Before long, users will be asking for the cool new feature that Bob in the next cube has been using. Cost savings The specific areas vary in which companies find cost savings, but companies almost always do find some. The most important thing to remember when creating a businesscase analysis is that each company s savings depends greatly on architecture, vendor or carrier selection, application rollout plans and staffing levels, among other factors. Generally, organizations save money (or increase top-line revenue) the most in a few areas: staffing, ongoing management and administration, IP audio- and videoconferencing, telecom circuits, cabling new buildings, and employee productivity. Staffing When they start using VoIP, organizations typically save on their staffing requirements, as well as the money they spend on outsourcers GIACOMO MARCHE SI Executive Guide

6 VoIP trends and consultants. However, a small percentage (5%) said they had to increase their staffs because of VoIP. In those cases, they added one to three employees, regardless of overall staff size. The average personnel savings has increased from 2004, when organizations reassigned or eliminated an average 0.74 positions, at $76,830 per year. This year the figure, when averaged among all organizations, is 0.76 positions, at $81,240 per year. Nearly one-third of the participants said they saved on staffing costs. When the numbers were run for only those organizations, the average staff savings jumped to 1.46 employees, or $192,584 in salaries and consulting costs. Participants said they typically reassign people rather than walk them to the door. In addition, some of the personnel savings comes from cost avoidance. If I had to go with TDM, I d have to hire more people, says the global telecom director of an entertainment company with a growing, 2,500- person VoIP rollout. I m working with 20% to 40% less with IP. Management and administration: Exactly what are these staff members doing, and how much time are they spending maintaining the voice network? First, they generally don t distinguish between maintenance and troubleshooting. It s all just managing the voice network. What that includes is making sure IP PBXs, handsets and softphones are up-to-date on the latest revisions; troubleshooting performance problems or outages; moves, adds and changes (MAC); and monitoring overall performance. Some - typically small and midsize - organizations are starting to outsource the day-today management of VoIP systems. We re considering eliminating a person and outsourcing the actual maintenance of the system, says the IT director of a large law firm. There s not enough to do to keep someone with those skills on-site. Savings on MACs are one of the most important ways organizations justify their VoIP rollouts. Overall, participants spend an average of $124 on MACs. This number includes MACs done internally and externally. The cost ranges from $29 to $450: At the low end are internal MACs done by an efficient, experienced and/or low-paid staff. At the high end - generally in large cities - are external MACs. The number of MACs increases with company size, not surprisingly, and ranges from 197 to 136,020. MAC penetration, however, isn t as dependent on company size (penetration is the percentage of MACs based on the total employee base). The big shift this year is that on average, organizations make 1.28 MACs for each employee. Realistically, at most organizations employees don t change offices more than once a year. What happens is more like a chain reaction. One person leaves the company, and three to five MACs result - one for the person leaving, one for the person who wants that office, one for the person who wants the next-vacated office, and one for the replacement. In moving to VoIP, MACs become very simple. The time involved for a TDM MAC is 30 to 90 minutes, but an IP MAC takes 10 minutes or less. The total cost savings, depending on the number of MACs at a given organization, can therefore be significant. Benchmarks for VoIP deployments There are four spending benchmarks: start-up costs, capital expenses, training and management. MEDIAN START-UP COSTS Fewer.than.100.users More.than.100.users AVERAGE CAPITAL EXPENDITURES VoIP implementations, all sizes IP.PBX IP.PBX,.messaging included IP.handsets Network.upgrades Voice.mail/UM Audioconferencing Deployment size Very.small Small Midsize Large Enterprise Management RECOMMENDED TRAINING Deployment size Very.small Small Midsize Large Enterprise RECOMMENDED MANAGEMENT BUDGET SOURCE:.NEMERTES RESEARCH Number of locations Fewer.than.5 6.to to to.1,000 1,001.or.more Number of locations Fewer.than.5 6.to to to.1,000 1,001.or.more $143.per.user $53.per.user $448,221 $562,024 $580,799 $1,398,527 $54,333 $182,463 $100,000 Users to train 0.to.1. (0.=.outsourced) 1.to.2 3.to.5 10.to or.more Cost per user $2,000 $2,000 $1,800 $1,500 $1,500 Budget Freeware,.IP.PBX.tools, carrier.tools. $25,000.to.$50,000 $75,000 $100,000 $100,000+.(depends.on the.configuration; requires.consultation) Executive Guide

7 VoIP trends IP conferencing: Another area of savings is video- and audioconferencing. The payback period is six to 12 months when organizations replace an ISDN-based audio- or videoconferencing system with an IP system. Typically, companies pay $200 to $300 per hour for ISDN-based videoconferencing services (and as much as $2,000 for global calls), and 6 cents to 12 cents per minute for audioconferencing services. Several organizations say they re using IP video- and audioconferencing for internal communications, which can be 10% to 75% of their audioconferencing calls and 30% to 60% of their videoconferencing calls, depending on the industry. They use service providers for external calls; typically these are ISDNbased services, but they ll use more IP-based services as the carriers migrate to IP. By shifting from ISDN to IP videoconferencing, organizations can see a payback in 12 to 38 months, based on the averages from the Nemertes study. Payback periods are even more compelling for audioconferencing: 1.4 to 5 months, based on averages from the study (see Benchmarking VoIP savings ). Telecom circuits By integrating access lines and consolidating unused capacity on WAN links, organizations report they re saving as much as 50% on their network service costs. Cabling For new offices, cabling costs drop by 40% to 50%, because there s no need to run three to four drops per desktop. Instead, companies can run one or two drops per desktop, eliminating the cost of the cable and, more significantly, the labor to do the job. Employee productivity Though difficult to measure, organizations are seeing improved productivity when they roll out VoIP and associated collaborative applications. These savings are mostly anecdotal, however. For example, hospitals save on nurses salaries by deploying wireless VoIP phones. They trim 15 to 30 minutes off each eighthour shift of a nurse, nurse technician or unit clerk in a hospital setting. That translates to 234 to 548 hours per year, per shift, per employee that can be devoted to other tasks. With an average loaded hourly salary of $28, hospitals save $6,552 to $13,104 per nurse, nurse technician or unit clerk per year. Gareiss is executive vice president and senior founding partner and CFO for Nemertes Research. She can be reached at robin@nemertes.com. Executive Guide

8 VoIP trends IP softphones slowly gain speed PC-based VoIP gains a foothold in call centers and with mobile workers By Phil Hochmuch, Network World Corporate users are talking on IP softphone clients everywhere - or nowhere, depending on whom you talk to. While use of PC-based VoIP software is taking off in homes and college dorms, the use of softphones in companies remains somewhat mixed. They are having some success among road warriors and telecommuters, as well as telephone-centric workers such as call-center agents. Telephony software on PCs has been around since the 1990s, but the emergence of Skype and the wider adoption of broadband have made the technology more accessible and familiar than ever. Many companies also now support pockets of softphone users or even large divisions of traveling employees with the technology. The IP softclient is a big thing for us, says Steve Lydston, network manager for Nissan North America, whose company is in the process of installing Siemens softphone clients on more than 1,000 laptops for its executives and mobile users. He says deploying softphones on the laptops of executives traveling abroad provides measurable cost savings. [Users] could be ringing up hundreddollar cell phone bills by making cell phone calls overseas, Lydston says. If you re already paying $10 to the hotel for broadband, the calls are free over the softclient. Plus, the quality is about as good as a cell phone s, and a lot of times, it s better. Nissan North America also is gaining productivity and cost savings with softphones without having to go through an entire corporatewide VoIP upgrade, which could add cost and complexity, Lydston says. Softphone clients on laptops are configured to connect into one of several large PBXs. The clients tunnel into the corporate LAN with VPN links and access IP cards installed on the PBXs. Overall, Lydston admits, the financial payback of softphones won t blow away the company s accountants. It s more like found money, he says of the savings, which could run into the tens of thousands of dollars per month. That s a drop in the bucket for a billion-dollar company like ours. What keeps softphones from becoming a killer app in other companies seems to be like the proverbial death from a thousand paper cuts. Some of the many issues include complicated PC sound configurations, end users dislike of headset devices, unfamiliarity with softphone interfaces and the awkwardness of talking to someone over a PC instead of a handset. Quite frankly [softphones] are more of a novelty than a real value-added type of application for us, says Phil Go, CIO for Barton Marlow, a Chicago construction firm. VoIP is a mature technology at Barton Marlow, which installed a Cisco CallManager IP PBX and more than 200 IP phones four years ago. Go can rattle off dozens of benefits that IP telephony has made for his company, but softphones are not high on the list. There is no such thing as making a quick call with a Cisco softphone client, he says. A user s laptop must first boot up, and then the correct PC audio settings must be configured. The VPN client must log into the network to connect with the Cisco CallManager. Carrying around a headset is another negative. End users sometimes have a hard time with all this stuff, Go says. Plus, cell phones are so cheap these days, and it s so much easier and faster to pick up your phone wherever you are and make a call. Perhaps the brand most known for bringing softphone technology to the mainstream is Skype. The little European start-up, purchased by ebay last year for $2 billion, has an installed base of 9 million users. Recently, the company launched a small-business VoIP service for organizations with fewer than 10 users. Skype is used widely at Dickinson College in Carlisle, Pa., where IT staff has found interesting ways to use the technology. The college s IT department made Skype part of its standard PC and laptop software image distributed to computers for staff, faculty and students. We have a lot of offices abroad, with people doing research who can use Skype even if they don t have phone service, says Todd Bryant, language program administrator for the college s academic technology division. The IT staff likes it because they can send quick messages [via instant message] and share files as well. Skype is a natural fit for the college s languages department, where Skype conversations are set up between Dickinson students studying French, German, Italian, Russian or Spanish and native speakers from those countries who are at a similar level in studying English. Language students can make a [Skype connection] from our PC lab and get Executive Guide

9 VoIP trends bandwidth priority, Bryant says. And if students want to record the conversations for credit, we have software for that, too. What makes Skype so useful is its simplicity. We started to try to do this before Skype came around, Bryant says. But it s so far ahead of other applications, especially in getting through unpredictable firewall or [network address translation] configurations. If you re calling up a random class somewhere that might not have good IT support, that s where Skype has a big advantage. Softphone options Almost all PBX and IP PBX vendors offer softphone clients for their phone systems. (These include 3Com, Alcatel, Avaya, Cisco, Mitel, Nortel, Siemens, ShoreTel, Inter-Tel, Sphere, Toshiba and Zultys Technologies, among others.) Depending on what type of phone system is (or isn t) already installed, users have several options. Traditional PBXs Users of traditional PBXs can connect workers with softphone by: VoIP traffic through. No PBX (client-based only) Installing an IP card - such as an NIC for the PBX, supplied by the vendor - which gives the phone switch an IP address on a LAN. Installing softphone clients (proprietary to the vendor) on laptops and PCs. (Remote users will require a VPN infrastructure to access the PBXs IP internal address.) Reconfiguring firewall settings, if necessary, to let all VoIP traffic through. In April, the Federal Trade Commission brought suit against four Detroit men who used open relays to disguise their identities and sent spam promoting bogus diet aids. IP PBXs No special hardware is required on IP PBXs. VPN software and hardware are required to access the phone system remotely. Firewall settings may have to be reconfigured to let all Download clients such as Skype, Vonage, SIPhone, Net2Phone, FreeWorldDialup, SipXphone and many others. Most clients support PC-to-PC calls for free with compatible SIP-based clients (except Skype, which is proprietary). Clients can be used internally or externally, since a peerto-peer or an external VoIP infrastructure is used to control calls. Calling real public phone numbers could require gateway hardware or cost extra as a monthly service or minutes plan. Firewall settings may have to be reconfigured for all VoIP traffic to get through. Windows and open source options Windows Communicator clients can act as softphones, running off a Live Communication Server on the back end. Asterisk, a free, downloadable open source IP PBX, has a softphone client and interoperates with standard Session Initiation Protocol-based softphones. Executive Guide

10 VoIP trends Watch out for Wi-Fi phones Dual-mode phones could be an IT management nightmare By Keith Shaw, Network World Do you remember all of those employees who brought home wireless LAN (WLAN) equipment and then started bringing their cards and access points into the workplace? If you thought that was a mess, get ready for Wave 2 - the Wi-Fi cell phone. At the recent CTIA Wireless 2006 show in Las Vegas, Nokia and Samsung Mobile displayed mobile phones that included a Wi-Fi radio in addition to the normal wide-area wireless radio. These vendors weren t the first to do this, but these models were the first ones geared to a consumer audience. The earlier devices were geared to enterprise customers who want to use Wi-Fi in an IT-controlled environment, such as a college campus or warehouse, as well as integrate with existing VoIP or PBX infrastructures. The Nokia 6136 and Samsung T709 are geared to the Best Buy/Circuit City/mall kiosk crowd. For example, the Samsung T709 lets calls channel from a Wi-Fi access point, through the Internet and onto a cellular network to give users uninterrupted connections when traveling between home and office or while on the road. A phone that uses Wi-Fi and a cellular connection could mean trouble for network managers. Imagine this help desk query from the vice president of sales. Yeah, I was making a cell phone call with my spankin new cell phone, and I walked into a stairwell and the call dropped - I just lost the $100 million deal I was working on. The vice president might not have realized that the call he was making connected via the internal Wi-Fi network instead of the regular cell network - all he knows is that the call dropped, and he may blame you. Just like they started asking for WLANs in the workplace, users will start asking for better WLAN coverage for voice applications. I The Nokia 6136 (left) and Samsung T709 are some of the first consumer-aimed cell-phones with WI-FI capabilities. You ve been warned. discussed this issue with the head of the Wi-Fi Alliance at the CTIA show, and he admitted that most enterprise WLANs were designed for wireless data, not wireless voice. He suggested that the best way for a company to find out where its wireless coverage holes are is to add Wi-Fi-enabled phones to the network and have people walk around the office and wait for the calls to drop. Last year when Network World tested the ability for WLAN systems (enterprise switches and access points) to handle wireless VoIP traffic, the results were dismal. We hope that when we test these systems again later this year the numbers will improve. At any rate, the clock is ticking for you to start improving your WLAN network before other vendors come out with their Wi-Fi cell phones and you re inundated with employees pounding your WLAN with voice traffic. Executive Guide 10

11 VoIP trends IP telephony deployments struggle with power/heat issues Power-over-Ethernet switches, servers replacing key phone systems make data center hotter. By Phil Hochmuth, Network World While the IP telephony market heats up, thermometers are literally spiking in some wiring closets and computer rooms where VoIP and power-over-ethernet (PoE) gear is being installed, users say. Equipment density and overheating are constant issues for data center managers; beating the heat is also becoming a topmind concern for network and telecom staff deploying gear in wiring closets, as PoE and VoIP equipment are set up in places that once just housed lower-power switches, cooler hubs and patch panel racks. Power in general has been our Achilles heel in our [IP telephony] deployment, says John Haltom, network director at Erlanger Health Systems, a southeast regional HMO in Chattanooga, Tenn. Achilles heel might overstate it, as Erlanger has deployed over 1,500 IP phones in production, both wired and wireless, running off of a Nortel Communication Server 1000 IP PBX. To support IP telephony, Haltom and his staff installed PoE switches in wiring closets to light up the phones, and uninterruptible power supply (UPS) equipment to allow switches to run during a power outage. These redundancy and power requirements challenged the healthcare organization s IT staff, which supports one 112-year-old hospital. Trying to retrofit areas that are already cramped with larger PoE switches, larger UPSes, was the challenge, Haltom says. By the way, all that gear generates more BTUs, so you have to upgrade the AC units in those closets. By most measures, the biggest heat-boosters in wiring closets are the PoE switches, which VoIP environmental fundamentals When putting an IP PBX or Power over Ethernet (PoE) LAN switch in a wiring closet to support IP phones on desktops, consider power and cooling requirements for the equipment, experts say. A sampling of environmentval/power specifications of some IP PBX/PoE LAN gear: IP PBX gear Vendor 3Com Avaya Cisco Nortel Product NBX 100 S8700 Media Server MCS 7825 CS 1000 Service provider Vendor 3Com Cisco Extreme Nortel Product SuperStack 3 Switch 4400 Catalyst 3750 G-24PS Summit p Switch T-PWR Heat (BTU s per hour) 923 1, ,024 Heat (BTU s per hour) Operating temperature 32 to to to to 95 Operating temperature 32 to to to to 104 Executive Guide 11

12 VoIP trends do double duty in transporting Ethernet traffic, and acting as AC power supplies for all IP phones and other PoE-capable gear plugged into the devices powered ports. For example, Cisco s non-poe 24-port Catalyst 3750 LAN switch generates around 176 BTUs of heat per hour; add the PoE option, and the switch heats up to 534 BTUs. Add in a standard UPS that dissipates BTUs, and you ve more than tripled the heat output in just one wiring closet in order to support IP telephony. Similarly, Nortel s 24-port Switch 420-T heats up to 220 BTU; its PoE-capable Switch T- PWR is more than double that. Planning for how this gear will be cooled off and kept safe should not be an afterthought, experts say. All network devices should be placed in locations with adequate heat dissipation, ventilation, and air conditioning, according to Salvatore Collora and Ed Leonhardt, two Cisco Certified Internetwork Experts, writing in Planning the Cisco CallManager Implementation, published in 2004 by Cisco Press. Although it is surprising, some deployments actually store servers and switches in broom closets and under desks. Improper care of your equipment contributes to environmental and security hazards that can disable or degrade your voice deployment. This could especially be true in small businesses, where an older key telephone system is being replaced. These devices combined call processor, phone power supply and switching and could be stored almost anywhere. However, companies should have a cool, dry place ready for newer IP PBX gear. In certain climates, you could have very high humidity, with the ambient temperature getting above [104 degrees Fahrenheit], says Patrick Ferriter, vice president of marketing for Zultys, a maker of IP PBXs that targets the small-offices as a key system replacement. There are places where it does get hot, and you re going to have problems if you don t have air conditioning. How much cooling will depend on the IP PBX itself, he adds. If you have an IP PBX which has built-in gateways, and if you have a lot of analog connections - FXS boards which provide ring voltage - it could start to get even hotter, Ferriter says. It s going to be hotter than a traditional key system for sure. Executive Guide 12

13 App-centric network management Fixed-mobile convergence improves the economics of IP voice By Thomas Nolle, Network World VoIP convergence used to mean a bunch of softswitches, media gateways, replacing Class 5 switches and - not accidentally - spending telecom dollars that used to be spent on traditional TDM on VoIP voice instead. Not much of that ever happened. Today, carrier planners at all levels are focusing on a new kind of convergence - fixed-mobile convergence (FMC). This time may be the charm. The idea behind FMC is to create a supervoice service that lets customers mingle calls between fixed-line and mobile handsets. A customer could set up rules that govern the conditions under which a call placed to one or the other line is completed. The easiest example is a rule that says, If my mobile phone is off, ring the call on my fixed line instead of going to voice mail. This could be expanded to include a test for specific numbers, letting non-critical calls go to voice mail. It would also be possible to do the opposite: Ring fixed-line calls through automatically to the mobile number if the mobile phone is on. There is clearly a customer value for all of this, but the value proposition for service providers goes beyond making customers happy. Where the value is found varies depending upon what kind of voice carrier is looking at FMC. An incumbent local exchange carrier (LEC) could see FMC as a way to futureproof wireline voice services against broadbandbased VoIP offerings. Most incumbent LECs (ILEC) also have wireless subsidiaries, and a VoIP offering based on FMC ties the popular mobile service to the increasingly pricepressured wireline voice. Because modern 3G services are based on Session Initiation Protocol calling, just like most VoIP services (except Skype), FMC would allow for VoIPto-mobile calls without going through a relatively expensive public switched telephone network gateway. This improves the economics of IP voice. For the cable companies, an ILEC drive to FMC creates competitive pressure to follow suit, and they have been signing mobile virtual network operator (MVNO) deals with wireless carriers to create their own FMC services. But cable companies have another reason to like FMC, and that relates to the dual-mode Wi-Fi/mobile handset. A dual-mode handset is capable of using Wi-Fi in the home (or, in theory, in other hot spots) and standard cellular mobile frequencies when on the road. With the right carrier equipment behind it, such a handset can let a user roam between Wi-Fi and cellular while keeping a call connected. When the user is at home (or at work, for a business version of the service), the calls can be rung through the VoIP and Wi-Fi connection, so there would be no airtime charge. By offering phone connections over home Wi-Fi, a dual-mode handset eliminates the need to connect the old phone wiring to a VoIP service. This reduces installation costs and potentially increases VoIP penetration. The cable companies might find this a critical edge in getting their VoIP services rolling quickly. For the overlay VoIP players, such as Vonage, it might be that dual-mode handsets, FMC and an MVNO relationship with a cellular carrier would be the difference between profit and being marginalized. By adding features to their FMC offerings, Vonage and other VoIP players might raise their margins and attract more customers. Basic Internet calling clearly is going to be virtually free, so if you want to make money you have to look beyond it. FMC certainly is an option. For users, FMC is likely to bring about major changes in calling. In the future, you might not have a mobile number and home number, just a personal number and set of rules that determine which calls placed to that number are connected on each of the voice services you have. For outside sales and support personnel, it could mean more freedom and flexibility; for home users, a single phone that works everywhere. This won t be an overnight process, but the pressures of the competitive market are clearly driving us in this direction. Planning now for FMC seems a prudent step for carriers and users alike. H A L M A Y F O R T H Executive Guide 13

14 Section 2 Case studies Speaking the language of convergence Butler University learned to keep an ear out for confusion over the terms and concepts used when groups collaborated on a VoIP deployment. By Phil Hochmuth, Network World When Butler University recently migrated from an on-campus hosted Centrex phone service to a Cisco CallManager VoIP system, one of the first challenges it encountered was to get more than a dozen staffers from the voice, data and application groups speaking the same language. The Indianapolis-based institution wanted to integrate its voice and data networks physically, meld several back-end applications - such as its PeopleSoft ERP system - and update its interactive voice-response system for self-service information-gathering. The deployment took two years, from planning to completion in late 2005, and required a lengthy RFP process, an independent consultant to provide outside perspective and advice, and the gradual merging of four separate staffs: data and networking, telecom, facilities management and applications, says Scott Kincaid, CIO for Butler University. The integration of the staffs was smooth, Kincaid says. But after a few meetings with everyone in the same room, Kincaid realized how high the barrier of technical language and jargon was going to be. Say what? First, we started talking about MACs, Kincaid says. I thought it was a PC-vs.- Macintosh debate; the voice people are talking about moves, adds and changes; and, of course, for the data people, this was about the Machine Access Control addresses on the IP phones and PCs on the network. In addition to overlapping acronyms, concepts that are second nature to one group may mean something different to another. An instance of this was the idea of an extension. In the middle of our project, we kept using the word extension, and we found it was a meaningless term, Kincaid says. To telecom staff, an extension was a logical endpoint that could ring in possibly multiple places. Data staff thought of an extension as a physical phone, not a programmable port or portable number that moved around. Then you had the PeopleSoft/ERP team members, who thought we were talking about data fields in a software product, he says. Another concept that needed to be defined clearly as the project got underway was the word directory, Kincaid says. To the data group this is all about Active Directory and LDAP, he says. For the voice technicians, directories were lists of phone extensions. To the programmers, these were the file structure and hierarchy of the servers and systems on which the ERP software and applications were running. The trickiest part about all of this, Kincaid adds, was that eventually all these concepts would have to come together: Cisco CallManager runs Active Directory, which includes phone extensions and dial-plan data, and is stored on Microsoft Windows 2003 servers in a directory hierarchy. Besides separate definitions of terms, Kincaid says he found the groups differed in their approaches to and philosophies about maintaining and managing a network, because of habits and tendencies built up over the years related to the technical cultures of each group. Most voice people I work with seem to come from a mainframe background, and they have that kind of mentality. There s a centralized mind-set to it; there aren t that many of them, first of all, Kincaid says. They like documentation. And there are only so many things you can do on a PBX. They re used to a very stable environment. Above all, he adds, They tend to have this belief that end users have a God-given right to [a] dial tone, and you have to respect that. As he worked with data people, he found their approach was more distributed and decentralized. The data people were comfortable and used to pulling different pieces together. But they re not used to having someone come into their network without them being in the loop. Using an outside consultant was key in helping the converged IT staff at Butler understand their communication differences and various philosophical approaches. It was important for us to have an independent consultant, not to make the decisions or to lead the project, but to guide us and help keep a level base line, Kincaid says. In meetings, the presence of an outside voice helped encourage the members of Executive Guide 14

15 Case studies each IT faction to clearly describe what they were talking about in the larger context of the project. Above all, a group of users - university staff and faculty - had the biggest jargon-cutting role in the combined IT organization. They were not afraid to raise their hand in meetings and question what the IT staff were talking about, Kincaid says. We got into all of these discussions about QoS and data packets and security; none of that mattered to the user. What mattered to the user was the phone conversation. The call center being there. Having availability to information. Having them involved was probably the most important step we took. Executive Guide 15

16 Case studies UC Berkeley upgrades voice By Ann Bednarz, Network World University of California, Berkeley, eked all it could from its legacy voice mail system - and then some. Even after Unisys dropped support in 2001 for the university s Digital Sound voice mail system, it located a third-party vendor willing to keep the system alive with components found on ebay and salvaged from other retired systems. They weren t making any new parts or upgrading the operating system. It was a very closed system, says Terri Kouba, a systems developer in UC Berkeley s communications and network services department. But it was maintained. The university knew the fix was temporary and started looking for a replacement to provide basic voice mail functionality and unified messaging. None of the available unified messaging products won them over. The industry really wasn t ready for a system of our scale at that point, Kouba says. UC Berkeley gave it another shot in 2004 and found the vendors were better equipped to handle a rollout to tens of thousands of users. After a lengthy review process, the university chose Interactive Intelligence and licensed its Communité unified communications software last year. Communité supports a unified in-box so users can browse and open , voice mail and fax messages from a single interface. The system also lets users retrieve voice, fax and messages from multiple devices, Executive Guide 16

17 Case studies including desktop PCs, wireless handhelds or cell phones. Unified messaging helps break down some of the walls between voice mail and and connects the message streams, Kouba says. In the past, people tended to reply to voice mails with another voice call and to s with another message. Now, if someone sends me an and I m listening to my over the telephone, I can reply to that with a voice mail attachment, Kouba says. The sender gets back the original message with a small.wav attachment. No matter how you send me information, I can reply or communicate in the way that I want to. Call-screening features tell users who s calling before a call is accepted, and followme/find-me technology lets users set precise call-handling rules - specifying, for example, which callers to send to voice mail and which to forward to certain alternative numbers. Users also can opt to be alerted by Short Message Service if parties leave a voice mail message. Into production UC Berkeley started its implementation last October with a pilot group. To drum up interest in the new technology, the IT group asked for volunteers from different campus departments. Getting volunteers excited about the new system - and talking it up to their coworkers - was one of the smartest things the university did, Kouba says. The pilot allowed Kouba s group to test the application under real-world conditions. One of the things that we can t do very well on the telephony side in a development or test environment is test-load, Kouba says. It s hard to generate real-looking calls. So that s one of the things that we focused on during the earlyadopter period. Kouba also used the pilot to tune the integration points between the Interactive Intelligence software and the university s existing systems. UC Berkeley didn t upgrade its telephony systems for the rollout, but it did do some heavy integration: The Communité software is tied to the university s Centrex service, Nortel PBX gear, CommuniGate Systems , iplanet Lightweight Directory Access Protocol directory, Kerberos security system and campus storage-area network. After the pilot, in January the team moved the remainder of the university s 10,000 faculty and administrative staff from the old voice mail system to the Communité platform. Because not every user needs all the available features, the communications group offers different classes of service, starting with basic voice mail and traditional telephoneonly message access. Enhanced voice mail services let users access messages via the Web, and unified messaging services add the option to retrieve messages via . Addons include call screening, call routing, and incoming and outgoing faxing options. The communications group makes these services available to university departments on a chargeback basis, so department managers can stretch their budgets by choosing services for staff judiciously. This fall, UC Berkeley plans to offer the new services to residence hall students, which could increase its implementation to 50,000 users. In the past, as many as three students in a dorm room had to share a single phone line. With Communité, every student can get a personal phone number, and each can opt to route calls to the dorm-room phone, a cell phone or any other phone. Somebody can always call that one campus phone number and ultimately reach the student, Kouba says. Attracting student users is important. Providing dorm-room telephone service is a moneymaker for UC Berkeley, which, like many universities, has seen its revenue drop as students increasingly favored cell phones over dorm lines. By offering unified messaging options such as advanced call-forwarding features and Web-based message retrieval, the university hopes to regain some of those customers. Executive Guide 17

18 VoIP-based testing VoIP testing team ventures into new terrain ILabs testing team finds that VoIP QoS works well, but NAT, security remain tricky By David Newman, Network World By now, basic interoperability is generally a given in multivendor VoIP settings. What happens, however, when VoIP devices go to work in decidedly unfriendly environments, such as through security devices and across wireless LANs? Results of the testing completed by the InteropLabs VoIP team suggest new QoS mechanisms can work effectively, but security remains as tricky as ever to get right. Even though it s not a security mechanism, network address translation (NAT) also proved especially troublesome. The team built a complex test bed connecting the VoIP phones of five enterprises across a vast armory of firewalls, IPSec and SSL VPN concentrators, and intrusion-detection systems. The security-gear suppliers included Aventail, BorderWare, Check Point, Cisco, Juniper and Nokia. Some vendors shipped multiple security devices: For example, Juniper supplied a firewall, an intrusionprevention system (IPS), two IPSec VPN concentrators - and three engineers to get everything working. In addition to security boxes at the edge of each enterprise s network, the security apparatus included IPSec and SSL VPN clients for remote users. Corporate network managers planning VoIP rollouts will probably deploy similar setups, configuring IP phones and security devices and drop-shipping them to remote users. All this equipment ensured tight security - in some cases, a little too tight. For example, BorderWare s SIPAssure offered detailed control over Session Initiation Protocol (SIP) but didn t provide the access controls needed in a general-purpose firewall. The team redesigned the network by placing this device alongside another firewalls. The BorderWare box became a VoIP session border controller alongside another BorderWare firewall. The test bed also comprised numerous wireless LAN (WLAN) switches, access points and end-stations, all using the new e standards for QoS enforcement. Phones in this year s event were equally diverse, ranging from softphones on PC and Mac clients to old analog handsets with SIP adapters and Wi-Fi and Ethernet SIP handsets. Unlike past years, where the focus was on interoperability among multiple vendors SIP proxies, the InteropLabs team this year standardized on the open source Asterisk SIP proxy for four of the enterprises. At the fifth were two proxies: an Asterisk box and the SpectraLink SIP proxy, which SpectraLink s new SIP-enabled handsets require. In general, however, the focus wasn t on the SIP proxy used but on the diversity of the equipment around it. In all, around 20 vendors contributed equipment and engineering resources to the effort, making this among the largest VoIP test beds yet constructed by the InteropLabs team. To NAT or not to NAT One of the most difficult decisions in this testing demonstration was whether to use NAT. Network architect and team leader Jim Martin - his day job is distinguished architect at Netzwert - initially opposed its use on the grounds that NAT breaks the end-to-end principle of Internet communications and might also introduce interoperability issues. As it turned out, he was right on both counts. Other team members argued that regardless of whether NAT is good or evil, it s in widespread use today and should be included in at least part of the test bed. The pro-nat argument prevailed. Team engineers configured one of the five enterprises to use private net-10 addresses and enabled NAT on a Check Point firewall linking this enterprise to the rest of the test bed. Enabling NAT proved to be troublesome from the start. Initially, neither inbound nor outbound calls reached their destinations. It took two hours of capturing traffic from various points and then an hourlong discussion in front of a whiteboard to lay out the various issues. In situations where one side used NAT but the other didn t, the SIP proxy received traffic but didn t return it. That s because SIP proxies get source IP addresses from the SIP header by default, not from the IP header. In this case, NAT translated the source IP address in the IP header, but not in the SIP header. Because the SIP proxy had no route to the source address using NAT, there was no way for the proxy to return traffic (see diagram). The team set a nat=yes parameter on the Asterisk SIP proxy, forcing it to read addresses Executive Guide 18

19 VoIP-based testing from IP rather than SIP headers. This solved the first problem of the SIP proxy not being able to send return traffic. It did not help with the second problem: the Check Point firewall not sending return traffic through an IPsec tunnel (this isn t a knock on Check Point s firewall; virtually any NAT box would do the same thing). This second problem proved more intractable than the first. Even though the SIP proxy now processed traffic correctly, the firewall at the enterprise site forwarded VoIP traffic onto the public network instead of placing it inside an IPsec tunnel for routing back to the remote-side caller. Engineers from Check Point and the InteropLabs team worked to resolve the problem but couldn t get VoIP working with NAT during the HotStage event. Check Point s engineers believe the problem is caused by the configuration s parameters. Cutting the cord The WLAN setup comprised a mix of access points and WLAN switches from such vendors as Aruba Wireless Networks, Cisco (in IOS and Linksys versions), Extreme Networks and Symbol. In addition, Check Point and Juniper supplied remote-office devices that combine firewall and VPN concentrator functions with access points. Hanging off these devices were softphones and wireless handsets from Cisco, CounterPath Solutions, SpectraLink, Unex and UTStarcom. A key goal of the testing was enabling the Wi-Fi Alliance s Wi-Fi Multimedia Extensions (WMM) to ensure better treatment for voice traffic. Based on the IEEE s e standard, WMM introduces a new twist to QoS enforcement. Instead of simply queuing VoIP packets ahead of others on any given station, it seeks to transmit VoIP packets first from any station, helping to keep delay and jitter to a minimum. Determining which devices supported WMM wasn t always intuitive. For example, a consumer-grade Linksys access point offered WMM support out of the box, but new SIP-enabled handsets did not create packets with WMM s QoS headers. The SpectraLink problem could be caused by the handset or SIP proxy configuration, and at press time team engineers were continuing to examine it. Another problem in prioritizing VoIP traffic has to do with lining up multiple QoS mechanisms. IP-forwarding devices, such as routers, generally use Layer 3 criteria such as DiffServ code points (DSCP) or IP precedence flags to classify traffic. In contrast, Layer 2 devices, such as wireless switches, use WMM access classes found in the header. Most sites will generally use only one WMM access class for VoIP traffic, but there may well be multiple DSCPs in use. As the team learned, it s critical that devices with both IP and WLAN capabilities (such as WLAN switches) map all the relevant DSCPs to the appropriate WMM access class. Yet another issue for WLAN forwarding had to do with virtual LAN (VLAN) tagging. Network designs often use separate VLANs for VoIP traffic, and the InteropLabs VoIP network was no exception. This generally worked fine, with two exceptions: First, a relatively old Symbol switch supported only VLAN IDs between 1 and 31 - too narrow a range to accommodate the VLAN IDs between 100 and 300 in use on the show network. To its credit, Symbol promptly supplied its newer WS5100 switch, which supports any VLAN ID. Second, the SpectraLink SIP proxy required that handsets reside in the same VLAN and IP subnet as the proxy. The workaround: On each access point, the team allocated two VLANs (each with a unique service set identifier), one for the local subnet and one for the SpectraLink proxy s subnet. The enterprise-grade WLAN devices all handled this workaround, but some consumer-grade access points (such as a Linksys WRT54GX) don t support VLANs at all. Despite the various hurdles encountered, team engineers generally were able to call from any location to any other location (including offsite) by the end of the HotStage testing period. Team engineers and vendors continue to work to resolve the few outstanding issues, and most agreed that VoIP is getting easier to deploy, even in environments that aren t necessarily VoIP-friendly. Executive Guide 19

20 VoIP-based testing Session border controllers guide VoIP streams SBCs are traffic cops that control VoIP traffic at the network edge By Edwin Mier, Anthony Mosco, Robert Tarpley and Robert Smithers, Network World Is there a session border controller in your enterprise s VoIP future? If you re looking to expand your organization s VoIP reach - to VoIP-based service providers, to other enterprises or even to VoIP-interconnected distributed sites via the Internet - there very well may be. Functionally, an SBC is a traffic cop: It facilitates and mediates VoIP flows in real time, in both directions between private VoIP domains: an enterprise and a VoIP-based service provider - the environment we tested here - or two service providers. SBCs came of age by providing peering connectivity between different carriers VoIP services and only recently have begun penetrating enterprises. There is no universal job description for an SBC. Certainly there has to be versatile handling of VoIP call-control protocols, such as Session Initiation Protocol (SIP) and H.323, especially amid different firewall and network address translation (NAT) configurations. And there needs to be some security safeguards - hiding the network topology of the private network, for example. But overall, SBCs are complex and costly components, coming from diverse backgrounds and offering widely varying capabilities. We invited more than a dozen vendors who were touting new SBC wares earlier this year to submit their packages for testing in Miercom s New Jersey lab. Four accepted our challenge for this feature-based testing: Ditech Communications, Ingate Systems, Mera Systems and NexTone Communications. Despite many differences in the feature sets of these products (see What SBCs do ), their general orientations lie in a few similar, basic areas, including VoIP call handling, QoS handling and security capabilities. Based on our assessment in these areas, our Clear Choice Test Award goes to NexTone s package, CLEAR CHOICE TEST the Multiprotocol Session Controller (MSC) coupled with its iview Management System (ivms). NexTone s dynamic VoIP session control, real-time monitoring with active error and threshold-limit notification, calllevel reporting system, and integrated firewall features make it the best of the enterprisefocused SBCs we tested. We note, though, that the NexTone package costs considerably more than the competition (more than $100,000, compared with $25,000 to $38,000 for the others). NexTone Communications One strength of NexTone s Linux-based MSC was its exceptional management and reporting, augmented by the powerful routing engine of the optional ivms. NexTone could be set up to adapt dynamically and to alter operational behavior involving admission control, routing priorities and bandwidth allocation, based on fluctuating network conditions and changed user or application behavior. For example, we observed how the system can be set up to divert traffic from low-cost VoIP carrier A to carrier B, if the quality measurements of calls via carrier A drop below established thresholds. Also, the parameters that users can apply for routing decisions by NexTone s MSC are broader and include, for example, user profile, time of day and desired QoS - the example cited earlier. The ivms allows routing and rerouting of calls among carrier services and trunks, and serves up extensive VoIP-quality reporting, including statistics on average call duration and postdial delay. We exercised the routing capabilities of this product by setting up multiple trunk groups and changing conditions to cause rerouting. One way was to unplug a gateway and see whether calls would reroute if there was a viable alternate path. In another case we intentionally oversubscribed the amount of bandwidth allocated in Call Admission Control, to ensure the overflow calls would be blocked. In both cases, the NexTone product worked as advertised. Another capability of NexTone s SBC is that it offers seamless connectivity between SIP phones and applications and H.323-based IP PBXs. This feature lets users connect their existing legacy VoIP environments, which are mostly H.323-based, to VoIP-based A word about performance In this inaugural test of session border controllers (SBC), it was not our intent to get into the minutiae of product performance, because SBCs have disparate feature sets and deployment options. That said, we can make some general assessments about SBCs based on the results of our sending modest levels of Session Initiation Protocol call traffic through them. SBCs effects on call quality varied from essentially no degradation (mean opinion score [MOS] of 4.5, R-factor of 93) to measurable degradation (MOS of 3.9, R-factor of 85). SBCs also could add to call-setup time and latency; the extent appears to vary based on the power of the SBC hardware platform. Executive Guide 20