Beyond Quality of Service (QoS) Preparing Your Network for a Faster Voice over IP (VoIP)/ IP Telephony (IPT) Rollout with Lower Operating Costs

Transcription

1 Beyond Quality of Service (QoS) Preparing Your Network for a Faster Voice over IP (VoIP)/ IP Telephony (IPT) Rollout with Lower Operating Costs

2 Beyond Quality of Service (QoS) Cost Savings Unrealized THE NETWORK PROBLEM ENTERPRISES FACE WHEN DEPLOYING IP PHONES As preparations are made for implementing IP phones, most organizations place heavy emphasis on testing and enhancing their network quality of service (QoS) to ensure that their network can deliver the required bandwidth and latency necessary for voice traffic. However, a number of other equally important network services are often overlooked as part of VoIP deployments, and often with undesirable consequences. For instance, all IP phones, like PCs and servers, require an IP address to send and receive data over the network. As such, installing an IP phone system can easily double the number of IP addresses that need to be managed in an organization. Other services also are essential for effective VoIP phone services, such as network time synchronization (NTP) and firmware and configuration file distribution (TFTP/HTTP). Many organizations rely on existing network infrastructure such as general-purpose servers and/or routers or switches that is not designed with dial-tone reliability in mind. As a result, many discover that their state-of-the-art IP telephony phone system is not nearly as reliable as expected, leaving end users dissatisfied and IT resources consumed trying to deliver the same reliability most have come to expect from conventional analog and digital phone systems. Enterprises find themselves with an increased and costly management burden, and may not be realizing the anticipated cost savings of IP telephony. Furthermore, IP telephony opens up new security vulnerabilities that require vigilance (and constant patching) to mitigate. To remedy this problem and allow organizations to realize the full efficiency and cost benefits of their VoIP applications, Infoblox provides essential IP network services in easy-to-manage, secure, scalable, and reliable appliances. In short, Infoblox appliances reduce IP phone implementation effort, operations cost, downtime, and security risk. NETWORKING REQUIREMENTS FOR VoIP PHONE SYSTEMS The network requirements for VoIP can be broken into three categories. First, there are specific networking protocols required for the operation of the phone. Second, there are service-level requirements that describe how the protocols should be provisioned. Third, VoIP planning, management, and diagnostic tools are critical for the ongoing management of the IP phones and network services. Network Protocol Requirements The following network protocols are used to support IP phone systems: DHCP (Dynamic Host Configuration Protocol) is used to allocate IP addresses to phones. An IP phone typically requires assignment of an IP address whenever it is powered on, when it is moved from one location to another, or when firmware is upgraded. The alternative to leveraging a DHCP system/service is to set each IP address statically and manually, which can be cumbersome when managing more than a few dozen employees. Also, DHCP is frequently used to deliver other installation-specific options to IP phones, such as the IP address of the TFTP server for firmware and configuration file updates. NTP (Network Time Protocol) is used to synchronize the clocks of computers and IP phones over a network. Having all the devices show the same time is a basic requirement of any network, especially if time-based accounting or billing is required, or if network events must be correlated to establish the sequence of actions in the event of network outages or security breaches. TFTP (Trivial File Transfer Protocol) and HTTP (Hypertext Transfer Protocol) are used for sending firmware updates and configuration files to an IP phone when new versions of the software are available. These updates can happen quite frequently, and may occur as often as monthly for minor firmware releases. 1

3 Beyond Quality of Service (QoS) RADIUS (Remote Authentication Dial-In User Service) is used for authenticating IP phones, for 802.1x authentication, and for encryption available on certain phones types. It also is used for screenphones and softphones. As network security requirements increase, users of IP phones may be required to authenticate prior to gaining network-based phone services, just as users do with their Windows login. Authentication prevents malicious users from mimicking phones and gaining unauthorized access to the enterprise network, and also can be used to set policies based on the user s identity. DNS (Domain Name System) maps names to IP addresses (e.g. to ) and is used heavily by SIP (Session Initiated Protocol) phones, screenphones, and softphones for basic communications, web browsing functions, etc. (Note: Phones that use H.323 signaling instead of SIP, such as current Cisco phones, do not make significant use of DNS.) Service-level Requirements In addition to basic protocol support, there are a number of service-level requirements necessary to meet end-user telephony expectations: Dial-tone /5-nines reliability: To make the IP phone experience the same level of reliability as a traditional analog or digital phone system, high availability is required for all supporting network services. Local survivability: Local survivability is required to provide continuous availability of network services when WAN links are down or during maintenance windows for networking devices at the centralized location. Central management and real-time reporting: Centralized management and reporting give a single administrator global control and administrative capability of the devices in a network. Security: Security of the network devices is critical to prevent a malicious user from compromising the voice network. Upgradeability: IP phones and the network devices supporting these phones require periodic firmware upgrades. A streamlined, centralized process allowing one-button upgrades without service interruption is ideal in a VoIP environment, where the cost of phone downtime could be high. Planning, Management, and Diagnostic Tools Specialized tools are required to deal with the new demands that IP phone system place on the network and to help ensure quick resolution of end-user issues. Proper tools also can provide visibility and control over critical items such as IP address space management and help to diagnose and correct phone problems at the network level. For example, deploying IP phones can effectively double the number of IP addresses in use, and yet many Protocol DHCP TFTP & HTTP NTP Key Impacts Phones need IP address when turned on DHCP lease expires, code updated, etc. Phones require file delivery services to receive updated software & config files. Changes can be frequent and may clog WAN links Reliable, consistent and secure source of network time needed for billing and troubleshooting Figure 1: Core VoIP network services required for dialtone reliability and maximum manageability Infoblox Inc. All rights reserved. wp_voip_26feb07 2

4 Beyond Quality of Service (QoS) organizations may experience address exhaustion in parts of the network because they lack tools to proactively monitor and manage their IP addresses. In addition, network traffic traces are often necessary to troubleshoot signaling failures that result in incomplete or dropped calls. HOW NETWORK SERVICES FOR VoIP ARE DELIVERED TODAY While most of the protocols described above are present in a typical enterprise, they are rarely designed with IP telephony requirements in mind. The most common method of deploying these services is via software installed on general-purpose servers, such as Windows- or Unix-based servers. There are several problems with this approach: General-purpose servers typically have security vulnerabilities, and these can now compromise both voice and data services. For example, a virus attack, which might have previously disrupted or web traffic, could now affect the ability of employees to make phone calls. The need to secure, patch, and upgrade the operating system and software applications on each server carries high administration costs. Managing the IP addresses, phone firmware and configurations, and other network data on dozens or hundreds of disparate systems in an enterprise with no centralized management tools can be costly, frustrating, and inefficient. Providing failover of network services for high availability and disaster recovery is very cumbersome with most server-based approaches. Generating reports of network activity for planning, troubleshooting, forensics, reporting, and regulatory compliance is extremely difficult when network infrastructure data resides in multiple independent databases. An alternative to delivering network services commonly used in branch offices is to leverage the DHCP services built into a switch, router, or other networking device for the local IP phones. While this solves the local DHCP provisioning issue, these solutions typically lack failover and central management capabilities and often are weak in their support for vendor-specific phone options. Still another approach is to use the services provided on VoIP gateways and callcontrol systems, but these also typically provide only rudimentary capabilities and lack many of the service-level requirements described above. THE INFOBLOX APPLIANCE APPROACH Infoblox appliances are purpose-built to deliver IP network infrastructure services for VoIP applications that ensure the highest levels of reliability, security, manageability, and ease of implementation across an enterprise. Infoblox appliances are security-hardened and simplify or eliminate many common system administration tasks. They run the Infoblox NIOS software, which has no unnecessary exposed network ports and provides no root access. Updating software is easy just a simple one-button operation. Deployment is simple, and built-in highavailability technology and database synchronization ensure fast network switchover and nonstop services. Streamlined administration via a web-based GUI simplifies management. The table below summarizes the benefits of the Infoblox appliance approach when compared with software on general-purpose servers. 3

5 Beyond Quality of Service (QoS) The Network Services for VoIP package, which runs on any Infoblox appliance, includes the critical network services necessary to operate IP phone systems: IP address assignment (DHCP), trivial file transfer protocol (TFTP), hypertext translation protocol (HTTP), network time protocol (NTP), and VoIP IP management and diagnostic tools. Another critical component of the package the grid module ties a group of appliances together, allowing for centralized management, automated IP phone firmware distribution, local survivability, and service redundancy. The optional DNS upgrade allows administrators add domain name system (DNS) functionality at a future date. Infoblox s flagship product, the DNSone with Keystone package, offers all the above services including DNS for end users with immediate DNS requirements as well. Software on General-purpose Server Infoblox Network Services Appliance Platform Security Underlying OS inherently vulnerable Hardened OS, no extra open ports Deployment Time 12+ hours 1 hour Integration Independently managed protocols & data stores Integrated services with unified data & management Resiliency Failure of device requires building a new server Built-in HA with less than 5-second failover Administrative Cost Dedicated expertise required Easy-to-use GUI, Automated backup & restore Software Upgrades Time-consuming, service-affecting One-button upgrade from GUI, easy reversion Table 1: Comparison of Infoblox appliance approach vs. generalpurpose servers THE INFOBLOX SOLUTION PROVIDES CRITICAL NETWORK SERVICES FOR CURRENT AND FUTURE IP PHONE DEPLOYMENTS Infoblox appliances not only solve the key protocol and networking service requirements today, but provide a platform to solve more advanced IP phone requirements in the future. Examples of this include DNS (for SIP phones) and RADIUS (for secure voice communications and for managing voice over WiFi authentication). End users can purchase the Network Services for VoIP package today and have an integrated appliance platform to add other services in the future as needed. The table below summarizes the challenges faced by organizations deploying VoIP systems and shows how the Infoblox solution addresses each challenge. Figure 2: Infoblox Provides a Solid Foundation and Growth Path 4

6 Beyond Quality of Service (QoS) PROBLEM WAN traversal problem for firmware updates IP phones require periodic firmware file updates from the IP-PBX. The files can be up to 5 MB in size, causing WAN congestion and delays (and phone outages) when a group of phones at a remote site simultaneously reboot and request the files from the centralized IP-PBX that usually carries the files. A common way to deal with this problem is to set up Windows or Linux servers in each remote location to serve the files locally, which requires a high level of IT overhead to purchase, set up, and manage the servers and the firmware file download process. No ability to ensure 5-nines or dial-tone reliability for IP phone system IP phones are only as reliable as the underlying systems that support them. It is difficult and costly to ensure reliability of DHCP, TFTP, NTP, etc. on standard servers in multiple locations. No local survivability for key services If network services (DHCP, TFTP, NTP, etc.) are provided from a central office, a remote office can be cut off from those central services, thereby causing local downtime of the IP phone system. No cohesive way to manage network services (DHCP, TFTP, NTP, etc.) globally Services are often run on different servers and devices, by different groups, and in different locations. Each device in each location must be managed individually. IP addressing and data files must be secure If DHCP or TFTP servers are compromised it can enable rogue devices to be installed on the network and can also enable malicious code to be installed on remote servers. The time/date displayed by IP phones must be the same as other devices in the network (desktops, servers, etc.) Providing accurate time service to devices on a network is not just a convenience to the user but is critical for accurate billing and usage data, for security, for compliance and logging services, and for forensic analysis following a security breach. INFOBLOX SOLUTION Infoblox provides an automated IP phone firmware distribution system through a combination of DHCP, TFTP, centralized management, Infoblox grid technology, and remote diagnostics. Firmware files are loaded once into a grid master, and are automatically distributed to each member appliance in each remote location one time over the WAN link. The local member appliance provides the TFTP services to the local phones on the local LAN connection, thereby dramatically reducing the time required for the phones to update. Also, the grid allows for centralized management and remote diagnostics of the process, which eliminates the necessity of a local IT resource physically going to a site and setting up a Windows server. The resulting operational savings can return the cost of the Infoblox appliances in less than 6 months. Infoblox provides high availability between appliance pairs, as well as service-level HA among appliances on a grid. The appliance is hardened, preventing root access that would allow an end user (or a malicious user) from loading other applications that might compromise the integrity of the core services provided and cause potential downtime. Deploying Infoblox appliances with HA and Infoblox grid technology to remote sites provides local survivability for all services. Infoblox grid technology provides centralized management for all services on all appliances. A grid of appliances can be upgraded with a single push of a button from a central location, rather than managing, patching, and updating each server individually. Infoblox NIOS software is hardened and consistently withstands security scans and attacks from the most demanding government and military organizations. In the event that a new exploit is discovered, the underlying Infoblox NIOS software can be upgraded in minutes via a single, simple operation. This makes them much more difficult to penetrate than general-purpose operating systems with known vulnerabilities. Management communication is secured using Secure Sockets Layer (SSL)-encrypted VPNs for protection against management compromise. Infoblox provides time synchronization services via network time protocol (NTP). The Infoblox NTP service supports authentication for environments that need to verify that network time is being supplied by a trusted source. Table 2: Infoblox solutions address key network services challenges in VoIP deployment 5

7 Beyond Quality of Service (QoS) THE INFOBLOX SOLUTION MEETS VoIP REQUIREMENTS AND OFFERS A COMPELLING ROI COMPARED TO ALTERNATIVES Infoblox appliances are priced competitively to easily complement an IP phone deployment. By avoiding the need to deploy and manage local servers for local survivability of DHCP and TFTP and by eliminating the WAN traversal problem for file downloads, the Infoblox solution pays for itself in as little as 6 months in medium-sized installations and even faster in very large, highly distributed environments. Infoblox Network Services for VoIP Solution Freeware Protocols on Windows/ Linux Servers Switch/Router/ Firewall IP-PBX DHCP NTP TFTP TFTP with automated file synchronization TFTP with centralized file management High availability Centralized management Plug-and-play start-up Built-in security IP address management tools Troubleshooting tools Real-time reporting and visibility Table 3: Infoblox delivers the most comprehensive set of network requirements for IP telephony Summary IP telephony applications rely heavily on IP network infrastructure services to operate. General-purpose servers and other ad-hoc methods of provisioning these services are costly, difficult to maintain, and do not provide the level of reliability that the average user in a telephony environment expects. Furthermore, new requirements for security and mobility in next-generation IP telephony deployments rely even more on IP infrastructure services to operate. An Infoblox hardened appliance running multiple services in a highly reliable, centrally managed, and scalable platform provides the ideal way for an enterprise to ensure network dial-tone for highly reliable, secure, and manageable IP telephony solutions. 6

8 For More Information: (toll-free, U.S. and Canada)