IPSec VPN Client and Motorola vt1000

Posts: 2 · New Forum Member Joined: Mar 25, 2004 Posts: 2

mhren wrote:

I have the same problem but it appears that the problem is more due to an apparent lack of IPSEC passthrough support by the Motorola unit Cry

Is this true?

My recollection is that the CISCO unit supports IPSEC Passthrough ......... can anyone confirm?

The Cisco ATA-186 only had a single ethernet port. Its Motorola equal is the VT1003. The Cisco ATA-188 had two ports that worked as a layer 2 switch (only supported on MAC address on the inside port). There is no Motorola equivalent. The Motorola VT1005 is a layer 3 router.

If you plug the WAN port of the VT1005 into your router (inside) it should function fine.

There is no need to worry about QoS Your ISP probably ignores the TOS bits sent by the unit anyway. (I'm kinda in the know on this subject) The only exceptions are 1) your ISP is a wireless provider using Motorola Canopy 2) you use a Motorola cable modem and your cable provider uses a Motorola CMTS. Even then the QoS is probably lost once the data hits your ISP's router.

Vern
(there are 10 types of people...those that understand binary and those that don't)

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

I have some counter-information, knowsnearlyeverything. First, the VT1005 can be either a router or a bridge. I currently use it in bridge mode which is enabled when you uncheck the NAT/DHCP checkbox in the Moto configuration. What happens is that the PC port on the Moto now is on the cable/DSL modem's inside interface subnet. I have confirmed this by noting that in this config, both the Moto and my Linksys router (BEFW11S4 connected to the Moto PC port) both get a separate IP address from the ISP (RoadRunner).

In addition, all non-voice traffic is forwarded to the MAC address that is connected to the PC port - in my case, my Linksys. How do I know this? I operate a number of servers on my Win2K desktop plugged into the inside of the Linksys: PPTP VPN server, web server, SMTP server, VNC remote control server, SSH server. All work just fine.

A nice side-benefit of this config is that the Moto does its QOS thing which is VERY necessary, almost no mater what uplink bandwidth you have. The key thing to remember is that any upload of data from your home network can fill the uplink pipe and thus cause voice packets to be delayed or dropped. I have verified this to be a problem by starting an upload on my PC at the same time I am in a voice call with my cell phone. I ALWAYS hear severely distorted voice inbound to the cell phone exactly when the upload starts. My RoadRunner Internet service gives me about 384Kbps uplink, which I have confirmed with much testing. Making all the Internet uplink traffic go through the Moto greatly reduces or eliminates the distorted voice. I hear a light 1-second distortion when the upload starts now. This makes the Moto's QOS feature VERY desirable.

I should mention that my Moto is running 1.16d. The Vonage tech said that this rev fixes some IPSec and maybe PPTP pass-through problems. For me, it did indeed fix inbound PPTP pass-through and it now allows me to "hairpin" web sessions originated from an inside PC.

Now, on to reliability. So far, this config has been working for me for 3 days - no loss of voice or data service. HOORAY! Previous to 1.16d, I had the Moto behind my Linksys which was good for voice reliability but sucked for outbound voice quality. I am very happy now.

Bob

knowsnearlyeverything wrote:

mhren wrote:

I have the same problem but it appears that the problem is more due to an apparent lack of IPSEC passthrough support by the Motorola unit Cry

Is this true?

My recollection is that the CISCO unit supports IPSEC Passthrough ......... can anyone confirm?

The Cisco ATA-186 only had a single ethernet port. Its Motorola equal is the VT1003. The Cisco ATA-188 had two ports that worked as a layer 2 switch (only supported on MAC address on the inside port). There is no Motorola equivalent. The Motorola VT1005 is a layer 3 router.

If you plug the WAN port of the VT1005 into your router (inside) it should function fine.

There is no need to worry about QoS Your ISP probably ignores the TOS bits sent by the unit anyway. (I'm kinda in the know on this subject) The only exceptions are 1) your ISP is a wireless provider using Motorola Canopy 2) you use a Motorola cable modem and your cable provider uses a Motorola CMTS. Even then the QoS is probably lost once the data hits your ISP's router.

Vern
(there are 10 types of people...those that understand binary and those that don't)

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

By the way, outbound Cisco VPN Client IPSec works fine for me.

Bob

bobbabai wrote:

I have some counter-information, knowsnearlyeverything.

Posts: 2 · New Forum Member Joined: Mar 25, 2004 Posts: 2

bobbabai wrote:

]I have some counter-information, knowsnearlyeverything.

I stand corrected. After clearing some ARP tables and booting the Moto, I found that bridge mode really does work. In fact, it's a full bridge instead of the single MAC like the ATA-188.

In bridge mode, with the Moto between my PIX and ISP, my PIX still fires tunnels fine. I haven't tried firing VPN's through the thing in router mode. Should work fine so long as only one tunnel is fired at a time (More than 1 pc firing tunnels at the same time almost never works behind NAT routers that cost less than $500).

Interestingly enough, the Moto will not pull an IP address from my PIX at home...works fine on the PIX at the office (same IOS). That makes it pretty much impossible for me to plug it in behind my PIX. I'll investigate that more later.

bobbabai wrote:

]In addition, all non-voice traffic is forwarded to the MAC address that is connected to the PC port - in my case, my Linksys.

Sure it is. If the Moto is in router mode that's where the MAC address stops. In router mode, your ISP only sees the WAN MAC address of your Moto. The voice traffic is still tagged with ToS bits. The problem is that layer 2 switches (like the one your ISP uses) have to be configured to prioritize traffic based on the ToS bit presented. Also, once the traffic hits a router, ToS bits are usually stripped.

To make a short story long...Using the Moto for QoS will help while you're downloading or uploading, but will probably do nothing about your neighbor's downloading/uploading (if you have a teenager in the house, this is still a big deal, especially if you only have 128K service). I'll also add that the default ToS bits for the Cisco ATA-18x are the same as the Moto, but the Cisco was tunable.

bobbabai wrote:

]My RoadRunner Internet service gives me about 384Kbps uplink

I win...mine is 12Mb down 5Mb up...now if I could only upgrade from Win98.

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

True, everything you say. But by far the biggest issue with bandwidth for almost everyone is going to be the limited upstream bandwdth, regardless of what other people in your neighborhood are doing and whether your ISP does priority queueing for voice at layer 2 on its switches. And that is the problem that priority queueing on the Moto solves - always giving voice priority over normal data on the uplink.

Bob

Posts: 243 · Vonage Forum Master Joined: Jan 18, 2004 Posts: 243

Message to all.... Put your ATA behind your routers... problem solved! QOS doesn't really do anything for your calls. I've run with the ATA behind my router since I've joined and have never had a single issue with quality of service. I've been on a called and have downloaded some large files at the same time I was connected to my office via VPN and was connected to my office PC via PCAnywhere and never once had a problem with my phone call.

The only times I had problems with my ATA was when I tried to run it in front of my router. Seems it wasn't able to handle the IP floods it would get being connected directly to the internet.

Greg

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

Try UPLOADING files, gfoulks. That's when the QOS problem is noticed, when your site is sending lots of traffic. The problem is repeatable, every single time.

When you are downloading, chances are that your local Internet link has more downstream bandwidth than at the worst point in the rest of the path of your download. Thus, voice traffic to you is seldom lost.

Bob

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

One more piece of info: the garbled won't be heard by you - it'll be heard by the person you are talking to.

Bob

Posts: 243 · Vonage Forum Master Joined: Jan 18, 2004 Posts: 243

Upload all of the time. When I'm at home I need to move large files Wav files to pc at the office. The largest file I've uploaded was 500 mb and I never had a problem with voice quality nor anything reported from those on the other end.

Posts: 66 · Full Forum Member Joined: Dec 15, 2003 Posts: 66

Cool! I think you're lucky. By the way, what is the upstream bandwidth of your internet service?