Voip problem due to high delays

[ralfzenklusen]

It seems that reliable voip is almost impossible on a FGT60 if AV or IPS is active. AV and IPS can both produce big delays. With IPS this depends heavily on the load and AV seems to produce delay " patterns" . But even with small or medium loads (<10Mbit/s) the delays are already getting critical for voip. Of course bandwidth management and priorisation was set optimal for voip. Unfortunately Fortinet is not really helpful. Talks started last year, the ticket was opened 01/19/05 and except for some proposals in the priorisation settings (didn' t help) nothing came over. Since a few weeks we haven' t heart anything. I know there are some issues with H323, but I expect the priorisation and bandwidth settings to work. Has anybody else made measurements and tests with voip? Ralf

[ralfzenklusen]

No answer from Fortinet since several weeks and no solution for a simple VoIP application... disappointing... It seems that FortiGate firewalls should not be used if VoIP is in use or priorisation is important... Ralf

[garyho]

How about create a separate rule just for the VOIP traffic and leave the Protection profile uncheck?

[ralfzenklusen]

We configured 3 policies: 1 internal->wan1, web-ports only, low priority, limited bandwith, AV/IDS 2 Internal->otheroffice, vpn, low priority, limited bandwidth 3 internal pbx ip->otheroffice pbx ip, same vpn, high priority, max bandwidth The pbx was connected directly with 100Mbit and the internal network with 10Mbit on the internal switch of the FTG60. We had max 0.5Mbit voice and 2-3Mbit other traffic. Test have shown that the av/ids, configured only for general web traffic, influences the voip traffic heavily. With much less then the theoritical maximum of 10Mbit web traffic, you can get more then 5% packet loss in max 200ms delay. Average delay itself can get high as well. Things get better if you connect the pbx on a separate ethernet, but even then you " see" the influence av/ids in the voice traffic. Everything is fine with no internal network and no av/ids, but why should you use FortiGate at the end...

[#5]

I' m guessing this may be restricted to single processor boxes, because the multiprocessor boxes seem to restrict AV activity to one processor while the other(s) can forward non-av traffic like voip traffic, unless you #optimize antivirus to distribute the load. That' s said, unless some actual AV activity was going on I wouldn' t expect it to be a problem on uni-processor boxes either... do you have problems even if only voip traffic is passing through the FGT60, with no HTTP/FTP/SMTP/POP3/IMAP4 traffic at all? <Nomenludi>

[ralfzenklusen]

We haven' t checked with a multi CPU model. It may realy change things. But with the very low traffic we used I would expect a FTG60 to be the right model...

[isptools]

we have a network with VOIP running since october last year. We had allways a extra tunnel from PBX a2b etc... The Network runs with 6 sites and the delay is no problem (we allways use Shaping for the VOIP-Tunnels). The only problem in the moment is support for a newer release of forti-os. We stay in the moment @ 2.8 b320. Michael

[ralfzenklusen]

The idea with an extra tunnel is new - thank you, we' ll try it out!

[isptools]

our config was allways: Internal: The Data-Network from the customer WAN1: Leased-Line (Cisco) WAN2: Leased-Line (Cisco or DSL for Backup-Purposes) DMZ: The PBX if you have further questions pls. send me an eMAIL. Michael

[#10]

possibly go to MR4. MR5-MR9 all have issues with H323 ad H245