asterisk users - Jul 2006 - Connecting branch offices through IPsec tunnel --latency effects?

Stephen wrote:
> If I connect two offices through an IPsec tunnel, what is the impact
on
> latency, and does it noticeably affect calls?
That would depend a lot on the equipment that services the IPSEC tunnel
endpoints.
> Has anyone out there tried this? What were the effects?
I've run small to mid size offices (20 to 60 people) over IPSEC
tunnels during periods of internal network failures with good results.
That includes offices on the opposite side of the world with one-way
latency normally around 100ms, but often up to 160ms.

Using commercial IPSEC endpoints, or OpenSWAN on a decent system only
adds a couple of ms, if that.

Dan

We have two offices - one in Oklahoma and the other in Vancouver, BC -
connected via an OpenVPN connection.  We have big pipes at each site
(15Mb and 10Mb), and it works great.  We average about 70ms latency
through the tunnel.  We have about 5-6 conference calls per day with up
to 20 users, and no one has complained about the audio quality (after we
upgraded the Polycom firmware, that is.  We had a godawful echo problem
with the older firmware).

We used to have an IPSec VPN, but for us the OpenVPN solution is much
simpler, and has been more reliable.

Kevin

-----Original Message-----
From: asterisk-users-bounces@lists.digium.com
[mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of Stephen
Bosch
Sent: Tuesday, July 25, 2006 10:25 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: [asterisk-users] Connecting branch offices through IPsec tunnel
--latency effects?

Hi:

If I connect two offices through an IPsec tunnel, what is the impact on
latency, and does it noticeably affect calls?

Has anyone out there tried this? What were the effects?

Cheers,

-Stephen-

Dan Austin wrote:
> Stephen wrote:
>> If I connect two offices through an IPsec tunnel, what is the impact
> on
>> latency, and does it noticeably affect calls?
> That would depend a lot on the equipment that services the IPSEC tunnel
> endpoints.
> 
>> Has anyone out there tried this? What were the effects?
> I've run small to mid size offices (20 to 60 people) over IPSEC
> tunnels during periods of internal network failures with good results.
> That includes offices on the opposite side of the world with one-way
> latency normally around 100ms, but often up to 160ms.
> 
> Using commercial IPSEC endpoints, or OpenSWAN on a decent system only
> adds a couple of ms, if that.
I might add that I did a little research for a non-voip project relative 
to what cisco 28xx routers could sustain in terms of ipsec-vpn 
throughput. The cisco doc's report 55 mbs sustained throughput.

On the flip side, the older cisco routers can't sustain 500 kbs without 
adding a hardware encryption board to the router.

So, you are probably very right with the "depends a lot on the 
equipment". ;)