About michaelmertens

I'm doing my first PAN QoS configuration- it's for a SIP trunk to a carrier from our VoIP network. I've read through the procedures and wanted to do a sanity check for my approach:   1) I've configured my security rules for SIP to have QoS "Follow Client to Server Flow" to maintain the DSCP markings from carrier to VoIP internal network and vise-versa.    2) I've defined on the Panorama my QoS Policy as that's where all our security and NAT policies are managed, so I figured I'd keep up with that approach. This policy marks RTP-BASE and RTP-Autdio traffic between our inside Border Controller and the carrier Border Controller as EF (which it should be marked  already as that) and assigned it as Class 1. The 2nd policy marks all SIP, SIP application, SIP Trunk, SIP Message) traffic between the two Border Controllers as CS3 (which it should be already) and assigned it as Class 3.   3) On the PAN appliance, I created a QoS Profile "VoIP"  with a Guaranteed Egress of 1 Gbps and max Egress of 1 Gbps. (It is a 1 Gbps ethernet interface). Within that QoS Profile is class 1 traffic (EF) with a guaranteed and max egress of 800.000 (800 Mbps) and class 3 at 100.000 (100 Mbps). I'm leaving the last 100 Mbps for everything else (this is only a SIP trunk so shouldn't have anything else). The last/bottom 100 Mbps for best-effort: Do I need to define what my best-effort traffic is? Or if a class isn't defined here and given egress bandwidth, it automatically becomes best effort?   4) The answer to number three will probably answer this- do the values of all the classes in a QoS Profile (in step 3 above) need to or should equal the "Egress Max) in the QoS interface "Physical Interfaec" tab?   THANKS for any help, direction or confirmation you can give!!!   Mike ... View more

We're provisioning and testing a dedicate wave circuit and an Internet-IPSEC backup between two PANs. (We are also running IPSEC over the wave circuit). We noticed a phenomena of sorts and was wondering if anyone has experienced this: We purposely failed the upstream PAN's WAVE circuit's ethernet interface to test failover to the internet-IPSEC. The wave-IPSEC tunnel went red for IKE and Tunnel Info on both head-end and remote-office. The odd thing was that we had a PAN Traffic Monitor going on the head and watching session traffic going over the wave-IPSEC; when the traffic was failed over to internet-IPSEC we still saw session traffic with new time stamps over the downed wave-IPSEC tunnel interface...We KNOW that circuit was down, unavailable and even the PAN knew it from the tunnel status. We are running OS 9.0.9. Does anyone have any guesses, thoughts, etc?  Thanks!!   Mike ... View more