<span style="color: rgb(0, 0, 153);">Hi Matthew,</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);">Thank you for your reply,</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);">
I have 2MB ADSL connection at branch office where I have 871 located. </span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);">regarding IOS firewall as this is still not in production I will configure it once I get all other issue sorted out. Qos automatically generated as a part of the auto qos voip trust command in interface and I have added bellow parts
</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);" class="e" id="q_10f0641d9e99852a_3"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">
policy-map Shape-2MB<br>
class class-default<br>
shape average 2000000 <br>
service-policy AutoQoS-Policy-Trust<br><br></span></font></span><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"><span style="color: rgb(0, 0, 153);">Which changes are you recommend t keep my Priority Queue /
LLQ < 35% of total bandwidth.</span><br style="color: rgb(0, 0, 153);"><span style="color: rgb(0, 0, 153);">Thanks again everyone, I would greatly appreciate your comments when you have time.</span><br style="color: rgb(0, 0, 153);">
<br>Manoj<br><br></span></font><br><div><span class="gmail_quote">On 11/21/06, <b class="gmail_sendername">Linsemier, Matthew</b> <<a href="mailto:MLinsemier@apcapital.com">MLinsemier@apcapital.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="blue" lang="EN-US">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Manoj,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Can you provide a few more details?</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<ul style="margin-top: 0in;" type="disc">
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">Is
this a public or private circuit?</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">Is
this a symmetrical 2mb link?</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
</ul>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Some things to look at:</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<ul style="margin-top: 0in;" type="disc">
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">No
IOS firewall has been enabled (if this is a public link, you will want to
do this)</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">As
a best practice Cisco states that you should keep your Priority Queue /
LLQ < 35% of total bandwidth</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">As
a security best practice you may want to disable telnet and http and stick
with ssh and https</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
<li style="color: navy;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;">If
you want to track MoS and other IP voice related statistics, you may want
to implement IP SLA</span></font> <font face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial;"></span></font></li>
</ul>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Matt</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<div>
<div style="text-align: center;" align="center"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">
<hr align="center" size="2" width="100%">
</span></font></div>
<p><b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold;">From:</span></font></b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;">
<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">cisco-voip-bounces@puck.nether.net</a> [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
cisco-voip-bounces@puck.nether.net</a>] <b><span style="font-weight: bold;">On Behalf Of </span></b>Lead Solution<br>
<b><span style="font-weight: bold;">Sent:</span></b> Monday, November 20, 2006
10:39 AM<br>
<b><span style="font-weight: bold;">To:</span></b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">cisco-voip@puck.nether.net</a><br>
<b><span style="font-weight: bold;">Subject:</span></b> [cisco-voip] Configure
Cisco 871 Branch Office VoIP</span></font></p>
</div><div><span class="e" id="q_10f0641d9e99852a_1">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;">Hi All,</span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;">Bellow is the configuration of our one of the branch office VoIP
router. I would like to share it with you guys and see whether someone can
suggest me better VLAN, QoS configuration. Also, I have policy map 2MB
spplied for FastEthernet 4 and Tunnel. Is this right? </span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;">I would greatly appreciate your comments.</span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;"> </span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;">Best regards,</span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;">Manoj</span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="2"><span style="font-size: 10pt;"> </span></font></p>
</div>
<div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Building configuration...</span></font></p>
</div>
</span></div><div><div><span class="e" id="q_10f0641d9e99852a_3">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Current
configuration : 7520 bytes<br>
!<br>
version 12.4<br>
no service pad<br>
service timestamps debug datetime msec<br>
service timestamps log datetime msec<br>
no service password-encryption<br>
!<br>
hostname XXXXX_871 <br>
!<br>
boot-start-marker<br>
boot-end-marker<br>
!<br>
logging buffered 51200 warnings<br>
enable password xxxxxxxx<br>
!<br>
aaa new-model<br>
!<br>
!<br>
!<br>
aaa session-id common<br>
!<br>
resource policy<br>
!<br>
ip cef<br>
!<br>
!<br>
no ip dhcp use vrf connected<br>
ip dhcp excluded-address <a href="http://192.168.5.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.1</a>
<a href="http://192.168.5.99/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.99</a><br>
ip dhcp excluded-address <a href="http://192.168.5.151/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.151
</a><a href="http://192.168.5.254/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.254</a><br>
ip dhcp excluded-address <a href="http://172.198.10.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.1</a>
<a href="http://172.198.10.99/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.99</a><br>
ip dhcp excluded-address <a href="http://172.198.10.151/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.151</a>
<a href="http://172.198.10.254/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.254</a><br>
!<br>
ip dhcp pool VLAN10<br>
network <a href="http://172.198.10.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.0</a>
<a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">255.255.255.0</a><br>
default-router <a href="http://172.198.10.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.1</a>
<br>
domain-name <a href="http://xxxx.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">xxxx.com</a><br>
dns-server <a href="http://211.129.14.134/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">211.129.14.134</a>
<br>
lease 7<br>
!<br>
ip dhcp pool VLAN20<br>
network <a href="http://192.168.5.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.0</a>
<a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">255.255.255.0</a><br>
default-router <a href="http://192.168.5.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.1</a>
<br>
domain-name <a href="http://xxxx.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">xxxx.com</a><br>
dns-server <a href="http://211.129.14.134/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">211.129.14.134</a>
<br>
option 150 ip <a href="http://172.16.0.10/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.16.0.10</a>
<br>
lease 7<br>
!<br>
!<br>
no ip domain lookup<br>
ip domain name <a href="http://xxxx.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">xxxx.com</a><br>
!<br>
!<br>
crypto pki trustpoint TP-self-signed-1440134037<br>
enrollment selfsigned<br>
subject-name cn=IOS-Self-Signed-Certificate-1440134037 <br>
revocation-check none<br>
rsakeypair TP-self-signed-1440134037 <br>
!<br>
!<br>
crypto pki certificate chain TP-self-signed-1440134037<br>
certificate self-signed 01<br>
3082024A 308201B3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 <br>
quit<br>
username pbxl privilege 15 secret 5 $1$Ce8g$9S4kDri6Yyg2gBCVSS1LI0 <br>
! <br>
!<br>
class-map match-any AutoQoS-VoIP-RTP-Trust<br>
match ip dscp ef <br>
class-map match-any AutoQoS-VoIP-Control-Trust<br>
match ip dscp cs3 <br>
match ip dscp af31 <br>
!<br>
!<br>
policy-map AutoQoS-Policy-Trust <br>
class AutoQoS-VoIP-RTP-Trust<br>
priority percent 70<br>
class AutoQoS-VoIP-Control-Trust<br>
bandwidth percent 5<br>
class class-default <br>
fair-queue<br>
policy-map Shape-2MB<br>
class class-default<br>
shape average 2000000 <br>
service-policy AutoQoS-Policy-Trust<br>
!<br>
! <br>
!<br>
crypto isakmp policy 10<br>
encr 3des<br>
hash md5<br>
authentication pre-share <br>
group 2<br>
crypto isakmp key 6 xxxxxx address <a href="http://210.181.112.194/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">210.181.112.194</a> no-xauth<br>
!<br>
!<br>
crypto ipsec transform-set XXXLKAMIYA esp-3des esp-md5-hmac <br>
!<br>
crypto ipsec profile GREPRO<br>
set transform-set XXXLKAMIYA <br>
!<br>
!<br>
!<br>
!<br>
!<br>
interface Tunnel0<br>
bandwidth 2000<br>
ip address <a href="http://10.0.20.2/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.20.2</a> <a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.255.0</a><br>
tunnel source Dialer0<br>
tunnel destination <a href="http://210.181.112.194/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">210.181.112.194</a>
<br>
tunnel mode ipsec ipv4<br>
tunnel protection ipsec profile GREPRO<br>
service-policy output Shape-2MB<br>
!<br>
interface FastEthernet0<br>
description ********** PC/VoIP **********<br>
switchport trunk native vlan 10 <br>
switchport mode trunk<br>
switchport voice vlan 20<br>
auto qos voip trust <br>
spanning-tree portfast<br>
service-policy output AutoQoS-Policy-Trust<br>
!<br>
interface FastEthernet1<br>
description ********** PC/VoIP ********** <br>
switchport trunk native vlan 10<br>
switchport mode trunk<br>
switchport voice vlan 20<br>
auto qos voip trust <br>
spanning-tree portfast<br>
service-policy output AutoQoS-Policy-Trust<br>
!<br>
interface FastEthernet2 <br>
description ********** PC/VoIP **********<br>
switchport trunk native vlan 10<br>
switchport mode trunk<br>
switchport voice vlan 20<br>
auto qos voip trust <br>
spanning-tree portfast<br>
service-policy output AutoQoS-Policy-Trust <br>
!<br>
interface FastEthernet3<br>
description ********** PC/VoIP **********<br>
switchport trunk native vlan 10<br>
switchport mode trunk<br>
switchport voice vlan 20<br>
auto qos voip trust <br>
spanning-tree portfast <br>
service-policy output AutoQoS-Policy-Trust<br>
! <br>
interface FastEthernet4<br>
bandwidth 2000<br>
no ip address<br>
ip nat outside<br>
ip virtual-reassembly<br>
ip tcp adjust-mss 1452<br>
duplex auto<br>
speed auto <br>
pppoe enable<br>
pppoe-client dial-pool-number 1<br>
service-policy output Shape-2MB<br>
!<br>
interface Vlan1<br>
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$<br>
ip address <a href="http://172.198.1.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.1.1 </a><a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.255.0</a><br>
!<br>
interface Vlan10<br>
description Data Vlan 1<br>
ip address <a href="http://172.198.10.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.1</a>
<a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">255.255.255.0</a><br>
ip nat inside<br>
ip virtual-reassembly<br>
ip tcp adjust-mss 1452<br>
!<br>
interface Vlan20 <br>
description Voice Vlan 1<br>
ip address <a href="http://192.168.5.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.1</a> <a href="http://255.255.255.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.255.0 </a><br>
ip nat inside<br>
ip virtual-reassembly<br>
ip tcp adjust-mss 1452<br>
!<br>
interface Dialer0<br>
bandwidth 2000<br>
ip address negotiated<br>
ip mtu 1452<br>
ip nat outside<br>
ip virtual-reassembly <br>
encapsulation ppp <br>
dialer pool 1<br>
dialer-group 1<br>
no cdp enable<br>
ppp authentication chap pap callin<br>
ppp chap hostname <a href="mailto:xxxxxx8@ffa.xxx.xxx.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">xxxxxx8@ffa.xxx.xxx.com</a><br>
ppp chap password 0 xxxx93<br>
ppp pap sent-username <a href="mailto:xxxxxx8@ffa.xxx.xxx.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">xxxxxx8@ffa.xxx.xxx.com</a> password 0 cyum93<br>
!<br>
ip route <a href="http://0.0.0.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">0.0.0.0</a> <a href="http://0.0.0.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">0.0.0.0
</a> Dialer0<br>
ip route <a href="http://172.16.0.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.16.0.0</a> <a href="http://255.255.0.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.0.0</a> Tunnel0<br>
!<br>
!<br>
ip http server<br>
ip http access-class 23<br>
ip http authentication local<br>
ip http secure-server<br>
ip http timeout-policy idle 60 life 86400 requests 10000 <br>
ip nat inside source list 1 interface Dialer0 overload <br>
!<br>
access-list 1 permit <a href="http://192.168.5.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.5.0</a>
<a href="http://0.0.0.255/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">0.0.0.255</a><br>
access-list 1 permit <a href="http://172.198.10.0/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.198.10.0</a>
<a href="http://0.0.0.255/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">0.0.0.255</a><br>
dialer-list 1 protocol ip permit<br>
no cdp run<br>
!<br>
!<br>
!<br>
!<br>
control-plane<br>
!<br>
rmon event 33333 log trap AutoQoS description "AutoQoS SNMP traps for
Voice Drops" owner AutoQoS <br>
rmon alarm 33333 cbQosCMDropBitRate.18.3164929 30 absolute rising-threshold 1
33333 falling-threshold 0 owner AutoQoS<br>
rmon alarm 33334 cbQosCMDropBitRate.34.5364641 30 absolute rising-threshold 1
33333 falling-threshold 0 owner AutoQoS <br>
rmon alarm 33335 cbQosCMDropBitRate.50.14618161 30 absolute rising-threshold 1
33333 falling-threshold 0 owner AutoQoS<br>
rmon alarm 33336 cbQosCMDropBitRate.66.2065329 30 absolute rising-threshold 1
33333 falling-threshold 0 owner AutoQoS <br>
banner login ^C<br>
-----------------------------------------------------------------------<br>
Cisco Router and Security Device Manager (SDM) is installed on this device. <br>
This feature requires the one-time use of the username "cisco" <br>
with the password "cisco". The default username and password have a
privilege level of 15.</span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Please
change these publicly known initial credentials using SDM or the IOS CLI. <br>
Here are the Cisco IOS commands.<br>
<br>
username <myuser> privilege 15 secret 0 <mypassword><br>
no username cisco </span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Replace
<myuser> and <mypassword> with the username and password you want
to use. </span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">For more
information about SDM please follow the instructions in the QUICK START <br>
GUIDE for your router or go to <a href="http://www.cisco.com/go/sdm" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.cisco.com/go/sdm</a> <br>
----------------------------------------------------------------------- <br>
^C<br>
!<br>
line con 0<br>
no modem enable<br>
line aux 0<br>
line vty 0 4<br>
length 0<br>
transport input telnet ssh <br>
!<br>
scheduler max-task-time 5000<br>
end</span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p></span></div>
</div>
</div>
<p><font color="#808080" face="Arial" size="1">
<hr>
</font></p>
<p><font color="#808080"><font face="Arial" size="1">CONFIDENTIALITY STATEMENT<br>This
communication and any attachments are CONFIDENTIAL and may be protected by one
or more legal privileges. It is intended solely for the use of the addressee
identified above. If you are not the intended recipient, any use, disclosure,
copying or distribution of this communication is UNAUTHORIZED. Neither this
information block, the typed name of the sender, nor anything else in this
message is intended to constitute an electronic signature unless a specific
statement to the contrary is included in this message. If you have received this
communication in error, please immediately contact me and delete this
communication from your computer. Thank you.</font> </font></p>
<p><font color="#808080">
<hr>
</font></p>
</div>
</blockquote></div><br>