Home / server / Questions / 310592
Accepted
dannymcc
Asked: 2011-09-13 10:19:27 +0800 CST

Using IP phones over a VPN?

  • 772

We have a few small sites that each have a Draytek Vigor (various models) which are configured to create a company VPN. It's setup as follows:

Branch 1 (192.168.1.0/255.255.255.0) Accepts Incoming
Branch 2 (192.168.2.0/255.255.255.0) Dials Out
Branch 3 (192.168.3.0/255.255.255.0) Dials Out
Branch 4 (192.168.4.0/255.255.255.0) Dials Out

There is a IP phones system (BCM 50/Avaya) running in Branch 1 on 192.168.1.210. I would like to be able to put an IP phone in one of the other branches that will use the VPN tunnel to connect to Branch 1. I believe, from the engineer that installed it originally, that this is a common thing to do. However, all the documents I have read state that the Branches must be on different subnets.

So, how do I make the IP phone work if it's on a separate subnet? Would it work correctly if I manually set the IP of the phone to 192.168.1.XX from a Branch other than Branch 1?

vpn site-to-site-vpn ip phone

2 Answers

  1. Best Answer

    Sounds like you need a basic primer on how IP routing works.

    Yes, each branch should be on its own subnet. Without that, you'd have L2 broadcast domains spanning your WAN which could get, well, interesting.

    Do the IP phones all connect back to a central softswitch at Branch 1? If so, as long as your routing is set up correctly (either static or dynamic routes at all locations for all necessary subnets), then there's nothing preventing this from working just fine. Along with making sure routing is configured correctly, you'll need to make sure that your firewall ACLs allow the necessary traffic in both directions.

    The one thing that can typically make things difficult for VoIP on a segmented network is if NAT is happening. SIP (and several other VoIP protocols) do not typically play nice with NAT and usually require some tweaking of the IP phone config to get it working right. From your description, though, I doubt that NAT would come into play here.

    • 4

  2. from your branch configuration they are all in seperate /24 subnets, so thats not an issue.

    depending on your vpn configuration, it should simply be a matter of, giving the IP phone an IP within the subnet of the branch in which it is connected and telling it to connect to the IP of the VoIP system in Branch1, your vpn should automatically send out routes that will force this to pass over the vpn.

    easiest way to check is to confirm you can ping an IP (or the VoIP system) from the desired branch, if this is working then your vpn routing should be correctly configured

    eg, Phone in Branch 3 should have IP - 192.168.3.100 and told to connect to 192.168.1.10 assuming those are relevant IP's of the hardware

    • 1