Security and Tunneling Overhead

IPsec is an IETF protocol suite for secure transmission of IP packets. IPsec can operate in two modes: Transport mode or Tunnel mode. In Transport mode, encryption is applied only to the payload of the IP packet, whereas in Tunnel mode, encryption is applied to the whole IP packet, including the header. When the IP header is encrypted, the intermediate routers can no longer analyze and route the IP packet. Therefore, in Tunnel mode, the encrypted IP packet must be encapsulated in another IP packet, whose header is used for routing purposes. The new and extra header added in Transport mode means 20 extra bytes in overhead. In both Transport mode and Tunnel mode, either an Authentication Header (AH) or an Encapsulating Security Payload (ESP) header is added to the IP header. AH provides authentication only, whereas ESP provides authentication and encryption. As a result, ESP is used more often. AH, ESP, and the extra IP header of the Tunnel mode are the IPsec overheads to consider during VoIP bandwidth calculation. IPsec also adds extra delay to the packetization process at the sending and receiving ends.

Other common tunneling methods and protocols are not focused on security. IP packets or data link layer frames can be tunneled over a variety of protocols; the following is a short list of common tunneling protocols:

■ GRE—GRE transports Layer 3 (network layer) packets, such as IP packets, or Layer 2 (data link) frames, over IP.

■ Layer 2 Forwarding (L2F) and L2TP—L2F and L2TP transport PPP frames over IP.

■ PPP over Ethernet (PPPoE)—PPPoE transports PPP frames over Ethernet frames.

■ 802.1Q tunneling (QinQ)—An 802.1Q frame with multiple 802.1Q headers is called QinQ. Layer 2 switching engines forward the QinQ frame based on the VLAN number in the top 802.1Q header. When the top header is removed, forwarding of the frame based on the VLAN number in the lower 802.1Q header begins.

Whether one of the preceding tunneling protocols, IPsec in Tunnel mode, or any other tunneling protocol is used, the tunnel header is always present and is referred to as tunneling overhead. If any tunneling protocol is used, the tunneling overhead must be considered in VoIP bandwidth calculation. Table 1-8 shows the tunneling overhead—in other words, the tunnel header size—for a variety of tunneling options.

Table 1-8 IPsec and Main Tunneling Protocols Overheads

Table 1-8 IPsec and Main Tunneling Protocols Overheads

Protocol	Header Size
IPsec Transport Mode	30 to 37 bytes
With ESP header utilizing DES or 3DES for encryption and MD5 or SHA-1 for authentication. (DES and 3DES require the payload size to be multiples of 8 bytes; therefore, 0 to 7 bytes padding may be necessary.)
IPsec Transport Mode	38 to 53 bytes
With ESP header utilizing AES for encryption and AES-XCBC for authentication. (AES requires the payload size to be multiples of 16 bytes; therefore, 0 to 15 bytes of padding might be necessary.)
IPsec Tunnel Mode	50 to 57 bytes
Extra 20 bytes must be added to the IPsec transport mode header size for the extra IP header in Tunnel mode	or 58 to 73 bytes
L2TP	24 bytes
GRE	24 bytes
MPLS	4 bytes
PPPoE	8 bytes

If a company connects two of its sites over the public Internet using IPsec in Tunnel mode (also called IPsec VPN), you must be able to calculate the total size of the IP packet encapsulating voice (VoIP). To do that, you need to know the codec used, the packetization period, and whether compressed RTP is used. The fictitious company under discussion uses the G.729 codec for site-to-site IP Telephony and a 20-ms packetization period (two 10-ms equivalent digital voice samples per packet); it does not utilize cRTP. For IPsec, assume tunnel mode with ESP header utilizing 3DES for encryption and SHA-1 for authentication. The voice payload size with G.729 and 20-ms

packetization period will be 20 bytes. IP, UDP, and RTP headers add 40 bytes to the voice payload, bringing the total to 60 bytes. Because 60 is not a multiple of 8, 4 bytes of padding are added to bring the total to 64 bytes. Finally, the ESP header of 30 bytes and the extra IP header of 20 bytes bring the total packet size to 114 byes. The ratio of total IP packet size to the size of the voice payload is 114 over 20—more than 500 percent! Notice that without IPsec (in Tunnel mode), the total size of the IP packet (VoIP) would have been 60 bytes.

Continue reading here: Calculating the Total Bandwidth for a VoIP Call

Was this article helpful?

+3 -2