Separate Your Traffic

When a virus hit the network at Worcester Polytechnic Institute (WPI) in 2004, the university’s VoIP-enabled phone system didn’t suffer. That’s because Tom Lynch, vice president of IT and CIO, and Sean O’Connor, director of network operations and security, understood that security planning was key to maintaining a reliable VoIP network. O’Connor and Lynch have spent the past year testing a Nortel VoIP system that will allow students and faculty studying abroad to communicate with the school via their laptops. The school is also migrating part of its on-campus phone network to VoIP, although for the moment it plans to maintain a hybrid system that will combine the new technology with the old by integrating the VoIP services into the college’s legacy Nortel PBX.

In addition to putting up multiple application firewalls, O’Connor and Lynch set up a virtual LAN for voice traffic to help protect it from viruses that could hit the data network. So when that virus hit the campus last year, it never made it onto the VoIP system. "The key is to separate the voice traffic from everyday Internet traffic," says O’Connor. A virtual LAN (VLAN) can protect voice traffic by setting aside a certain amount of bandwidth and separating voice and data by creating "logical barriers."

Bill Ashton, director of IT for the town of Herndon, Va., feels comfortable with his recently installed VoIP systems in part because he too has VLANs. Ashton recently moved six town facilities and 160 employees to VoIP telephones and plans to roll out VoIP service to the town’s public safety department this summer. However, 911 calls in Herndon will remain on analog lines to keep the call center infrastructure consistent countywide. Public safety officials have expressed concern that calls via a VoIP line may not always reach 911, and that 911 dispatchers cannot trace the location of people calling on VoIP. In early June, the Federal Communications Commission issued rules that will require VoIP service providers to warn consumers their calls may have trouble reaching a 911 operator.

Emergency services aside, Ashton says he believes VoIP is safe if installed with care. "There will be hacker attacks down the road, so it pays not to cut corners," he says. "If there is one thing I could get fired for, it would be if The Washington Post reported that our public safety system has problems."

VLANs, firewalls and gateways can keep intruders out of the VoIP system, but they don’t protect against internal hackers. To add another layer of security to a VoIP system, users should encrypt the "packets" just as they do with data networks. Encryption is important regardless of the protocol being used. (The two main protocols are Session Initiation Protocol, or SIP, and H.323.)