1

Greetings all,

The company i work for has been looking into replacing our old digital phones with a VOIP setup. The owner has been going back and forth with the two companies, and has decided to go with the company offering the Samsung Officeserv7400, over the Mitel 5000 (Not sure about the specific Mitel model).

Both companies offered to setup new Cisco 48 Port POE Switches for us, as well as a new router (Currently, the main IT guy has had us on unmanaged Netgear switches, and a Netgear router).
Anyhow, they are going to handle setting up the Router and Switches for us, as well as setting up and training myself (I will be handling the phone system myself, and as I’m working on my CCNA right now, with plans to finish it up by summer, I’m going to be hopefully taking over the networking side as well, so bring as much inside the business as possible).

Anyhow, i had a few questions i wanted to run past people with more experience and knowledge than I have up to this point.

They have proposed using a Cisco RV320 router for our office. We don’t have a separate Firewall, and they didn’t propose adding one. I’ve heard good things about the ASA Cisco Firewalls, as well as Sonicwall. I wouldn’t be opposed to adding one, but the issue becomes needing them to either perform the initial configuration, or doing it myself. I would be more than happy to learn and configure a Firewall on my own, but for the type of information and work that we handle (We are a Medical billing company, so I’ve really been trying to do as much as I can to revamp and check our HIPAA compliance and security in general. I don’t care as much about the fines as I do not wanting someone’s life ruined just because myself or other didn’t put in the effort of checking and re-checking every little detail possible). Anyhow, we have 5 VPN connections, as well as 3 to 4 people who connect through a Terminal Server to get remote desktop access for work from home. That could all possibly grow in the future, as the company has easily grown from about 20 people when i joined on 2 years ago as a data entry person, to now, where we are at 105.
We do have a decent amount of traffic that will be moving through it. We have our E-mail server that some companies use to send large PDFs from time to time, as well as our FTP, and the users who are frequently using the internet to search for information, download large PDFs and other files from Insurance companies, and the usual people streaming youtube or music on their lunch breaks. I just want to make sure that the router they proposed won’t leave us exposed in terms of security, or under-served in terms of performance. I’m trying to plan for a 50% growth by next winter, as a ‘worst case’ if we were to open a new office across the hallway.

In terms of the phone system, it appears that phones only handle Fast Ethernet connections, which the Mitel vendor had noted, since the Mitel IP phones have gigabit jacks to work with. I was reading it, and I didn’t think that would be an issue. Even moving voice data, PDFs, spreadsheets, Word documents, and e-mails, I just don’t know that a system would routinely push to the absolute limits of a standard Fast Ethernet connection. But, as I said, I’m definitely still learning all of this stuff, so I wanted to ask people who know better than I do.

TL;DR: Would a RV320 router provide adequate protection/functionality for an office of 100 users with frequent e-mail use, web use, and generally hefty downloads of PDFs.

Is a gigabit connection from wall to phone, then phone to computer really a potential bottleneck, or just something that sounds nice, but is likely to never be fully used.

P.S. I’m going to have them make sure they get us VLANs just to keep the traffic segregated, and then QoS to ensure that voice traffic gets priority in the event that we do start bottling up connections on the network.

Thanks, everyone! I appreciate any help you all can give me on this. I’m really thrilled that the owner trusts me to take on a project like this, and handle a system this important to our company, so i don’t want to advice them on something that can’t handle it, but at the same time, I don’t want them throwing money away on flashy things that are nice, but likely to never be fully used.

1 Spice up
2

Remote from home is where I would be worried. As far as firewall goes pretty simple to setup. The rest of your plans look good to me. It is just that remote thing to do work from home I would be worried about. All your security and your firewall setting broken by someone uses the home pc and gets a worm and transmits it into your network threw that remote connect. If you can sandbox those pc’s that ware used from the outside that would make me feel better. EEEK utube and streaming. That ftp is an upload only… FTP very insecure, I would look into some type of drop box setup(Long description on this setup). Congrats on the job and keep up the planning. What are you plans for backup and disaster? Are you responsible for that? Where will you keep your configs? Will you install a dial up line for fail over? Does your ISP offer some type of WIFI uplink as a fail over? How will you take care of an outage?

1 Spice up
3

Oh, the backup disaster situation is…well, a disaster. Our main guy is generally out of country most of the year. When i got brought in, we were way smaller, so i was just going to assist here and there, as I was interested in picking up IT. Well, fast forward two years, and I’m working a lot with our servers (Equally frustrating, as we have nice equipment, but nothing is really specialized. We have Server 2012 R2, but not even simple things like groups, or anything involving GPO to make things easier for setup and running). The servers are on my list of things that I may just try and do a complete re-design of, just start from the ground up, and move any needed data over.

Backups are something I’ve never been filled in on. I know we have some, but I don’t know where/how they are accessed. The main guy is supposed to be in town soon, so if i can get some time, I’m going to try and stress how important it is (Not just for HIPAA compliance, but for keeping the company up in an emergency) that we have a well-documented and tested backup/recovery plan in place.
I don’t want to be trying to get a hold of someone in a timezone 10 hours ahead of me, at 8am, hoping they pickup their phone because the folding table they put our 3 servers on failed overnight, and dropped all 3 servers on the floor, breaking the VMWare server, and leaving us with a mystery backup and recovery situation.

I’ve been working on finding a solid AV system as well. I’ve been working on training our users, as well as putting together a handbook/presentation for the new users that will help cover basic computer use, and how to help keep things safe.

The problem has been that we look pretty much like you would expect a company with no set IT department to look (Even up until 1 month ago, all of my IT work was on the side of my insurance work, it’s just become so busy lately that I don’t get to even touch the Insurance anymore). Everything is messy, disorganized, and just pieces together. I’ve got plans to change it, but the learning it will take to do that definitely won’t be an overnight process. I’m hoping to nail the CCNA by summer, so any pop-up issues with the network can be resolved without waiting on phone calls/e-mails when possible, and then I want to start in on Server certification so I can feel confident in completely re-doing our servers, and providing a new and better functioning experience, especially for remote users (They log into a virtualized copy of Terminal Services running on Server 2003, or SBS, can’t remember specifically. But, it’s a lot of headaches for them).

4

We are using Cisco phones with a 1GB link from the wall to the phone then the phone to PC without any issues. Definately no bottleneck. Most users only use 1% or less of the available bandwidth.

1 Spice up
5

Well server 2003 you will run into PCI issues real fast os not supported any more. The dial up was for you to gain remote access to your switch if you ever need to access it.

1 Spice up
6

Yeah. I’ve been looking at replacing the 2003 setup entirely. But, as I’m definitely new to the server work, setting up a brand new Remote Desktop setup would definitely be advanced, to put it lightly.

Does the Gigabit on the VOIP phones seem like a real need, or just a company trying to oversell a product?
My understanding definitely may be incorrect, but most computers come with standard Fast Ethernet NIC capabilities. So, even if we ran Cat6 from wall jack, to phone, to computer, the gigabit connection in the phones would be moot, because the computers, even if they did produce that much data at once, wouldn’t be able to move all of the data at once, due to their Fast Ethernet NIC.

They also mentioned Samsung phones not having Full Duplex speakerphones, but that seems to be a bit of a moot point as well, since no one at their desks uses their speakerphone, and any conference room phone would likely be purchased with Full Duplex capabilities.

Thanks, everyone!

7

Not sure how much experience you have with VoIP, but for 100 users, it might be worth it to bring in a consultant for the implementation as there is a lot involved with this type of implementation.

1 Spice up
8

Oh, this is my first time with it. We have a company that’s going to setup the switches, router, and phone system. I’m just going to be in charge of it once it’s in, after going through some training with the company.

We have the quotes and everything, for the system, phones, and whole setup, I just want to make sure that I’m getting as much 2nd opinion on it as possible. They traditionally work with offices a bit smaller (20 or so people, though i think that they have handled a bigger phone setup, for a telemarketing office.

I’m mostly just doing what I can to make sure that they aren’t possibly overlooking anything (The first offer one of the companies proposed was without any switch or network upgrades, which while possible that it would have worked with our old unmanaged Netgear devices, may have left us in a tight spot if the VOIP and data were running into a lot of collisions and loops).

I think between the router, switches, Cat6e cabling in the building, and the new phone system and training, we should be okay, I just want to make sure I cover all of the bases before the owner makes a final decision.

9

I manage the network for a medical clinic, too, and we abide by HIPAA regulations. You can configure your firewall to scan client VPN machines prior to establishing a connection. I currently use Fortigate 620B firewalls and have our VPN set up this way. It ensures all clients connecting to our health records remotely are sanitized prior to access. Additionally, I installed a Nessus vulnerability scanner to scan medical clinic PC’s weekly for any HIPAA files that shouldn’t be there.

As for your VoIP implementation, Mitel is a great solution. We have Mitel VoIP solution. If the model phone you’re getting supports Gig, you should get Gig switches, too. I’m running 2960X switches in the access layer and I’ve yet to see a user come close to maxing their interface bandwidth. I originally had a CoS policy in the access layer to prioritize VoIP, but got rid of it because it wasn’t necessary. I have a QoS policy for management traffic at the distribution layer since our uplinks to the core can get congested.

As for firewalls, if you don’t have one, get one! The ASA is a good product as long as it has the features you need. If you’re looking for a firewall and no other security features, this may work for you. You should also consider an intrusion prevention sensor, antivirus scanner, and email firewall (if you’re hosting your email server). Attacks are getting much more sophisticated and malicious traffic can easily slip past a firewall.

2 Spice ups
10

The RV320 will handle 100 users. It has dual Gig interfaces so the bottleneck will probably be your Internet circuit. What’s your Internet circuit bandwidth? Are you planning on creating VLAN’s on the router? If so, keep in mind it supports a maximum of seven VLAN’s. It also has an SPI firewall feature which is nice, but supports a maximum of 50 rules. If you envision your VPN use growing, the RV320 can handle a maximum of ten SSL VPN connections.

1 Spice up
11

Hi Aaron,

Don’t worry, you are not the only IT Pro that isn’t particularly comfortable around phone systems. Voice is often the thorn in the side of many of even our most savvy clients.

Are you planning on connecting the Samsung 7400 with SIP trunks or PRI? I might have some ideas on technologies you should explore, depending on which access method you plan on using.

Overall, it sounds like your owner is set on the Samsung system but considering how fast you are planning on growing, did your company consider using a hosted system? I know that system can potentially grow to nearly 500 seats but your needs in terms of features/functionality might also change as you grow and sometimes companies find hosted systems much more flexible when they are changing this rapidly.

@AeroCom_Inc

1 Spice up
12

I’m assuming that having the Fast Ethernet ports shouldn’t be an issue. With QoS in place, the VOIP traffic shouldn’t be interrupted, and i doubt users would notice having to wait an extra second or two when waiting for a PDF or E-Mail to load.

13

That all sounds really helpful. I will definitely look into that. I’m checking into the Nessus as we speak. I’ve been trying to push for more security and protection (our current setup is just not even close to adequate, which is not something you want to find out because a hacker helps you see the light). I’ve been pushing for a completely re-done security setup, better disaster recovery that doesn’t rely entirely on someone that is at a bare minimum, 32 hours away from getting here, at a bare minimum, which assumes that the minute we notice (Without proper logs, and systems setup, that could be hours late), contact him, he is able to immediately book a flight, get on it, and arrive here without issue. That could be 32 hours, or it could be 3 or 4 days. If it’s a complete shutdown, we could be down for almost a week.

System-wise, I was leaning towards the Mitel system. The only problem with that was more that the company providing it hasn’t been too reliable for us. They provide our current digital phone setup, and if it weren’t for their one technician who has been helping our owner for the past 10 years or so, since she was running it out of her basement, they probably wouldn’t even be in the conversation.
The owner seems to be leaning towards to Samsung system, if for no other reason than the company seems to be really wanting the business, and knows a lot about the Samsung system. I think the Mitel would be more preferred, but I don’t know that any potential differences in abilities and performance would be enough to negate the Samsung system with better support.

14

I have looked into them. Unfortunately, I don’t know that I feel comfortable enough completely diving into a self-supported phone system. Maybe after a few years we could have something that we buy, install, and manage ourselves. I would definitely want a more reliable network, but I’m hoping that after a few years I can definitely put my stamp on this place and get everything working and running reliably.

1 Spice up
15

Understood. Are you thinking of SIP or PRI to connect the Samsung, or are you undecided and need some guidance on the differences?

16

Sorry, completely forgot to address that.
Currently, we’ve got 1 PRI line that we connect through. I believe the owner has said we’re likely going to expand to 2 PRI lines, and has already run it through our ISP to make sure they’re ready.

1 Spice up
17

Currently, we’ve got 1 PRI line that we connect through. I believe the owner has said we’re likely going to expand to 2 PRI lines, and has already run it through our ISP to make sure they’re ready.

You may want to consider using two telecom carriers (each providing a single PRI and then failing over to one another). In the past we’ve often done this for clients and it’s given them awesome redundancy that you can’t get with a single PRI and back-up POTS lines. If your traffic is fairly evenly distributed, you can put your inbound traffic on one PRI and your outbound on the other, then have each configured with a trunk overflow feature, pointed at the other circuit.

Let me know if you’d like a quote on this config from a few great PRI providers, in addition to your current ISP.

PM me if you’d like more info or check us out at www.aerocominc.com .