Enterprise VoIP

Voice quality is
an engineering problem.

Poor call quality isn't random — it's the result of predictable, fixable infrastructure failures. We engineer VoIP from the network up: VLAN isolation, QoS policy, encrypted signaling, SBC, and RTCP monitoring on every call.

99.9%
Uptime Target
<150ms
One-Way Latency
AES-256
SRTP Encryption
The Problem

Bad call quality isn't bad luck.
It's bad infrastructure.

Most business VoIP deployments hand you a SIP credential and leave. Everything else — QoS, firewall rules, VLAN, SBC — gets skipped. The symptoms are predictable.

One-Way Audio
NAT misconfiguration or enabled SIP ALG causes SIP and RTP to take different network paths. One end can't hear the other.
Choppy / Robotic Voice
No QoS means voice packets queue behind file uploads. Jitter exceeds buffer depth — the codec drops frames and interpolates, producing audio artifacts.
Unencrypted Calls
Default SIP deployments send signaling and media in plaintext. RTP can be intercepted and played back with freely available tools.
No SLA or Monitoring
Without RTCP metrics collection, you don't know call quality is degraded until a client complains. By then, the damage is done.
Dropped Calls on Busy Networks
No bandwidth reservation means a single video download during a client call can degrade MOS from 4.4 to below 3.0 — audibly unacceptable.
Phones on the Wrong VLAN
IP phones on the same Layer 2 segment as workstations expose VoIP infrastructure to broadcast storms, ARP spoofing, and rogue DHCP.
Architecture

Two protocol streams.
Both engineered correctly.

VoIP is two separate flows — signaling and media — that must each be handled by the network. We engineer both, independently.

IP Phone / Softphone
SIP User Agent
Voice VLAN · LLDP-MED
→
Fortinet FortiGate Firewall
QoS + NAT + Policy
DSCP EF · SIP ALG disabled
→
Session Border Controller
B2BUA · NAT traversal
Topology hiding · CDR
→
SIP Trunk (ITSP)
PSTN Gateway
SIP/TLS · SRTP
SIP Signaling
DSCP CS3 (24) · TCP/TLS · Port 5061
Call setup, codec negotiation (SDP), call teardown. Text-based, similar to HTTP. Encrypted with TLS. Relatively low bandwidth — a few KB per call setup.
RTP Media Stream
DSCP EF (46) · UDP/SRTP · Ports 10000–20000
The actual voice audio, 50 packets/second at 20ms intervals. Real-time — cannot tolerate retransmit delays. Encrypted with SRTP. ~85–90 kbps per concurrent call (G.711).
QoS Policy

Voice gets the fast lane.
Every time.

Quality of Service ensures voice packets are processed before file transfers, video streams, or anything else on your network — regardless of link utilization.

Traffic ClassDSCPQueueBandwidthPolicy
Voice (RTP) EF — 46 LLQ Strict Priority
20% max 		Always first. Strict priority queue. Capped at 20% to prevent starvation.
Video / Conferencing AF41 — 34 CBWFQ Assured
30% reserved 		Assured bandwidth for conferencing tools. Elastic up if voice unused.
Business Apps AF21 — 18 CBWFQ Weighted
35% weighted 		Interactive applications. Weighted fair queuing. Higher weight than bulk.
Best Effort (Bulk) BE — 0 Default Queue
15% residual 		File sync, backups, updates. Shaped to residual bandwidth only.
Security

Three independent
security layers.

VoIP is a high-value attack surface — SIP scanning, toll fraud, and call interception are real threats. We engineer defense at three independent layers.

Encrypted Media — SRTP
The audio stream is encrypted with SRTP (AES-256). Key exchange via DTLS-SRTP provides forward secrecy — compromise of one session's key does not expose any other session.
Voice VLAN Isolation
IP phones live on a dedicated VLAN, hard-separated from workstations, servers, and guest Wi-Fi at Layer 2. DSCP EF is only trusted from phone MAC addresses registered in the switch policy.
Encrypted Signaling — SIP/TLS
All call setup traffic travels over TLS (port 5061). Call metadata — who called whom, when, for how long — is never sent in plaintext. Certificates verified against our SBC.
Firewall Policy
SIP ALG disabled — it breaks modern SIP. Explicit permit rules: SIP/TLS to SBC public IP only; RTP port range (10000–20000) to SBC media IP only. All other inbound SIP dropped.
Session Border Controller
SBC sits at the network edge, terminating both SIP legs. Topology is hidden from the ITSP. The SBC enforces codec policy, blocks SIP scanning, and rate-limits INVITE floods.
RTCP Monitoring & MOS Scoring
RTCP receiver reports collected every 5 seconds per call. MOS scored per session. Alerts trigger if MOS < 3.5, jitter > 30ms, or packet loss > 1%. You know before your clients complain.
Call Quality

Every metric tracked.
Per call.

Every call generates measurable data. We collect it, score it, and report it monthly — so quality is managed, not guessed at.

MetricWhat It MeasuresAcceptableOur Target
MOS ScoreMean Opinion Score (1–5 scale)> 4.0> 4.3
JitterRTP inter-arrival variance< 30ms< 15ms
Packet LossUnrecovered RTP frames< 1%< 0.3%
Round-Trip LatencySIP OPTIONS ping / RTCP< 300ms< 160ms
Post-Dial DelayINVITE to 200 OK< 4s< 2s
Registration FailuresSBC registration monitor00

ITU G.114 target: <150ms one-way. Our target for local SIP trunks: <80ms. All metrics stored per session for trending and monthly reporting.

What We Deliver

Full engineering stack.
Not just a SIP credential.

Every VoIP engagement includes the complete set of infrastructure work — designed and documented, not assembled and forgotten.

Voice VLAN Design
Dedicated Layer 2 segment for IP phones with PoE switch, LLDP-MED phone detection, and DHCP option 66 auto-provisioning.
QoS Policy (SRX)
DSCP EF marking and strict-priority queuing on WAN egress. Voice capped at 20% of uplink — protected without starving data.
SIP TLS + SRTP
TLS on port 5061 for signaling. DTLS-SRTP for media with forward secrecy. SIP ALG disabled. Firewall rules scoped to SBC IPs only.
Bandwidth Calculation
~90 kbps per concurrent G.711 call. We size your uplink reservation to your peak concurrent call count — never guesswork.
Session Border Controller
SBC terminates ITSP leg, re-originates internal leg. Solves NAT traversal, hides topology, enforces codec policy, enables CDR.
RTCP Monitoring & Reporting
Per-call MOS scoring from RTCP-XR data. Alert on jitter > 30ms, loss > 1%, or MOS < 3.5. Monthly report with trends and capacity utilization.

Ready for calls that
actually sound like calls?

We start with a network assessment — firewall, switches, uplink capacity, existing phone system — and deliver a written VoIP design within 48 hours of the site survey.

Schedule Network Assessment View Managed Service Tiers