VoICE over Wi-Fi: Too Green for the Enterprise

Everyone likes to get something for nothing, so the combination of Internet telephony and open wireless access can seem irresistible. Imagine a wireless phone that can work with networks all over the world, without needing a subscription to a service provider.

Sound good? Well, forget it--at least for the moment. VoIP over Wi-Fi is a budding new technology with a lot of potential, but it's not going to send cell phones to the landfill. Wi-Fi is still designed for the LAN, which makes Wi-Fi telephony a cordless phone technology--and one that's still immature. The IEEE 802.11 standards don't yet cover the QoS mechanisms necessary for high-quality voice, and no phones currently support 802.11i, the security specification that Wi-Fi telephony will eventually depend on.

Still, running voice over 802.11 can be a compelling alternative to cell phones. A TCO analysis by Network Magazine reveals that Wi-Fi telephony can provide significant savings for some organizations--specifically, those with at least 50 staff members who spend about half an hour each day talking on their cell phones, but only while within enterprise premises (see "Comparing the Costs" ).

That may sound overly restrictive, but Wi-Fi telephony will become more attractive as more advanced phones are released. Like wired enterprise VoIP, it promises increased productivity through convergence. The difference is that whereas regular VoIP improves enterprise telephony by integrating it with computers, voice over Wi-Fi improves it through integration with cell phones. Current Wi-Fi phones offer few advanced features, but the next generation could allow people to use a single number for both their office and cell phone, or to access smartphone functionality such as address books and text messaging while routing calls through the office PBX.

Network Magazine's own reader survey confirms what every 802.11 vendor is saying--namely, that voice over Wi-Fi isn't a mainstream enterprise networking technology now, but it could become one over the next two years. The majority of network managers building Wi-Fi networks say support for voice is an important factor in choosing equipment. That's because Wi-Fi networks designed now will have to work with a new generation of phones expected in 2005.Wi-Fi infrastructure vendors are obliging, developing new standards for QoS and shipping new products that allow for faster roaming. But building a wireless voice network isn't just a matter of putting up a few new access points (APs). It involves a complete new architecture that more closely resembles a cell phone network than traditional enterprise Wi-Fi.

BUY ONE, GET ONE FREE?

Just as with voice over regular Ethernet, the most straightforward argument for Wi-Fi telephony is that it can provide two networks for the price of one. This makes VoIP ideal for greenfield sites--and when it comes to cordless telephony, nearly every site is green. Because Wi-Fi telephony appears to require little new infrastructure, enterprises previously unable to justify a cordless telephony network can now do so.

This is true up to a certain point. If you already have a Wi-Fi AP and a VoIP service or PBX, it's likely that your users have experimented with putting the two together. It's also likely that those trials suffered from poor performance, even if the network was well-engineered for Ethernet voice or wireless data. This isn't because of the laptop or PDA softphones that the users were probably running, but because voice imposes unique requirements on a wireless network.

Although implementing either VoIP or Wi-Fi alone can be a daunting task, getting them to work together is even worse. Security and QoS top the list of concerns in our reader poll (see Pros and Cons on page 28), and it's easy to see why: Both are absent in current 802.11 telephony.Voice's strict latency and jitter characteristics mean that VoIP architects have already had to make changes to their networks, such as supporting packet prioritization at layer 3 and the Real-time Transport Protocol (RTP) at layer 4. Adding Wi-Fi requires similar changes at layers 1 and 2, but these are even more difficult to implement because every wireless network is forced to rely on shared media.

Likewise, most enterprise Wi-Fi networks only use enough APs to ensure that stationary users receive a signal wherever there are desks and chairs. Voice means mobile users will need a signal in the bathroom and the elevator, as well as the ability to roam between APs without noticeable delay.

NOT SO FAST

Most Wi-Fi APs and data NICs already support 802.11i, the IEEE's fix for the poor security in the original 802.11 specification. But most phones don't. They still rely on Wired Equivalent Privacy (WEP), which can be cracked in minutes using freely available software.

The problem is that phones are inherently less flexible than PCs and PDAs, so most can't be easily upgraded in software. This could continue to be a problem even when 802.11i-compatible phones are available. 820.11i relies on the Extensible Authentication Protocol (EAP), which itself offers several different types of authentication. A computer can be programmed to support any or all of them, but a phone usually can't. Wi-Fi phones need to be designed with a particular EAP type in mind, not just 802.11i itself.IT managers who need to support today's phones without leaving the network open have two options. One is to use Lightweight EAP (LEAP), a proprietary technology from Cisco Systems that's also included in phones from SpectraLink and Vocera Communications. However, LEAP requires Cisco APs and is vulnerable to offline dictionary attacks, in which an eavesdropper sniffs traffic and later compares it against a list of common hashes to determine a user's password. Cisco itself is in the process of replacing LEAP with Flexible Authentication via Secure Tunneling (FAST), a proposed standard based on 802.11i, though this is currently supported only by the company's data NICs, not its phones.

An alternative approach is to segregate voice and data traffic using VLANs, each with a different level of security. Pioneered by Aruba Wireless Networks and now offered by most other AP vendors, this is aimed at limiting (but not preventing) the damage that attackers can do. Unless a device has been authenticated properly and is using 802.11i, it will only be allowed access to the PBX, not the data servers.

This is acceptable to some organizations, especially hospitals. Cell phones can't be used around sensitive medical equipment, and the risk that someone will die due to an inability to communicate more than outweighs the theoretical risk that a war driver will make free phone calls. Even the poor protection offered by WEP is an improvement on traditional cordless phones, which often contain no security at all and can be overheard with a simple (but illegal) radio receiver. But most enterprises are better off using softphones that run on a PDA, or waiting for more secure hardware phones.

These are on the way. Cisco plans to upgrade its phone to support FAST by the end of 2004. In May, Motorola demonstrated a dual-mode GSM and Wi-Fi phone due to ship in early 2005. Dual-mode phones will be able to use the SIM smartcard that GSM networks rely on for authentication and key storage. In addition, Motorola's version supports EAP-TLS, the PKI-based authentication technology widely seen as the most secure implementation of 802.11i. (It's also the only one accepted as an RFC [2716], with the others still in the Internet draft stage.)

QUANTIFYING QUALITYThe biggest questions in Wi-Fi telephony involve call quality. Whereas security standards have at least been set, QoS specifications are still emerging. What's more, ensuring wireless voice quality involves more than just protocols and traffic prioritization. It also requires ubiquitous radio coverage and smooth handoffs between APs.

All Wi-Fi clients need to share the same airwaves, so some kind of traffic prioritization mechanism is a must for voice links. The most popular is SpectraLink Voice Priority (SVP), a proprietary protocol that only works with SpectraLink phones and requires the NetLink SVP Server, a management device that can prioritize up to 850 simultaneous calls.

To make SVP work with nonvoice devices, QoS needs to be enforced by APs so that voice is always given priority over data. Most enterprise-class APs made in the last year do support it, as SpectraLink licenses SVP free to AP vendors. Thanks to its heritage in non-IP cordless telephony, SpectraLink is such a dominant player in the Wi-Fi handset market that even competitors such as Cisco, Avaya, and Extreme Networks include SVP in their APs.

Still, SVP is unlikely to survive in the long term. The IEEE is developing its own QoS standard, 802.11e, which will go beyond prioritization. Instead of simply giving some packets preferential treatment, it will likely let APs provision bandwidth to simulate circuit switching. This proposal is somewhat controversial: 802.11 chip leader Atheros opposes it because it makes less efficient use of bandwidth than simple prioritization. However, the company has committed to implementing it if passed--something that seems likely given its support from Cisco. 802.11e will also add better power management, which isn't strictly related to QoS, but is helpful for VoIP because it makes the battery life of Wi-Fi devices nearly as long as cell phones'.

Vendor disagreements mean that the full 802.11e standard won't be ratified until mid-2005, but the part of it that handles SVP-style prioritization has been ready since early 2004. The Wi-Fi Alliance has branded this element as Wi-Fi Multimedia Extensions (WMM, also known as WME) and began certifying products for interoperability in August. The first of these should be shipping around now, which gives network managers planning Wi-Fi telephony another dilemma: Is prioritization good enough, or should they wait for bandwidth provisioning?The official spin is that WMM is sufficient for the relatively low data rates required by VoIP, with full 802.11e only necessary for fast "consumer" applications such as video streaming. However, this coincides suspiciously with the capabilities of existing wireless products. While most APs made in 2004 can support WMM either natively or through a firmware upgrade, they're not necessarily upgradeable to full 802.11e.

TREE TOPOLOGY

Most cell phone users don't need to think about which base station tower they're connected to. They expect to be able to move around and hand their conversations off from one antenna to another without any noticeable delay.

The same isn't true in Wi-Fi networks. In a traditional 802.11 system, changing APs can mean reauthenticating and obtaining a new DHCP address, a process that breaks Transport-layer connections and can require user intervention. The problem is exacerbated by Wi-Fi's short range. A person walking through a building may have to change APs every few seconds, whereas cell phone users can stay connected to the same radio tower for several minutes, even while traveling at highway speeds.

One solution is to use Wi-Fi switches to centralize control of APs. Invented by Symbol Technologies and improved by start-ups such as Trapeze Networks, Chantry Networks, and Airespace, Wi-Fi switches allow APs to be treated as little more than antennas. This is similar to the internal architecture of a cell phone network, which places relatively little processing functionality at each tower. It doesn't matter which particular AP users are connected through, as authentication and presence information is held at a switch further inside the network, not the AP.Switches don't eliminate the need for handoffs altogether. Unless every AP in a network is linked to the same switch, the switch will at some point need to transfer connections to another switch. Without such a handoff, networks suffer from what Proxim calls the lobby problem: As people enter a building, their connections are initially routed through whichever switch handles the AP closest to the front door. Unless they can be transferred seamlessly to other switches as they move to different rooms and floors, their traffic will continue to be routed through the lobby's switch all day.

The IEEE is working on a standard for handoffs known as 802.11r, but this is unlikely to be completed before 2006. In the meantime, every Wi-Fi vendor will continue to use a different proprietary mechanism, forcing network managers to build their networks from a single vendor's switches. And since there are no standards for connecting switches to APs, they'll also need that single vendor's APs, too.

The notable exception is Cisco, which can't do interswitch handoffs at all. In Cisco's defense, its switch is so large that few customers need handoffs. It supports up to 300 APs, 10 times as many as some of its competitors. But it also costs at least 10 times as much, though thanks to a modular design it can be used for other functions such as routing and Ethernet switching.

Most networks don't yet have enough APs to require Cisco's giant switch or its competitors' handoff schemes, but VoIP might push them closer to that point. This is because voice usually requires wider coverage than data. Though people don't often surf the Web in corridors or elevators, they expect their phones to work everywhere.

Improving coverage entails more than just buying APs and switches. It also means redesigning the entire network, as most vendors require adjacent APs to use different radio channels to avoid interference.Many of the switch vendors provide sophisticated site survey software that can help with this, using APs to measure each other's signal strength and mapping the results to building blueprints. But this doesn't solve the fundamental problem, which is that there aren't enough radio channels in the 2.4GHz band for a dense cluster of APs.

Wi-Fi networks can also use the 5GHz band, which has many times more channels and so lets APs be placed much closer together. However, none of the shipping Wi-Fi phones support 5GHz. The first to do so will be Motorola's dual-mode GSM and Wi-Fi handset, which will only work with Wi-Fi and VoIP infrastructure from the company's partners, Proxim and Avaya.

Start-ups Meru Networks and Legra Systems have both developed technology that allows adjacent APs to use the same radio channel, meaning that a 2.4GHz network can be made as large or as dense as necessary. These systems work in the same way as 3G and CDMA cellular networks, allowing users to be connected to more than one AP at a time.

Other vendors recommend standardizing on 5GHz for voice and 2.4GHz for data. This is possible, as most APs now contain two radios and can thus support both simultaneously, but it's too inflexible. In the long term, nearly all Wi-Fi networks will use the 5GHz band for both voice and data. In the short term, 2.4GHz is required for backward compatibility.

HOME DELIVERYVoice's unique requirements makes using VoIP in a Wi-Fi hotspot or on a free network challenging. To make it even harder, most commercial hotspots require users to authenticate using a Web browser, something no Wi-Fi phones have. Many free networks are beginning to follow suit, asking users to click through end-user license agreements that promise they won't use the hotspot for spamming, illegal music sharing, or other activities likely to cause trouble for the owner.

This doesn't mean that Wi-Fi phones are only of use in enterprise premises. Employees may also find them useful when working from home.

Cordless phones have been popular among consumers for years, but have recently become less useful as they contend with interference from home data networks. Vendors see Wi-Fi telephony as a way to avoid interference by bringing voice and data together.

VoIP provider Vonage has already partnered with home networking vendors Linksys and Netgear to sell Wi-Fi routers with VoIP capability. So far, these are limited to wired telephony. The routers have phone jacks so that people can use ordinary analog phones with a VoIP service. However, Vonage plans to start selling its own Wi-Fi phones this month, which are designed to work with Netgear's routers.

The Vonage phone is, of course, intended for users of Vonage's own residential phone service, but Linksys and Netgear are both interested in supporting other handsets and services as well. A VoIP service is simply a server somewhere on the Internet that provides an interface to the PSTN, so it can also be provided by an enterprise IT department rather than a carrier, enabling employees to make and receive calls through their office PBX while at home.Some employees might object to being contacted at home, and some enterprises might object to letting people run up the company's phone bill while out of the office. But these problems aren't unique to Wi-Fi telephony, as company-supplied cell phones suffer from the same issues.

BUY NOW, PAY NOW

Improved productivity is nice, but it's not the biggest driver for Wi-Fi telephony. According to our reader survey, the main business case is simply the ability to save money on cell phone bills.

Wi-Fi telephony once seemed particularly attractive for internal calls, as these could avoid the public network entirely, but the cell phone industry is fighting back. Its main weapon is Push to Talk (PTT), a simulated walkie-talkie developed by Nextel, but now offered by Verizon and planned by others. PTT provides unlimited free and instant calling to groups of people within a local geographic area, such as employees in an office. This eliminates some of Wi-Fi's cost advantages, but not all of them.

A TCO analysis shows that, compared to PTT, VoIP over Wi-Fi can offer significant savings to some enterprises. The precise crossover point depends on the number and type of calls, but usually occurs when the number of users exceeds about 50. The main savings are in international calls and cellular subscriptions, as a large number of users can share several access lines.Large organizations are also favored by the high initial costs of Wi-Fi telephony. The cell phone industry is structured around a "buy now, pay later" model: Carriers subsidize the cost of handsets, often promoting them as "free." In exchange, customers are locked into long-term service contracts with heavy cancellation penalties. Though targeted mainly at cash-strapped consumers, this also appeals to businesses that need to minimize their capital expenditure. Nextel advertises PTT phones for as little as $25 each, with its monthly service plans ranging from two to 10 times the phone's initial cost.

In contrast, building a Wi-Fi telephony network is extremely capital-intensive, requiring investment in hardware, software, and manpower. This makes the cost of capital and the expected payback period an important consideration when choosing between cellular and VoIP over Wi-Fi. All other things being equal, Wi-Fi telephony will cost a lot less to an organization with a triple-A credit rating than to a young and desperate start-up.

Surprisingly, users who make a large number of long distance calls won't see a significant savings from wireless VoIP. This is because cell phones become cost-competitive with landline telephony when used with plans that offer several thousand inclusive long distance minutes. The long distance portion of a call costs the same for both and is often carried over IP, but it's easier to increase access network capacity by sticking up a new radio tower than by laying more cables to every subscriber.

PRESENCE IN FUTURE

The best candidates for Wi-Fi telephony are enterprises that already have an IP PBX. That's because IP PBXs don't care whether arriving packets come from a Wi-Fi or an Ethernet phone, so they can be used without modification. It's also possible to use Wi-Fi telephony without wired VoIP. SpectraLink has been selling cordless phones since before most enterprises even heard of VoIP, using gateways to route calls to a traditional PBX. It offers similar gateways for use with its Wi-Fi VoIP solutions.However, the most promising new features of wireless VoIP will depend on 802.11-aware IP PBXs. These could add a user's physical location to the data in a presence server and automatically transfer calls from a Wi-Fi phone to a desktop phone when a user sits down at the desk. Cisco and Avaya both plan such systems--Cisco using its own phones and APs, and Avaya through partnerships with wireless vendors such as Motorola, Proxim, and Extreme.

This kind of functionality hasn't been implemented in either phones or PBXs yet. But by designing Wi-Fi networks for voice now, IT architects can avoid costly forklift upgrades when the time does come.

Andy Dornan, chief technology editor, is author of The Essential Guide to Wireless Communications Applications, ISBN 013-0097-187. Reach him at [email protected].Comparing the Costs

A cost comparison between Wi-Fi telephony and cell phones depends on many factors, the most important of which is the number of users. As the graph shows, the total cost of Wi-Fi telephony is less dependent than cell phones on this, making it more suitable for larger networks in general. This theory is backed up by empirical data from Network Magazine's survey, which shows that the larger the organization, the more likely it is to be using, testing, or considering wireless VoIP.

The other factors included in the graph are listed in the table. As it shows, the cost of cell phones is relatively easy to calculate. The most difficult part is choosing a service plan, which requires estimating the number of local, incoming, or long distance minutes needed. Additional minutes tend to be billed at a very high rate, so it's nearly always better to overestimate and "waste" minutes than face overage charges. The graph and table assume a Nextel plan that includes 500 minutes per month, plus unlimited internal calls.The calculation for wireless VoIP is more complex, depending on an enterprise's existing network and building architecture, as well as user requirements. For decades, the telecom industry has relied on a set of equations known as the Erlang formulas to estimate how many access lines a PBX will need for a given traffic load and QoS. Erlang calculations usually require dedicated software, though Web-based versions are now available at sites such as www.erlang.com. The equivalent for wireless networks is much worse, as these calculations also need to factor in radio interference and the need to provide coverage in areas that only contain users some of the time. This makes it a process of trial and error.

In the graph, access lines are overprovisioned to handle twice the average external call load, and AP voice connections are overprovisioned to handle 10 times the average total call load. This can seem high, but there are still fewer APs than users, as each AP is assumed to be able to handle five simultaneous calls, and most users spend only a small proportion of their total time on the phone.

(Visit www.networkmagazine.com/tco/vow/ for help in customizing both to your own requirements.)

Risk Assessment: Wi-Fi Telephony

Enterprise VoIP is immature. Wi-Fi is immature. Put them together and you get twice the hype and more than twice the problems to be worked out. Most Wi-Fi phones don't yet support 802.11i or EAP, and the IEEE is still arguing over a QoS standard.Many of the technical problems involved in running voice over Wi-Fi have been solved: Hospitals already use Vocera, SpectraLink, and other proprietary systems in life-and-death situations every day. The challenge is making the technology cheap enough to be cost-effective in less-critical situations, as well as simple and reliable enough to attract cell phone users.

Cordless telephony is hardly revolutionary, but the combination of VoIP and Wi-Fi could still have an enormous impact. It's a vital requirement in seamless mobility and might eventually form the core of fourth-generation mobile networks. In the meantime, Wi-Fi telephony is even benefiting enterprises that don't use it by spurring cellular operators to roll out services such as PTT.

With most Wi-Fi vendors now touting voice, there's little extra cost in choosing equipment that can support it. To future-proof your network, use Wi-Fi switches with WMM capability and fast interswitch handoffs. But don't invest in phones themselves until they support 802.11i: Without it, you're taking a big security risk.