> I was unable to get this to work by using queues, but by giving SIP it's
> own dedicated pipes, I was able to isolate it from IPSec.  The downfall
> to this approach is that if that pipe isn't being used for SIP, it
> doesn't get used for anything else either.
> 

This is why we need OpenBSD's PF with its nice "borrow bandwidth"
feature ;-)

-- Vincent