Inside Networking
September 2001
 

Tony Rybczynski

Navigating A VPN Roadmap

BY TONY RYBCZYNSKI


The traditional approach to enterprise networking based on private lines has largely given way to various forms of Virtual Private Networks (VPNs) running on some form of packet network. Even large enterprises running converged private networks have complemented these with VPNs. Some VPN technologies have been around for more than a decade, as has been the case for frame relay and ATM. Others such as remote access VPNs have ridden on the Internet wave. Yet others are relatively new, as is the case with Virtual Private Ethernets and Virtual Private IP Nets. All of these have been driven by the growth of data traffic, most recently IP-based and originating on an Ethernet LAN.

Infonetics predicts that the service revenues in the VPN market will increase six fold to $35 billion by 2004. In many cases, voice networking has been left "off the table," being very cost-effectively handled by legacy circuit-switched voice VPN services. That said, all the VPN technologies have evolved to include "voice-over" capabilities. A VPN roadmap should assist enterprises in navigating through these options.

VPNs DEFINED
VPNs have a common characteristic. They all provide some form of secure segmentation of the public network for an enterprise's own use. This segmentation can be done on a configured basis, as has been done when using frame relay or ATM permanent virtual circuits, or on an as-needed basis by dynamically establishing IP tunnels over the Internet or private labeling Ethernet frames received from a customer. While connectivity is a primary feature of public service offerings, enterprise requirements for Service Level Agreements (SLAs), and the service provider's need to differentiate their services, have led to the development of more comprehensive service definitions, including specification of reliability, throughput, and delay.

VPNs serve various purposes. They can be used for inter-site connectivity, the traditional realm of private networks, or for secure access for employees working from home or on the road, traditionally served through switched access into modem pools. These later environments have not stood still (in more ways than one) with users demanding access through high-speed Internet (e.g., cable modems and DSL) and wireless (e.g., PDAs). In addition, business imperatives have dictated the opening up of the enterprise networks in a controlled fashion to partners and for B2B communications.

PRIVATE LINE EMULATION
With the dominance of private line networks in the 1980s, it was reasonable that the first VPN services were based on the concept of emulating these private lines using what are called virtual circuits, first in the form of frame relay and then extended to higher speeds via ATM. Just like physical circuits, virtual circuits were preconfigured on a point-to-point basis.

Much of the class-of-service richness of ATM has not played a role in VPN services, since frame relay was the lowest common denominator. As a site-to-site VPN service, frame relay and ATM have served the multiprotocol LAN and legacy world well, but convergence on IP as the networking protocol of choice, on Ethernet as the LAN technology of choice, and maturing of the Internet has created new VPN categories.

TUNNEL VISION
The ubiquity and cost structure of the Internet make it very attractive to reach millions of customers across the globe, ideal for keeping connected with employees wherever they may be, and for new remote offices that require instant connectivity. It's also ideal for ad hoc networking with partners, where these partners change frequently in response to business needs. In these cases, the advantages of Internet ubiquity and low cost far outweigh lack of consistent performance and the overheads associated with tunneling and firewall management.

The above created a new category of Internet-tunneled VPNs. These entailed taking IP traffic originating in a remote office, employee's home, hotel room, or car, and creating secure tunnels across the Internet with an enterprise central site "extranet switch" providing tunnel termination. Security is addressed through user authentication and encryption mechanisms such as IP Sec, and through personal or small office firewalls. Internet-tunneled VPNs initially applied to dial-up modem scenarios with ISPs providing local modem pools, bypassing expensive 1-800 services used by enterprises. This solution naturally evolved to environments with remote users using cable modems and DSL always-on services. Internet-tunneled VPNs also allow partner access and B2B networking via secure extranets, most often using a PC-based soft VPN client. Putting an extranet switch with some added functionality at both ends extended this VPN concept to site-to-site connectivity over the Internet.

In their first incarnations, these Internet-tunneled VPNs were implemented at the edge of the Internet, that is on the customer's premise, either as a roll-your-own solution or via a service provider managed service. New technologies have been introduced which allow service providers to provide the VPN handling functionality within the cloud, minimizing the complexity of customer premise VPN functionality. These IP service management systems accept data coming from the customer on a dedicated physical or logical port. This could take the form of a physical circuit, a DSL port, via a dedicated physical circuit, via a frame relay or ATM virtual circuit, or via a secure IP tunnel. These IP service management systems manage all the security and encapsulation functions required across an enterprise's sites. Since these systems are heavily standards-based, hybrid private/public configurations are also possible.

Inevitably, some people started talking about these Internet-tunneled VPNs as the emerging architecture of choice for all enterprise networking, though for some enterprises this was emerging to be the case. But no matter how appealing the Internet is from a price and connectivity perspective, enterprise reliability, performance, and security requirements continue to move the industry towards networking technologies that are better suited for enterprise site-to-site networking for mission-critical applications.

PRIVATE LABELING
The evolution of public networks towards massively scalable terabit-switched optical networks is creating VPN service solutions that can better serve the needs of enterprise networking. Specifically, the industry adoption of multiprotocol label switching, or MPLS, on top of optical systems is the key enabler of these new types of VPNs. These underlying optical systems can support hundreds of wavelength or lambdas, each lambda supporting 10 Gbps and more, over thousands of kilometers without repeaters. "Multiprotocol" implies that multiple payloads can be supported, including ATM cells, Ethernet frames, Internet IP traffic, and enterprise VPN IP packets. "Labels" are headers that can be attached to these packets (or frames or cells), and dictate how these packets are handled in the network.

An important feature of MPLS is that multiple labels can be carried with a packet through a technique called label stacking. Label stacking opens up the possibility of uniquely identifying all packets belonging to a particular enterprise or user group within the enterprise, that is to a particular VPN. "Switching" refers to the ability to route these labeled packets across the network, even ultimately mapping certain traffic with common attributes onto switched lambdas (hence the term multiprotocol lambda switching).

MPLS standards and initial products already exist, though it will be a few years before the service provider core networks will support multiprotocol MPLS. There are two schools of thought on how to leverage this emerging infrastructure to provide VPNs, these distinguishable by the nature of the interface to the user. These can be called Virtual Private Ethernets and Virtual Private IP Networks.

Virtual Private Ethernets provide an Ethernet User Network Interface, to which the customers attach their LAN switches or routers. Ethernet frames are labeled and initially switched using distributed Ethernet Switching running directly over fiber, over wavelengths, or over Resilient Packet Rings (see my August 2001 column). Virtual Private Ethernets will rely on MPLS to provide added scalability required to support thousands of enterprises, particularly across the long-haul public network. They operate purely at Layer 2 and can be configured on a point-to-point basis (emulating a circuit), on a point-to-multipoint basis (emulating frame relay star networks), or on a many-to-many basis (emulating a broadcast LAN across a configured set of customer sites). As a Layer 2 service, they are transparent to Layer 3 transport protocols (e.g., IP, Novell's IPX, IBM's APPN, and Appletalk) and associated addressing schemes, routing protocols (e.g., Open Shortest Path First or OSPF) and associated protocols (e.g., Dynamic Host Control Protocol or DHCP). A key opportunity that Virtual Private Ethernets present are the ability to make a remote site look logically like a wiring closet in a campus site, for the first time dramatically simplifying branch networking, by enabling redistribution of routing, processing and storage to regional sites.

Virtual Private IP Networks operate at Layer 3 and interface to the customer router as a routing peer. While routed networks can be multiprotocol, these services will likely be specific to IP. IP packets will be MPLS labeled either on the customer premise or at the entry point into the cloud, which will have to be aware of routing protocols and IP addressing used within the enterprise. They rely on IP-only (vs. multiprotocol) MPLS in the network core to switch the customer's IP packets across the network. The key advantage of Virtual Private IP Networks is that they are Layer 3 services and can be transported on any Layer 2 network independent of speed. The key disadvantage is that they are Layer 3 services and are not transparent to the enterprise IP network, are complex to configure, and introduce additional network processing and delays.

IP SEC AND LABELS COMPLEMENT EACH OTHER
Enterprises continue to look to network outsourcing so that they can refocus their resources on their core businesses. VPNs are the answer and continue to evolve to better meet the needs of enterprises. There are two complementary solutions. Internet-tunneled VPNs, and Labeled VPNs either in the form of Virtual Private Ethernet or Virtual Private IP Networks. Internet-tunneled VPNs are here to stay for remote access, extranets, and for the cost-conscious site manager.

The choice between Virtual Private Ethernets and Virtual Private IP Networks will be dictated by how well each meets the enterprise requirements for tight security, high reliability, improved price/performance and scalability, operational simplicity, and meaningful SLAs. The explosion in the availability of optics right to business sites makes Virtual Private Ethernets the preferred VPN service solution for enterprises looking for lower latency, more reliability, and the inherently simpler Layer 2 solutions.

Tony Rybczynski is director of strategic marketing and technologies for Nortel Networks' Enterprise Solutions unit. E-mail questions or comments to tonyryb@nortelnetworks.com.

[ Return To The September 2001 Table Of Contents ]