Private Use of Public Networks for Enterprise Customers
Total Page:16
File Type:pdf, Size:1020Kb
3 Com Technical Papers ® Private Use of Public Networks for Enterprise Customers New Standards-Based Virtual Private Networks Offer Cost Savings and Business Opportunities Private Use of Public Networks for Enterprise Customers New Standards-Based Virtual Private Networks Offer Cost Savings and Business Opportunities Contents Why Enterprises Need VPNs 2 What Is a VPN? 2 VPN Benefits 3 Cost Savings 3 Easy Scalability 4 Support for Ad-Hoc Business Relationships 4 Full Control 4 Enterprise VPN Applications 4 Global Internet Access 5 Dial Access Outsourcing 8 Virtual Leased Lines for Branch Office Connectivity 9 How VPNs Work 11 VPN Protocols 12 VPN Security 12 Microsoft Point-to-Point Encryption (MPPE) 12 Secure IP (IPsec) 13 Tunnel Switching: Improved Security and More Flexible VPN Applications 16 VPN Management 17 3Com VPN Solutions 17 3Com Solutions for Enterprises 17 Conclusion 18 1 Private Use of Public Networks for At the same time, IT must support grow- Enterprise Customers ing branch office connectivity. Particularly in organizations growing through acquisition or New Standards-Based Virtual Private Networks merger, the ability to rapidly integrate separate Offer Cost Savings and Business Opportunities and frequently incompatible infrastructures can be critical to the success of business relation- ships. In addition, there is the emerging Acronyms and Virtual private networks (VPNs) offer cost- requirement to deploy extranets that support Abbreviations effective solutions to some of today’s most crit- ical networking challenges. Enterprises need a unpredictable relationships with customers and AAL more affordable, scalable way to meet the business partners. IT also has to cope with the ATM adaptation layer demands of a growing community of remote plethora of management and security issues CHAP users and to manage branch office connectiv- these connections entail. Challenge Handshake ity. They need to be able to accommodate the Virtual private networks (VPNs) offer Authentication Protocol pace and unpredictability of business by link- solutions to these dilemmas. They provide IPsec ing customers and partners into extranets on enterprises with a number of ways to achieve Secure IP an ad-hoc basis. And they need to be able to substantial and immediate remote access and branch connectivity cost reductions by taking ISAKMP provide all of this access to networked Internet Security Association resources, including legacy systems and advantage of the networking infrastructures Key Management Protocol enterprise protocols, without compromising and services of Internet service providers (ISPs) and other network service providers ISDN security. Integrated Services Digital The benefits of VPNs include the opportu- (NSPs). VPNs offer a cost-effective, scalable, Network nity to save 50 percent or more in the cost of flexible, manageable, and secure means of handling network growth, of linking in newly ISP remote access and branch office connectivity. Internet service provider VPNs also offer tremendously increased strate- acquired business units, and of supporting ad- gic flexibility, which can lead to additional hoc business relationships. Companies can get L2F all these benefits while retaining central con- Layer 2 Forwarding cost savings and potentially important business advantages. trol over security and management of adds, L2TP This paper describes how VPNs cut costs moves, and changes. Layer 2 Tunneling Protocol and increase strategic flexibility. It describes Enterprises deploying VPNs will have an MPPE and diagrams some of the most popular VPN increasing range of VPN-based services to Microsoft Point-to-Point 2 applications. It explains the underlying chose from. Infonetics Research predicts that Encryption tunneling technology, including system compo- the VPN market will grow at more than 100 NSP nents and industry standards for tunneling and percent per year through 2001, when it will network service provider tunnel-based security. It introduces tunnel reach nearly $12 billion. They report that 92 POP switching and the advantages it offers for percent of large ISPs and 60 percent of all ISPs point of presence increased enterprise network security, more plan to offer value-added VPN services by PPP flexible access to network resources behind mid-1998. Point-to-Point Protocol firewalls, and more flexible service-level han- What Is a VPN? PPTP dling of tunneled traffic. The paper closes by Point-to-Point Tunneling discussing 3Com VPN solutions and their A VPN is a connection that has the appearance Protocol advantages. and many of the advantages of a dedicated link but occurs over a shared network. Using a Why Enterprises Need VPNs technique called “tunneling,” data packets are Industry analysts predict that by 1999, 80 per- transmitted across a public routed network, cent of corporate workers will have at least one mobile computing device.1 IT organizations 1. “Internet Remote Access,” Network Strategy everywhere are struggling to meet this balloon- Service, The Forrester Report, vol. 10, no. 8, July 1996. ing demand for remote connectivity and to deal with the resulting increases in network com- 2. “Virtual Private Networks,” Infonetics Research, plexity and end-user support costs. 1997. 2 such as the Internet or other commercially translation, VPNs can provide for data encryp- available network, in a private “tunnel” that tion, authentication, and authorization. simulates a point-to-point connection. This Tunneling devices perform these functions by approach enables network traffic from many communicating with security servers. Such sources to travel via separate tunnels across the servers also usually provide information on same infrastructure. It allows network proto- bandwidth, tunnel end points, and, in some cols to traverse incompatible infrastructures. It cases, network policy information and service Acronyms and also enables traffic from many sources to be levels. Abbreviations differentiated, so that it can be directed to spe- VPN capabilities can be added to existing cific destinations and receive specific levels of networking equipment through a software or PSTN service. board-level upgrade. Once installed, the capa- public switched telephone network The basic components of a tunnel are: bility can be used for multiple VPN applica- • A tunnel initiator (TI) tions, each delivering substantial cost and/or QoS • A routed network revenue benefits. Quality of Service • An optional tunnel switch RADIUS • One or more tunnel terminators (TT) VPN Benefits Remote Authorization Dial-In Tunnel initiation and termination can be User Service performed by a variety of network devices and Cost Savings SMDS software (Figure 1). A tunnel could be started, VPNs offer cost savings in the areas of com- Switched Multimegabit Data for example, by an end user’s laptop equipped munications charges, remote user support, and Service with an analog PC modem card and VPN- equipment. TI enabled dial-up software (basic tunneling and • Communications costs (leased line tariffs, tunnel initiator long-distance charges). Connecting two security capabilities are bundled into Windows TT 95 and Windows NT 4.0). It could also be computers over long distances using the tunnel terminator started by a VPN-enabled extranet router on an Internet can yield substantial savings over today’s dedicated leased lines and Frame VLAN enterprise branch or home office LAN, or by a virtual LAN VPN-enabled access concentrator at a network Relay networks. The Internet is also less expensive than long-distance direct modem VLL service provider point of presence (POP). A virtual leased line tunnel could be ended by a tunnel terminator or ISDN calls. VPNs are money-savers or switch on an enterprise network or by a VPN because they enable remote users to make VPN virtual private network gateway on an NSP’s network extranet router. local calls to an ISP, which are then tunneled In addition, there will usually be one or to a VPN device on the destination network. VTP more security servers. Along with the conven- Virtual Tunneling Protocol tional application of firewalls and address xDSL digital subscriber line Tunnel terminator Tunnel Tunnel initiator Tunnel termination device or tunnel switch on enterprise network Shared routed VPN gateway Access concentrator network at an NSP POP on NSP network Extranet router on a branch LAN Dial-up software on an end user laptop Figure 1. VPN Components 3 Users have the same experience as if they capacity and reach of their network simply by had dialed directly into the network—typi- setting up an account with a new NSP or cally at half the cost of the most economical expanding their agreement with an existing 800 number. provider. In addition, installing VPN capabili- Branch offices can use VPNs to replace ties in remote offices is typically a simple task dedicated leased lines to company headquar- that does not require a technical specialist on ters or to other branches. The branch LAN is site. A few simple commands should configure connected to a business class NSP, which an extranet router for both Internet and VPN tunnels traffic from LAN users over the connectivity, and workstations can get their Internet or over its own network backbone to configuration automatically from the router. a LAN in another part of the user’s enter- Easy scalability allows agile responses to prise. Branch users are still able to access the organizational change and market demands. A corporate network in the usual way, and the company completing an