VPN without tears

In the search for new revenue streams, virtual private networks are getting a lot of attention from Internet service providers-and not just the Tier 1 names, either. According to a new survey of local and regional ISPs by Infonetics Research, 37% of respondents offer VPN services to their customers now. That proportion will leap to 73% in 2000, by which time these small providers estimate that one-fifth of their business accounts will require VPNs.

Local players entering the VPN business need systems that are scalable, quickly and easily deployed and simple to maintain. Vendors are responding to that call. VPNet Technologies, for example, has introduced the VPNsure Program, a menu of services that allows ISPs to plan, design, install, manage and support VPNs.

Service providers can dominate this outsourcing market, said VPNet Vice President of Marketing Richard Kagan, because customers with overtaxed information technology departments would rather deal with one provider for everything relating to bandwidth. But most of these ISPs need help, too-to accelerate their market planning and service definition, to supplement their design capabilities and to train.

VPNsure's services speed up time to market and lower the cost of market entry with sales development assistance and planning services covering network design and integration, security assessment and technical training. "We actually design the VPN," Kagan said. "We help decide who gets access to the site, the service levels needed, the applications to run over it, the site characteristics-everything between your decision to offer VPNs up to the turn of the first screwdriver."

Implementation of that design, along with troubleshooting and help desk support, come through VPNet's alliances with local, regional and global support providers such as AT&T Global Services.

Internet Devices has just introduced a carrier/enterprise policy router system built on a segregated architecture of policy manager, server and router. ISPs use the Fort Knox C/E policy manager software to define the different roles of end users via a browser-based graphical user interface (GUI). The separate policy server is a centralized repository for all policies, user communities and data. Policy routers are deployed at the customer site and contain all the VPN capabilities-firewalls, bandwidth management, Web site blocking and others.

Key to the Fort Knox C/E is "role-based policy management," which breaks VPN policy into four dimensions: time of use, users, resources and the network itself. "You literally drag and drop each dimension to make policies," said Mitch Strobin, marketing vice president for Internet Devices. "Instead of figuring out VPN firewalls and such technical stuff, we add a layer of intelligence that lets us translate directly from an English policy to the GUI. That's a massive win in terms of keeping support costs low."

The system is very scalable. "By having a distinct policy manager box, you make policy once and send it out to many routers," Strobin said. The ISP can also use the browser to design topologies-meshed, hub and spoke, hybrid meshed or tunnels-to suit a customer's needs.

Finally, SpringTide Networks simplifies VPNs and other Internet protocol (IP) services by adding what it calls an IP services switch at the boundary between the IP backbone and the access aggregation point. Tunneling, the most common method of creating VPNs from one end of the Internet to the other, requires encrypted data and therefore prevents intelligent decisions about quality of service (QOS) and classifying flow. "You also can't put the burden of having every possible source on this new network know every possible destination network address," said Stephen Collins, marketing vice president and SpringTide co-founder.

The answer, he said, is a new kind of mediation device-the IP service switch. "Think of it as a kind of a portal via which users access services and applications over the network but which shields them from the complexity of QOS requirements, encryption and addresses," Collins said.

Since the IP service switch is the connection point between a user and a service or application, it also serves as the logical point at which to do the detailed accounting for usage-based billing.

ARRIS, GI MODEMS DOCSIS CERTIFIED High-speed cable modems from Arris Interactive and General Instrument are the fourth and fifth units to win DOCSIS certification from CableLabs. The units join products from 3Com, Toshiba and Thomson Consumer Electronics as the only cable modems thus far certified to be interoperable with CableLabs-qualified headend equipment.

LOGIX RIDES INTO AUSTIN Integrated communications provider Logix Communications will offer services to Austin, Texas, businesses through its new switch in that city. Logix supplies voice, data, wireless, Internet and enterprise networking to commercial clients in the Southwest and plans five more switches in Texas this year, as well as one in Tulsa, Okla.