abc
McGraw-Hill
Copyright © 2000 by The McGraw-Hill Companies. All rights reserved. Manufactured in the United States of America. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher. 0-07-139158-4 The material in this eBook also appears in the print version of this title: 0-07-134648-1.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps. McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate training programs. For more information, please contact George Hoare, Special Sales, at
[email protected] or (212) 904-4069.
TERMS OF USE This is a copyrighted work and The McGraw-Hill Companies, Inc. (“McGraw-Hill”) and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms. THE WORK IS PROVIDED “AS IS”. McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise. DOI: 10.1036/0071346481.03
Contents Chapter 3
Virtual Private Networks
21
Introduction History Intelligent PBX Solution Virtual Private Networks (VPN) Internet-Based VPN Goals Shared Networks Internet Performance Outsourcing Standard Outsourcing Issues Security Creating the VPN Encryption Key Handling Public Key Cryptography Authentication Router-Based VPN Firewall-Based VPN VPN Specific Boxes Throughput Comparison Remote Management of VPN Components Cost Considerations Proprietary Protocols VoIP VPN Summary
22 22 24 25 27 27 28 28 29 29 30 31 31 32 32 33 33 34 35 36 36 38 38 39 39 39
Copyright 2000 The McGraw-Hill Companies. Click Here for Terms of Use.
03.64347_CH03x
12/3/01
11:39 AM
Page 21
CHAPTER
3
Virtual Private Networks
Copyright 2000 The McGraw-Hill Companies. Click Here for Terms of Use.
03.64347_CH03x
12/3/01
11:39 AM
Page 22
Chapter 3
22
Introduction The term “Virtual Private Network” can have different meanings, but it usually refers to voice or Internet. In this chapter, we’ll learn the meaning of the term in both environments.
History As corporate communications volumes increased, organizations realized the cost of telephone service was escalating. Originally, all long distance service was charged on a per minute basis. AT&T introduced a volume discount outbound calling plan called Wide Area Telephone Service1 (WATS). For a monthly fixed payment, the organization got 240 hours of service to one of five bands across the country. Each band was priced, based on the distance from the originator’s location. A typical company usually had a band 5 line and a band 1 or 2 to cover adjacent state calls. It took some analysis to determine the most cost-effective solution for each company’s particular calling pattern. Foreign Exchange (FX) service provided a fixed rate-calling plan if a company had a large call volume for in-state locations. This is essentially subscribing to telephone service at the “foreign central office” location and leasing an extension cord from the telephone company to the home location. Originally, there were no usage charges on this line so the more you used it, the less expensive it was. Of course, long distance calls made from the “foreign” exchange were billed at the long-distance rate. A FX line is needed to each high volume calling location. Alternatively, a company could use a leased telephone line between locations. These lines went by several names: Terminal Interface Equipment (TIE) line, dedicated line, and a data line, when used for data. These are essentially point-to-point telephone lines that are available in two-wire or four-wire configurations. Because the difference in cost between two and four-wire connections was small (relative to the cost of the line), the fourwire option was preferred unless the company needed many lines. The next logical step was to use these TIE lines to connect PBXs at the various locations. Here again, there were no usage charges on these dedicated lines. A company with locations in Seattle, Phoenix, Atlanta, and headquarters in Chicago might have a “hub and spoke” arrangement of TIE
1
Some people refer to the term as Wide Area Telecommunications Services.
03.64347_CH03x
12/3/01
11:39 AM
Page 23
Virtual Private Networks
23
lines from their headquarters to each regional office. Each location then might have FX lines to adjacent cities; for example, a company based in Seattle might have a FX line to Tacoma, Kent, and Everett (see Figure 3-1). There were corresponding inbound services where the called party paid. For example, the original Zenith operator provided toll-free calling in the days of manual switchboards. The inbound WATS service, now known as 800 service, was originally structured also in bands. Finally, for local toll service, Remote Call Forwarding (RCF) allowed people to sign up for telephone service in a foreign exchange and have them make a long distance call from Tacoma, for example, back to Seattle at your expense. Although this was more expensive (depending on the number of calls) than FX, an advantage of RCF is that you can receive multiple calls at a time. It soon became apparent to people working in the Phoenix location that they could call their uncle in Kent by first asking the company operator (later by dialing) for the TIE line to Chicago. They would then choose the TIE line to Seattle and finally dial across the FX line to Kent. The PBX, although not smart, did allow a person to dial up the TIE and FX lines.
Figure 3-1 Hub and spoke arrangement for TIE lines
Everett
Seattle
Chicago
FX
Kent
Phoenix
Atlanta
03.64347_CH03x
12/3/01
11:39 AM
Page 24
Chapter 3
24
The important fly in this otherwise ingenious solution (ointment) to high-cost long distance telephone service is that each TIE or FX line could only handle one call at a time. The challenge for the telecommunications manager was therefore to figure out the optimum number of TIE lines between locations to minimize cost and waiting time for the TIE line, while maximizing savings across the commercial long distance circuits. About this time, AT&T noticed a small drop in its long distance revenue from such business and a sharp increase in the number of leased lines it was providing. Now, clearly it is much more profitable to rent a telephone channel out at $0.25/min than to lease that capacity to a corporation for $1000/month. Table 3-1 shows somewhat optimistically the amount of revenue that a normal telephone channel could return vs. the lease line. From Table 3-1, it is clear that the telephone companies much prefer switched service to dedicated service. (This thumbnail sketch focuses only on business hour revenue and ignores after hour revenue and the network providers’ cost to provide the service.)
Intelligent PBX Solution Using these dedicated lines between locations, organizations created a private network. The next step in the evolution of private networks was to devise a corporate-wide numbering plan and have the now intelligent PBX determine the route to the dialed destination via its peers, just like the local telephone office does. After all, other than size, there is little difference between a PBX and a telephone company central office switch!
Table 3-1 Comparison of usage sensitive and leased line costs
Usage
Cost Per Month Based on Usage
Leased line Flat Rate
$1000
8hr/day usage .25/min
$2400
4 hr/day usage .25/min
$1200
03.64347_CH03x
12/3/01
11:39 AM
Page 25
Virtual Private Networks
25
Virtual Private Networks (VPN) To get corporate America back on the switched network, AT&T devised a marketing strategy. The approach went something like this to the CEO/CFO: “Look, your primary business is banking [building airplanes, trading stocks, selling insurance or whatever], but it is not running a telephone company. Who knows better how to run a telephone system than we do (You can substitute your favorite carrier here. AT&T is chosen here because they were the first to introduce this service.) You think you are saving money by using these dedicated lines. On the surface, it appears that you are. However, who is managing this network? What is it costing you to recover from outages? Do you have back-up facilities for each of your dedicated routes? Your dedicated team of telephony experts is costing you a bundle. Why are you doing this?” The CFO and CEO look at each other and shrug their shoulders. “Our CIO or CTO2 sold us on the idea for providing better service at a lower cost,” they said in unison. “Look,” said AT&T. “We have the ultimate (outsourcing) deal that will provide all your current capabilities for one low price. We will manage the whole network for you and give you all the service you currently enjoy with your private network with little or no hassle.” Our product is called (somewhat obscurely) Software Defined Network because you can define the parameters of the network yourself,” AT&T said proudly. Sprint and MCI/Worldcom3 also offer essentially the same product and call it a Virtual Private Network (VPN). We use VPN here because it is both the generally used term, and it is descriptive of the offering. Here is how the deal works: The company defines the locations that will be part of the virtual private network. The larger the average traffic commitment made between these locations, the lower the price per minute can be. (The catch is that if traffic falls below the average commitment, cost falls into the next higher rate category.) The big advantage is that organizations no longer have to manage this far-flung network. The carrier will do it. Organizations can now lay off the telecommunications department. (Please note that the staff supporting the
2CTO is the Chief Telecommunications Officer or Chief Technology Officer depending on the organization. 3
MCI and WorldCom were different entities at the time of this offering, but for this book are updated to reflect current situations. Software Defined Network is a registered trademark of AT&T.
03.64347_CH03x
12/3/01
11:39 AM
Page 26
Chapter 3
26
PBX in each location is still needed to handle moves, adds and changes. In addition, the staff needed to maintain the dedicated data network is still needed. Even if the organization migrates to a Frame Relay network, some management of the vendor is always required). All the calls to specifically defined locations (offices) in Chicago, Atlanta, Phoenix, and Seattle are known as on-net calls. These are priced at the reduced rate. Calls to business partners and customers are off-net calls and are charged at a higher rate. If the off-net call volume to these specific locations rises, the organization can still place FX lines into these areas. Again, there is no substitute for knowing the traffic distribution when evaluating any telecommunications plan. As one can determine from the above description, it takes a sharp pencil to figure out if this is a good deal. It is definitely a good deal for the carrier who gets all those calls and minutes back on the switched network. The VPN network is more reliable than a dedicated, line-based network because calls are really riding over the Public Switched Telephone Network (PSTN), which is rich in multiple paths. One of the features of the private, line-based network was four- or five-digit dialing. This can be preserved intact if we want. Because the switches in the telephone network are computers that have access to a database, they can easily look up how to route a number based on the originating location and number dialed. The VPN then is a special “discount-billing plan,” with the carrier managing the network on which we can have a custom dialing plan. This discussion so far has only considered the case where the corporation owns the PBX and connects it to the VPN. What if a Centrex system is provided by the Incumbent Local Exchange Carrier (ILEC) or leased from a reseller? The answer is that one can still implement all the above with a Centrex system at any or all locations. Because Centrex is essentially a PBX that is physically resident at the local central office, it, too, can have TIE, FX, or RCF trunks. The long distance carrier supplying the VPN will be more than happy to terminate VPN trunks on a Centrex system. In summary, the important points are as follows 1. Calls are carried over the PSTN. 2. A custom dialing plan is used. 3. Pricing is dependent on the locale. 4. The number of locations 5. The projected or committed traffic volumes This is all achieved by computer databases in the network.
03.64347_CH03x
12/3/01
11:39 AM
Page 27
Virtual Private Networks
27
Internet-Based VPN One might say that these Internet-based VPNs are the same as voice a VPN but different at the same time. The philosophical point is that a dedicated network will be overbuilt in some areas and underbuilt in others. A shared network offers the hope that we can spread the overall cost out while getting the benefits of a private network. Historically, this accounts for the popularity of shared data networks beginning with X.25, Frame Relay, ATM, and now the Internet. It is easy to jump to the conclusion that the Internet is free and therefore there are tremendous cost savings to be had from this “free” shared network. Later, we will explore some cost comparisons but as one might guess, the relative cost benefit depends very much on each network’s geography and traffic volume.
Goals The goal of any network is to support users in a flexible, reliable, secure, and inexpensive manner. ■ The network manager wants the network to be flexible. ■ Users want the network to be reliable and secure. ■ Management wants the network to be inexpensive. A balance of these often-competing goals can be achieved, provided a good dialog is maintained among the participants. Table 3-2 shows the network goals in terms of applications, users, potential network solutions, and access to the network. It is an exercise left to the reader to select from the list those applications and users who are to be served. The network list indicates that these users and applications could be interconnected by any of these network technologies. As indicated previously, dedicated networks are expensive and rarely fit the need perfectly. Frame Relay and ATM are shared network technologies that can be very cost effective, depending on the geography and traffic volume. Dial-up telephony can be a networking technology for highly mobile, low-volume users. Normally, we would like to have a backbone network with direct access for various users and dial-up access for infrequent users. We will discuss these alternatives in following sections.
03.64347_CH03x
12/3/01
11:39 AM
Page 28
Chapter 3
28 Table 3-2 Mix of methods and uses to pick from
Access
Network
Users
Application
Dial-Up
Dial-Up
Road Warriors
E-mail
ISP
Dedicated
Tele-Commuters
db Access
XDSL
X.25
Branch Office
Sales Support
Cable Modem
Frame Relay
Customer
Customer Service
ISDN
Internet
Partners
e-Commerce
Dedicated
ATM
Order Entry
Shared Networks The advantage of shared networks is that organizations do not have to incur the entire cost of the infrastructure. For that reason, Frame Relay has been extremely popular. Because it (like X.25 before it) is virtual circuitbased, there is little concern about misdirected or intercepted traffic. Still, Frame Relay service is not universally available and access charges to a POP can be expensive. However, compared to the cost of dedicated networks, shared networks offer equivalent performance and a much lower cost.
Internet The next logical step is to use the Internet as the private network. It is almost universally accessible, minimizing access charges. From our discussion of the Internet in Chapter 29, two things are clear: 1. No one is watching the traffic or performance of the Net as a whole. 2. The path our data takes across the network is quite unpredictable. This leads to the conclusion that performance will be unpredictable and that our precious corporate data may pass through a router on the campus of “Den-of-Hackers University.” (It is not the intent here to malign university students, but only to offer the observation that they are bright, curious,
03.64347_CH03x
12/3/01
11:39 AM
Page 29
Virtual Private Networks
29
love a challenge, and may have time on their hands and access opportunity to do a little extra curricular research on the vulnerability of data on the Internet.) There are then two problems: performance and security.
Performance The performance issue poses the problem of sizing the bandwidth on each link, which becomes a major task as the network grows. Unfortunately, few network managers have a good handle on the amount of traffic flowing between any given pair of locations. Typically, they are typically too busy handling moves and additions to the network, which frequently leads to performance problems. Because the network grew without the benefit of a design plan, invariably it means that portions of the network, including servers, become overloaded. A dedicated line network is expensive, requires maintenance, and necessitates a backup plan should a line or two fail. Using a shared network does not alleviate the problem of traffic analysis. On the contrary, we now have to worry about the ability of the Internet to provide the bandwidth we need when we need it. Selecting our ISP to provide the performance we need becomes an important issue.
Outsourcing One solution is to outsource the network to a network provider (the analogy to a voice VPN here is strong). The most popular previous solution was to lease Frame Relay service. The benefit was that the network provider took care of the management of the network and even provided levels of redundancy (for which you paid) within its network. Unfortunately, to make most efficient use of this service, one still needed to have a handle on traffic volumes. For example, a Committed Information Rate (CIR) that was too low resulted in lost data and retransmission, while a CIR set too high was a waste of money. A national or international carrier with its own Internet backbone then becomes a good choice as a VPN provider. One negotiates Service Level Agreements (SLA), which include Quality of Service (QoS) guarantees. Some ISPs even provide Virtual IP Routing (VIPR) in which they permit you to use an internally used, unregistered IP addresses.
03.64347_CH03x
12/3/01
11:39 AM
Page 30
Chapter 3
30
If one builds a completely independent, internal (Intranet) network, one could use any set of IP addresses one might choose. This alternative is attractive to large corporations that are constrained to using class C addresses. If these private addresses were to get out onto the Internet, chaos would quickly ensue. VIPR permits the flexibility to continue to use this “unregistered” set of addresses transparently across the Internet. This is strongly analogous to having one’s own dialing plan on a voice VPN. There are many possibilities and choices here. We can outsource the whole network, including the VPN equipment on each site, or outsource pieces.
Standard Outsourcing Issues A few points are worth making about outsourcing. One must take a realistic look at the task at hand. 1. If the internal staff possess the capability to implement the VPN, do they have the time? 2. If you outsource the whole network, how permanent will the relationship be? 3. To what extent will the internal staff become involved in the design and maintenance of the VPN? Choose your vendor carefully. Evaluate responsiveness in the areas of presale support, project management, and post sales support. As in any procurement process, writing a system specification and Request for Proposal (RFP) is essential. Also, make up the evaluation criteria ahead of time. You may (or may not) choose to publish the evaluation criteria in the RFP. Select the vendor who is most responsive to your requirements. Here is a good opportunity for the vendor to do the traffic analysis so that a traffic baseline for design can be established. Always include growth in the RFP. Ongoing support will be critical. If the network spans multiple time zones, specify the minimum support requirements. For example, 9 A.M. to 5 P.M. CST is of little use to offices located in Taiwan. What training is offered as part of the package? The more knowledgeable the internal staff can be, the better they will be able to support the VPN—even when they are outsourcing support. It is important to have a coordinated security plan so that we have an integrated and consistent view across our firewalls, proxy servers, and VPN equipment.
03.64347_CH03x
12/3/01
11:39 AM
Page 31
Virtual Private Networks
31
Security The basic concept of a VPN is to provide a secure, point-to-point connection across the network between communicating entities. A couple of words about security are important to keep our paranoia in check. The first question is “How much security is enough?” To answer that question, we must consider the impact on our business if the data we are sending is: 1. Simply Lost. Is there a backup mechanism for sending or recovering the data? 2. Found by another business (not a competitor) 3. Found by a competitor 4. Actively pursued by a competitor In the last case, we must ask “How much effort is the competitor willing to invest to get our data?” The answer to these questions will help us decided how much security is enough. Note that in the foregoing example, one can equally substitute the word “hacker” for competitor.
Creating the VPN There are five ways to create a VPN as follows: 1. Between desktops 2. Between routers 3. Between firewalls 4. Between VPN specific boxes 5. Integrated boxes Although not normally considered a VPN, one can certainly use desktop PCs to encrypt data and send it across the Internet securely. Additionally, software is available that runs on a desktop capable of creating a VPN to a firewall or stand-alone VPN device. Most VPN equipment vendors offer corresponding software that runs on a laptop or desktop in order to provide a secure path to the home office over the Internet. Most of the discussion then involves creating a VPN between business locations, branch offices, and road warriors.
03.64347_CH03x
12/3/01
11:39 AM
Page 32
Chapter 3
32 Encryption
The basic rule is the more secure it is, the less convenient it is to use and the greater impact (negative) it will have on overall system performance. The strength of an encryption mechanism is dependent upon the complexity of the calculation and the length of the key. The most popular mechanism for which hardware is readily available is Data Encryption Standard (DES), developed by IBM and now standardized. The basic key is 54 bits long. Triple DES involves simply running the algorithm with a 112-bit key. The question here is as always “How secure do you need to be?” The more secure, the larger the key used (or the more times the algorithm is run with different keys). This all takes time to encode and to decode. Much has been made lately of the fact that by using thousands of computers, a DES encoded message could be broken in 39 days. Keep in mind that this is for one key. If we change keys, it would take the crackers and hackers another 39 days. Are they (hackers and competitors) motivated to do this? The method mentioned above used the brute force attack of guessing keys. Changing keys often means that the attackers must start all over again. The other encryption standard (not widely supported) is IDEA, which uses 128-bit keys. The second basic rule is that encryption performed in hardware is much faster than in software.
Key Handling A very important part (some say the most important) of an encryption is the mechanism used to disseminate keys. Here again, security is the inverse of convenience. True, keys can be sent in a multiply encrypted file. They can also be sent by “snail mail” or given over the telephone (not very secure). The problem with this private key system is that both communicating parties must have the same key. If all locations are talking to the home office, they all must have the same key, or the central office must keep separate key pairs for each location. This key management nightmare can be handled in two ways. We could use the X.509 digital certificate system for key management. The other alternative is to use a public key system to encrypt the private key so that they can easily be exchanged.
03.64347_CH03x
12/3/01
11:39 AM
Page 33
Virtual Private Networks
33
Public Key Cryptography (RSA) The layman’s version (don’t try this at home because it won’t work as described here) is that each of us thinks up a couple of prime numbers (the bigger the better). One number we keep for ourselves, and the other number we publish on our Web site along with the product of the two prime numbers as our public key. Anyone wishing to send us something will use the public key to encrypt it with the public key, and only we can decrypt the message with our private key. We can authenticate the source if the sender used his private key to encrypt his signature because only his public key will decrypt his signature. This system is secure because of the tremendous amount of processing power it takes to factor large prime numbers. (For example, if we could factor the product, we could determine the private key). Unfortunately, performing the encryption and decryption are also processor intensive (read “slow”). But it sure solves the key distribution problem. Therefore, we could use public key cryptography to encrypt and distribute the keys to all our VPN boxes.
Authentication Authentication is the process of verifying that, “this is the party to whom I am speaking,” and that they have authorized access. There are several ways of doing this; however, the most common way is to provide an authentication server that passes out authenticated certificates based on something the user has or knows. User level authentication The user has or knows his/her account code (name) and password. User names are public and passwords can be compromised. A more secure system is to use a type of secure ID card. These credit card sized devices are based on an internal clock that generates a different pseudo random code every minute. The authentication server is time synchronized with the card and therefore generates the same number at the same time. When the user calls in, he/she must enter his/her account code and the code from the card as the password. Packet level authentication The IPSec standard provides for packet level authentication to prevent man-in-the-middle attacks. (This is where someone intercepts your packets and substitutes his/her own.) An authentication header is created for each packet. The layman’s version of this is
03.64347_CH03x
12/3/01
11:39 AM
Page 34
Chapter 3
34
that a checksum is calculated and encrypted with the data. If the checksum calculated by the recipient doesn’t match the one sent by the originator, someone has tampered with the data. The IPSec standard specifies two different algorithms for doing this MD5 and SHA1. If your vendor’s equipment supports both algorithms, it improves the chances for intervendor compatibility. The other alternative is to simply not use packet level authentication. In order to guarantee authenticity of the packets, a digital signature is required to authenticate the devices to one another. IPSec has included the X.509 digital certificate standard. Essentially, the X.509 certificate server keeps a list of certificates for each user. When you want to receive data from another device, you first ask for the certificate from the certificate server. The sender stamps all data with that certificate. Since this process is secure, you may be sure that these packets are authentic. Your vendor then ideally supports both authentication algorithms and X.509. In any case, it is essential that someone in your organization understands in detail how each vendor supports the various levels of security that you intend to use. These authentication and encryption systems all have to work together flawlessly. If the vendors you choose stick to the standards, it improves the chances of, but does not guarantee, an integrated working environment.
Router-Based VPN Several router vendors offer VPN products based on the ability of the router to perform the requisite security functions. If your VPN is relatively small and the traffic volume not too heavy, then you might consider this option as a cost-effective approach. You need to have compatible routers at each location as shown in Figure 3-2. If there are individuals (for example, laptops or telecommuters that don’t have routers), they must have software that is compatible with that provided on the router. Make sure your vendor provides the compatible software that provides the level of security that you require for your VPN. The absence of a firewall in Figure 3-2 may be taken to mean that in this low cost approach we are doing firewall functions on the router. In this case, the network would logically appear as in Figure 3-3. The general admonition here is that you may be creating a bottleneck in the router. For large networks, let routers route.
03.64347_CH03x
12/3/01
11:39 AM
Page 35
Virtual Private Networks
35
Figure 3-2 Compatible routers are used at each location for VPN services
Figure 3-3 Stand-alone firewall
Firewall Based VPN The very same issues exist here as with routers. One needs to have compatible (preferably the same vendor’s) firewalls at each location. Mobile users or telecommuters must have compatible VPN software. Firewalls are always
03.64347_CH03x
12/3/01
11:39 AM
Page 36
Chapter 3
36
potential bottlenecks, so asking them to perform VPN encryption can adversely affect all other access to your network. Here again, there is no substitute for traffic analysis. We only recommend this solution for small networks where the traffic through the firewall can easily be handled by the firewall hardware. Figure 3-3 shows a stand-alone firewall hardware that filters all traffic into our network, in addition to VPN functionality.
VPN Specific Boxes VPN specific boxes are the recommended solution for high volume, large networks. Several vendors offer these solutions in both hardware and software incarnations. The general rule is that hardware boxes will outperform software boxes, and are theoretically more secure because they are based on proprietary technology that is harder to hack than publicly available operating systems. (A hardened Unix-based system is also extremely difficult to hack.) Traffic volume and feature support for remote terminals and industry compatibility will guide your decision here. These boxes set up secure tunneling by using IPSec encryption and certificates as described previously. They are typically installed in parallel with your firewall. The firewall handles Web (HTTP) requests, while the VPN box handles access to your internal database. Figure 3-4 shows the firewall and VPN box in parallel, reinforcing the division of labor between the two boxes. Because we now have two “holes” into our network, it is imperative that we have the permissions and access rights set up correctly. The firewall should not let users in who would be required to authenticate via the VPN box. The integrated solution that some vendors are offering is an integrated custom box that does routing firewall and VPN all under one roof. This is an attractive option where traffic volume and performance is not going to be an issue. Again, Figures 3-3 or 3-4 might be used to depict this configuration.
Throughput Comparison Unfortunately, while there is compatibility testing, there are no consistent performance criteria across the industry. It, therefore, becomes difficult to compare the performance of different vendor offerings. Vendor claims tend
03.64347_CH03x
12/3/01
11:39 AM
Page 37
Virtual Private Networks
37
Figure 3-4 Stand alone VPN equipment divides access to the network
to be exaggerated. They will measure their product in the best possible light (for example, maximum-sized packets and data compression turned on, using the simplest encryption algorithm). Our recommendation is to search the periodical literature for tests on the vendors you are considering as a starting point. Then, in your RFP, specify a test sequence. With encryption and authentication, there is a lot of end-of-packet processing. This causes a significant performance hit when packet sizes are small. The number of simultaneous sessions also affects performance. Vendors claim thousands of simultaneous sessions, but ask them how many they can set up or tear down at a time, and the number drops to fewer than 100. Notice also that during this peak-processing load of session setup, overall throughput will be affected. Here again, having knowledge of how your users use the system, when the peak sign-on demand occurs, when the peak traffic occurs, and what kinds of response time you consider to be reasonable all influence your product selection. By the way, being able to set up 100 sessions/second is plenty in a 1,000-user network. (How many of these users are actually using the VPN?) Worst case (which statistically never occurs) means that the last user might have to wait 10 seconds to get a session setup. Most likely, no one except the network manager with the “Sniffer” will ever notice a delay.
03.64347_CH03x
12/3/01
11:39 AM
Page 38
Chapter 3
38
Remote Management of VPN Components If you have only two locations on your VPN, then remote management of policy is probably not an issue. For a large network, visiting each site to install policy rules becomes a burden. For larger networks then, look for the ability to provide remote policy management of not only your VPN devices, but also your firewalls and routers securely.
Cost Considerations Figures don’t lie but liars know how to figure. Although we’re presenting some typical numbers here, you should run the numbers using your own particular configuration. The most beneficial comparisons of a VPN occur when compared to a dedicated, line-based network or one that makes extensive use of long distance dial-up lines. If you are already using a shared network (Frame Relay or ATM), the cost savings are not so striking. Consider that a VPN box at each location might cost $5,000 including installation; multiplied by seven sites is equal to $35k. Now, how long will it take to save this cost if you substitute your ISP charges for each location and subtract the cost of your existing T1 or frame relay network? If you had six T1s at $5k/mo, you might now have seven T1 access lines from our ISP at $3k or $4k/mo. The $7k/month savings will pay off the $35k investment in 5 months. If your Frame Relay service is costing $1,000/mo per location, the break-even point doesn’t happen in any reasonable period. Using Remote access server and dial-up lines is cheaper to install costing about $6k to $7k for about 20 users to install at the central location. Now comes the big bite, which are the long distance charges from all the remote locations. This could easily grow to $5k/month if each of the users spent two hours online. Each working day at $0.10/min is about $8,000/mo. Plug in your own assumptions as to duration and cost of telephone calls here. (Even at 1hr/day and $0.06/min. that is $2,000/mo for 20 users). A VPN system might cost $14,000 to install, including licenses for PC software at each location. The ISP charges are $20/user/month, plus an ISDN line at the home shop for $100/mo, means that we are saving $1,500 in monthly charges. We can pay off the system in 10 months. Again, do not
03.64347_CH03x
12/3/01
11:39 AM
Page 39
Virtual Private Networks
39
assume that it will pay off in all cases. But, in all cases, it is worth the effort to perform the calculations. Your VPN will definitely require more network management than a dialup system so the cost of perhaps an additional system administrator may have to be added.
Proprietary Protocols Most VPN products are designed strictly around IP. They will often handle other protocols, such as Appletalk and IPX, by tunneling them inside of IP packets. This introduces both overhead and delay. If the amount of “foreign” protocol traffic is small, then this is not significant. If the bulk of your network is IPX or Apple talk, we recommend you investigate VPN vendors who will support these protocols in native mode.
VoIP VPN The justification for doing VoIP on a VPN is primarily security, along with the reduced cost of VoIP. Depending on usage, voice generates relatively large amounts of traffic. Be sure to include this additional traffic in your sizing estimates. Our discussion of VoIP applies to whether we have a VPN or not (see Chapter 30). With a VPN, the delays due to encryption are larger, and therefore we would expect that the performance of voice over the VPN would be worse than voice over IP. If we have chosen a network provider who will offer a SLA with QoS, there is a better chance for success, but the delays due to encryption and basic packet switching will still be there. With the exception of international calling, one must have a very large calling volume to make it worthwhile to put voice over the Internet and suffer the attendant quality reduction.
Summary VPNs can provide a cost-effective solution to have secure communications across the Internet. Performance can be improved by utilizing a national/ international ISP that will offer SLAs and QoS. Choosing hardware-based
03.64347_CH03x
40
12/3/01
11:39 AM
Page 40
Chapter 3 over software-based VPN equipment will generally provide better performance. Choosing VPN vendors who embrace standards and support multiple standards increases your flexibility to your vendor/equipment choices. Knowing your current and anticipated traffic volumes permits you to make improved cost performance studies. 1. Some people refer to the term as Wide Area Telecommunications Services 2. CTO is the Chief Telecommunications Officer or Chief Technology Officer depending on the organization 3. MCI and WorldCom were different entities at the time of this offering, but for this book things are updated to reflect current situations.
