VPN

IP—VPNs Part 2: The Technology —continued

The technologies available to create IP—VPNs

• IPSec is a means of providing encryption and authentication, and is effectively standardised
• L2TP and PPTP may be used with IPSec to terminate connections from dial-up access, but this is no longer essential because the features are now included in IPSec
• MPLS provides a means of setting up virtual circuits across a router network, and is used to partition bandwidth. Standards for combining MPLS virtual circuits with router partitions to create IP—VPNs are being developed.

There is a misconception that IPSec and MPLS are competing technologies for the support of IP—VPNs. IPSec provides security features, including encryption; MPLS provides performance guarantees, including reserved bandwidth. IPSec and MPLS can be used together if the layer 2 separation provided by partitioned routers and reserved paths is not considered sufficient for the security requirements of the user.

Further, IPv6 has no material impact on IP—VPN implementation. MPLS can encapsulate IPv6 as easily as IPv4, and the use of DiffServ, IPSec, and RSVP is exactly the same with IPv6 as with IPv4.

Vendors are taking different approaches to the IP—VPN market
A number of vendors claim market leadership in different aspects of IP—VPNs. Cisco is implementing VPN support in a wide range of its products, including support for IPSec tunnels in firewalls, routers and concentrators, and support for MPLS on its routers. CoSine is focusing on migration from frame relay, with support for IPSec and MPLS and frame relay in its service platform. Nortel is providing VPN platforms that support IPSec termination in routers and firewalls, as well as implementing MPLS support in other network devices. Orchestream, meanwhile, is focusing on the management of MPLS-based networks.

These technologies are being deployed now
The range of IP—VPN offerings has only recently become substantial, having expanded sharply during 2000 and continuing into 2001. Major providers of international telecoms business services—such as Cable & Wireless, Concert, Equant, Global Crossing and Infonet—have all launched substantial new IP—VPN services during that timeframe, as have KPNQwest and NTT Communications.

The new IP—VPN services are acquiring growing numbers of major customers and will soon have the status of mainstream services for at least large international corporate companies.

Many service providers are currently tending to concentrate on tailored IP—VPN solutions for large companies, often with strong international networking requirements, rather than on simple service packages for small and medium-sized enterprises (SMEs). Such a focus favours the major global service providers, and is to some extent natural with a major new networking technology—especially one that depends on state-of-the-art ATM and IP core networks for its implementation. Additionally, some IP—VPN services are targeting high-bandwidth use in the carriers' carrier and service provider markets.

Nevertheless, there is growing interest among service providers in the SME market for IP—VPNs. BT has offered SME-oriented IP—VPN services in the UK since 1999, and many other incumbents and service providers (such as XO Communications) now offer national IP—VPNs that can be used by SMEs. Competition is increasing as service providers with international IP networks target national markets. For example, the France Telecom Group has recently announced that it will offer managed IP—VPN services to SMEs, starting initially in Portugal and Switzerland.

There is similarity between IP—VPN offerings
Many current IP—VPN service offerings are very similar. This is caused by a combination of technical realities and service and market logic.

Thus, there is a tendency to have two separate offerings: one based on IPSec, the other based on MPLS. Also, these tend to be offered on different underlying networks—either ATM or IP.

At the current state of technology and historical network investment, ATM, with its inherent strong QoS capabilities, is perceived as the obvious existing network technology to support early QoS in IP—VPNs. Similarly, IPSec, having matured earlier than MPLS, has an obvious claim for early implementation.

The similarity of offerings extends to such characteristics as access bandwidths and interfaces, security capabilities, QoS and management support, as these are determined by the common needs of large-scale corporate networking. SLAs, however, may be more related to the service providers' overall service policies than to the IP—VPN service itself.

—End

Related articles:
[Jul. 11, 2001]	IP—VPNs Part 1: Growth Ahead
[Jun. 13, 2001]	VPN Vendors: Our Take
[Jan. 10, 2001]	InternetConnect: Joining IP and ATM with MPLS

<Back to Page 1

Disclaimer
Figures and projections contained in this report are based on publicly available information only and are produced by Analysys Research Limited independently of any client-specific work within the Analysys Group. The opinions expressed are those of the stated authors only.

Analysys Research Limited recognises that many terms appearing in this report are proprietary; all such trademarks are acknowledged and every effort has been made to indicate them by the normal UK publishing practice of capitalisation. However, the presence of a term, in whatever form, does not affect its legal status as a trademark.