ISPPlanet • eTunnels VPN-on-Demand - page 4

The Service Provider Opportunity
Service providers purchase capacity from eTunnels: a specified number of client, server, and gateway seats. "This is like how you buy wholesale ports today," said Sirota. "The provider will buy a certain number of seats for a year, and then can bundle those seats any way they want for resale to their own customers."

eTunnels supplies each new channel partner with access to the subscriber management portal and a provider-branded VPN manager portal and web wizard. "Portal customization takes about 5 days. We follow this with about 5 days of testing, so turn-up takes about two weeks," said Sirota.

"Providers can use their outside sales force to sell VPN-On-Demand to business customers, or they can sell the service electronically," said Sirota. "In either case, new customers are pointed to the web wizard to set up their first VPN." In release 1.0, there is no equipment to buy and no hardware to install. In release 2.0, "zero configuration" appliances can be warehoused by the provider or shipped directly to customers from the manufacturer.

A large carrier might buy 50,000 client and 5000 gateway seats. An SME customer might purchase 50 clients and 1 gateway from that carrier. "Our cost to the carrier to provide these seats is $15/month/user," said Sirota. "The carrier can resell this service for at least twice this amount; pricing and bundling are up to the carrier. We don't charge for traffic—VPN traffic actually uses the customer's own network access because the tunnels aren't terminated by eNS. The carrier can bill customers based on number of clients, usage, or service bundle."

Channel partners are responsible for tier 1 (inquiries) and tier 2 (known issues) support. eTunnels provides tier 3 support and a knowledge base to assist partners in providing tier 2 support. "We'll eventually provide outsourced tier 2 support for a fee, but we'll never get into tier 1," said Sirota.

In June, eTunnels announced a pre-release beta test with nine participants: Group Telecom, Netopia, Deloitte & Touche, RB Capital Partners, Cinax, IFMCityNet, Roomlinx.com, Venture Vortex, and Launchpower. In mid-September, Sirota told us that several carriers, including Covad, were actively evaluating VPN-On-Demand 1.0. To date, we have not seen any public partner announcements.

The Bottom Line
VPN-On-Demand is designed to enable secure workgroups: dynamic, distributed 200-user communities-of-interest. Target markets that can be satisfied include small businesses, departments or groups within a larger enterprise, and Extranets.

Like other emerging network-based VPNs, eTunnels reduces operational cost through soft provisioning and provider-hosted self-management. Even when CPE is required, it is drop-shipped and centrally-managed. Because the service is subscription-based, there is no up-front capital investment by the channel partner.

"One of the issues with network-centric solutions is that your coverage is only as good as your POP footprint," said Sirota. Because it does not place equipment at the provider's POP or CO, VPN-On-Demand is access-independent. Of course, Internet access through someone's POP is required—it just doesn't have to be an eTunnels partner POP.

We find these strengths compelling, but temper them with a few caveats. As Sirota admitted, adding software to a desktop can be contentious. Although standard IPsec is used, eNS tunnel setup and centralized management are proprietary. VPN-On-Demand is not (currently) a multi-vendor platform, and security policy options are intentionally limited. That's fine in the SME market, but won't fly everywhere—for example, large enterprises that require integration with an existing VPN or resist single-source purchasing.

In any centralized architecture, ability to scale is a question. eTunnels is young; it must prove itself by establishing a strong track record of high-volume customers. Furthermore, as endpoints in a VPN grow, full-mesh topology becomes impractical. Release 2.0 enables larger VPNs by using gateways to aggregate LAN user traffic.

For large carriers, lack of control and ownership over a shared eNS may also be a concern. To address this, eTunnels will support a distributed eNS model with local eNS servers in a future release.

Providers seeking instant gratification in the SME remote access VPN market should take VPN-On-Demand out for their own test drive. Those aiming to satisfy larger enterprises may consider VPN-On-Demand as a complement to other offerings.