Virtual Private Networks

An Early Look At Network-Based VPN Deployment

These new Virtual Private Networks are truly "virtual" (created in software, on provider equipment). Eliminating customer premises equipment lowers costs significantly at every stage, not just installation. In this column, we look at these new platforms and talk with providers who are tapping this new market.

Lisa Phifer
VP Core Competence, Inc.
[September 5, 2000]

Last fall, I contacted vendors in the nascent "network-based VPN" market, hoping to speak with a few early adopters. While many speculated about potential, few customers had reached the stage where they wished to speak publicly about planned or actual deployment. So, instead, I briefly introduced IP service platforms being developed by the likes of CoSine, Nortel, and Spring Tide (in "Network-Based VPN Platforms"), promising to revisit this market when the time was right. In today's column, nearly one year later, I do just that.

Defining The Network-Based VPN Market
"Network-based VPN" has been used by many to describe several very different services. Here, I use the term to describe IPsec tunnels that originate and terminate on IP service platforms, located inside the provider's network. By contrast, most of today's managed VPN services employ tunnels that start and end on customer premises equipment (CPE). Even the so-called layer 2 "private networks" use ATM and Frame Relay virtual circuits to interconnect CPE. The key difference? A new kind of central office/POP/superPOP platform that allows "soft provisioning" of virtual routers, network address translations, firewall rules, traffic shaping parameters — and virtual private networks.

Infonetics Research publishes a quarterly market share report on Service Provider Core and Edge Hardware, the product space that includes this new type of platform. "For IP services, routers — products that sit between the core and edge, providing IPsec-based tunneling — we see a $235M market this year," said Kevin Mitchell, an Infonetics Service Provider Networks analyst. "Nortel, CoSine, and Spring Tide are the big three in this market. Cisco purchased Compatible Systems and may be looking to enter this market, but we haven't seen this materialize yet. Today, Redback and Cisco are both really in the broadband aggregation market, not the IP services market. But this space will only get more crowded."

IP service platforms are aimed squarely at carriers and high-volume service providers. The lure? By eliminating customer premises equipment, you can lower cost at nearly every stage. Reduced investment in capital equipment. Fewer truck rolls to the customer site. Rapid service provisioning and simplified maintenance. A faster, more robust, more scalable engine. And the opportunity to create and sell incremental IP services that leverage a common, flexible service delivery platform.

How receptive have providers been to network-based VPNs? According to Mitchell, Infonetics just completed a study of tier 2 service providers, which they define as national without fiber or regional with fiber. "Based on data gathered from 23 of the 75 tier 2 providers that operate in the US today, 26% said they have cloud-based tunneling and encryption now," said Mitchell. "43% said they expected to do this within a year. That's big market penetration for products just now becoming available."

Mitchell acknowledged that many surveyed providers who answered "yes" are probably conducting trials; revenue-generating commercial deployment may be a smaller number. Nonetheless, with numbers like these, surely I'd find someone ready to speak publicly about initial deployment experience?

And so, once again, I invited the "big three" to put me in touch with service provider customers. This time, I hit paydirt.

 

1. Introduction

>2. Broadslate's Experience with Lucent

3. Savvis' Experience with Nortel

4. AduroNet's Experience with CoSine, and Conclusion