VPN Platforms for Internet Service Providers

This survey of VPN hardware suitable for ISP use lets you compare equipment across a number of significant variables.

by Lisa Phifer
[Lisa Phifer will be demonstrating VPN products
at VPN @ TISC, a one-day workshop to be held
October 11th at the World Trade Center, Boston.]

Platform selection is arguably the most strategic decision facing any service provider entering the VPN market today. One way to begin selection is by surveying commercially available networking products that offer VPN features. In this column, we do just that. (See chart, below.)

There are many variables in the service provider VPN equation. In this survey, we have identified a few key factors that differentiate one VPN product from another.

POP or CPE?
As with any service, deploying a VPN involves both Point-of-Presence (POP) platforms and customer premise equipment (CPE). Products suitable for POP usage must meet higher expectations for scalability, performance, manageability, and integration—and typically come with a larger price tag. CPE products are considerably more diverse, ranging from PC client software to Internet appliances, VPN-enhanced routers, and specialized gateways. The "CPE" products identified in our survey are actually marketed for enterprise use. Some are more appropriate for small business or remote offices, while others are hefty enough to serve as central site "CPE" in a branch office VPN. One could argue that larger CPE is suitable for POP usage; it really depends on the target environment.

Remote Access or Branch Office?
VPN products typically support remote access VPNs (enabling dial-up access by individual clients) and/or branch-office VPNs (connecting networks, such as remote office to central site). Remote-access VPNs often use protocols like Point-to-Point Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Layer 2 Forwarding (L2F). These protocols are designed to authenticate PPP-based access by individual users; POP products that support them may include other features relevant to remote access such as high dial port density and integration with RADIUS. Branch-office VPNs commonly employ tunnels between security gateways that support IP security (IPsec) standards. But IPsec can also be used for remote access VPNs when the security gateway is paired with client-side software.

Connectivity and Scalability
This survey does not exhaustively explore the diverse connectivity offered by VPN products. To give a rough idea of scalability, I have included the number of simultaneous connections (calls or tunnels) quoted by each vendor. It is important to realize that products often support many client-to-gateway tunnels, but a much smaller number of gateway-to-gateway tunnels, so comparing these numbers can be misleading. Perhaps a more useful metric when comparing platforms for branch office VPNs is aggregate throughput, although we don't show this here. Some products offer integrated WAN interfaces, while others are intended to sit behind an external WAN access switch or router. These dual-Ethernet products can be paired with a wider range of WAN access solutions, but result in a more complex network end-to-end.

A Role For Software
This survey focuses on hardware VPN products, but we've included a few representative software products for comparison. Windows NT and Moreton Bay PoPToP can be used to turn a general-purpose PC into a remote-access VPN server; these solutions may be of interest for small-scale POP deployment. Most IPsec remote-access products are paired with client software sold by the same vendor. Layer 2 products utilize Windows PPTP clients or require no client software at all. For further discussion of client-side issues, see my column, Dial VPNs: Revenue Opportunity or Headache?

Final Thoughts
The information included in this survey was drawn from product specs posted on vendors' web sites. ISP usage and VPN application represent my own impression, based on available product specs. In a few cases, I have included two products sold by the same vendor to illustrate both smaller CPE and larger solutions for enterprise central site or POP. This survey is intended to be representative, not exhaustive. I hope you find it useful to see "the lay of the land", and encourage you to contact vendors directly to investigate all products of interest. And now on to . . .

The Survey

—End

read more by Lisa Phifer on VPNs