# Od PSTN k IP/VPN

---------------------------
V 60. rokoch, kedy vznikla prvá digitálna hlasová komunikácia, Public Switched Transfer Network (PSTN) bol podporovaný celosvetovo ako primárny typ hlasovej komunikácie. PSTN je connection-oriented, circuit-switched sieť, kde je pre komunikáciu je vytvorený dedikovaný kanál (circuit), ktorý existuje počas celého trvania prenosu. Pôvodne prenášal výhradne analógový signál, PSTN však umožnil používanie digitálneho prenosu, ktorý dedil a využíval všetky výhody predchádzajúceho analógového prenosu. Hoci vysoký stupeň spoľahlivosti bol nevyvrátiteľný, PSTN mal dva výrazné nedostatky:
1. drahá šírka pásma (bandwidth), ktorá viedla k vysokým telefónnym účtom pre fyzické i právnické osoby.
2. Neefektívne využitie sieťových kanálov, čo sa prejavovalo obsadením celého kanála pre každú jednu konverzáciu.
Ich identifikácia podnietila hľadanie iných možností.
---------------------------
Converged network architekúra
Typická sieť pozostáva z dvoch častí:
1. vnútorná sieť
2. de-militarizovaná zóna (DMZ)
DMZ je napojená na verejný internet cez externý firewall a obsahuje rôzne servery, ktoré musia byť prístupné z externých lokácii. Myslí sa tým web, mail, domain name service (DNS) servery. Vnútorná sieť je napojená na DMZ pomocou iného firewallu.
Potreba flexibility sieťovej konektivity
Pretože firmy potrebujú zostať konkurenčné, sú tlačené k vylepšovaniu produktivity a realizácii úspornejších riešení operícií a komunikácie. V prípade telekomunikačných produktov to dnes platí dvojnásobne a je preto vcelku predvídateľný nástup stratégii a vývoja smerujúceho k next=generation sieťam, konektivite a menežovaných služieb. Celá snaha hľadania ideálu sa stretáva v bopde nazývanom IP virtual private network (IP VPN) služieb (neinternetové IP/multiprotokol label switching (MPLS) a internetové IP VPN). Ak chceme ísť hlbšie, MPLS siete začnú dominovať jadru wide-area sietí (WAN), umožnia poskytovateľom služieb flexibilné a customizované high-margin služby, ktoré sú kľúčové pri procese získavania business zákazníkov.
Nenákladné IP VPN služby zjednodušujú sieťovú infraštruktúru — umožňujú širokú rozmanitosť žiadúcich business aplikácii a benefitov:
Multimediálne služby používajúce IP multicast a nízkolatenčné IP class data služby a video apliácie, vrátane video konferencií alebo vzdialeného vyučovania. Voice over IP Outsourced, managed services converging voice, data and video traffic Content hosting for Internet/intranet/extranet applications and services Multiple traffic classes with "application awareness" for prioritizing traffic types, bandwidth management, and time-sensitive traffic handling capabilities Corporate intranets, and most extranets, are now primarily designed as separate Internet and nonInternet IP-based networks because of security concerns. Enhanced IP network services (IP VPNs) offer the competitive advantages of secure, flexible, cost-effective and easy connectivity extension/contraction for the variety of voice and data traffic required by businesses of all sizes. What's in This Acronym — IP VPN? [return to Table of Contents] IP VPNs are managed or unmanaged Layer 3 (network or customer premises equipment (CPE)/edge-based) offerings, providing a full range of metropolitan-area network/local-area network (MAN/WAN) networking functionality using IP backbone transport technology — either a private carrier-operated network or shared public Internet IP network for a closed (or at least well-defined) community of interest. IP VPN offerings take several architectural forms, depending on their intended use: remote access, internal enterprise networking (corporate intranets), or business-to-business networking (corporate extranets). Generally, managed IP VPNs deliver a common set of features: any-to-any connectivity, fault management, configuration management, security management, edge-device management, edge-to-edge service-level agreements (SLAs), and possibly some project management/professional services. Features available in 2003 will increasingly include management tools such as network/service operations monitoring/status reporting capabilities and even end-user controlled/dynamic bandwidth provisioning and service modifications (adds-deletes-changes) in a managed VPN environment. IP VPN types are varied and may include: Internet-based IP VPNs, typically using IP security (IPsec) Multi Internet service provider (ISP) type — End-user managed or third-party managed Single ISP type — End-user managed (with SLAs for transport), third-party managed or ISP managed (possibly with end-to-end SLAs) NonInternet-based IP VPNs (typically using MPLS WAN) End-user managed (CPE) — Not typical Service provider managed (CPE) — Fully meshed and multiple classes of service (COS) Internet IP VPNs [return to Table of Contents] Internet IP VPN is commonly used to define VPN services that are enabled at the edge (CPE/edge-device hardware or software) and usually only provide a single class of service. This type of IP VPN is viewed exclusively as the implementation of secure, end-to-end connectivity by creating tunnels through the public Internet using encryption methods, such as IPsec, data encryption standard (DES) or 3DES. Standards-based approaches for providing Internet IP VPN connectivity include Point-to-Point Tunneling Protocol (PPTP), tunneling protocol (L2TP) and IPsec). MPLS IP VPNs [return to Table of Contents] MPLS VPNs are fully meshed network-based solutions using Layer 3 routing, with a mix of various vendor-specific and standard-based protocols. MPLS improves private IP network traffic management by creating virtual circuits between MPLS-enabled endpoints on the network (with nearly instantaneous automated provisioning capabilities) — streamlining and optimizing the traffic pathway (traffic isolation) and minimizing congestion (see Figure 1). MPLS provides the ability to establish traffic classes, which allow tiered levels of service quality. Although a less common practice today compared to the use of DiffServe-enabled routers, MPLS can handle multiple protocols such as Layer 2 (asynchronous transfer mode [ATM] and frame relay [FR]); and Layer 3 (IP) over the network and enable the migration of many ATM control plane functions to Layer 3, simplifying network management. MPLS has been implemented as an IP overlay on frame relay and ATM networks. Secure MPLS VPNs can be built on-demand by creating IP "tunnels" within the MPLS network without the necessity of using any encryption. However, at its core, MPLS is an IP service, so when any router in the MPLS network connects directly to the public Internet, the network may be at risk from cyber intrusion. If additional security is needed, encryption over MPLS can be provided by adding an IPsec overlay. Adding DiffServ at the edge router will also permit carriers to add COS discrimination to the network although most MPLS networks today are highly over-provisioned and therefore do not need this extra layer of quality of service (QOS). MPLS networks are discrete to each carrier — each endpoint must be enabled by the same service provider because multi-MPLS network interconnection standards have not yet been developed. There are different proposals for using MPLS to provision IP-based VPNs. One proposal is RFC2547-MPLS/BGP VPN, which enables MPLS VPNs using extensions to the Border Gateway Protocol (BGP). MPLS is used for forwarding packets over the backbone, while BGP is used for distributing routes over the backbone. Another method for using MPLS to create VPNs is based on maintaining separate routing tables for the various VPNs. This scheme, defined by implementing the VPN as a set of virtual routers, does not utilize BGP. Data Security — Always the Concern [return to Table of Contents] Internet IP VPN [return to Table of Contents] Internet IP VPN security is accomplished essentially by tunneling through the IP backbone, which involves using one of several techniques to set up a virtual connection on a shared network by means of encapsulating the data in a secure format. There are several techniques of doing this by using standard tunneling protocols such as PPTP, Generic Router Encapsulation (GRE) and Layer 2 Tunneling Protocol (L2TP). Security for this type of VPN involves authentication, which demands the users be able to prove that they are entitled to access the information (user names and passwords), and digital "tokens." The second method is encryption, where the data in the tunnel is scrambled on transmission and unscrambled by the recipient. Currently, the most popular tunneling and encryption technique is the IPsec, which offers data formats, secure key exchange, and encryption/security methods including header authentication for a very robust secure IP VPN service. Other encryption options for an Internet IP VPN include DES and 3DES, escrowed encryption standard (EES), and the RC-4 encryption standard. Other security measures used in conjunction with encryption commonly include a network-based firewall to provide content filtering management, site authentication, virus scan, anti-spoofing, intrusion detection and denial of service protection. MPLS and IPsec [return to Table of Contents] Network-based MPLS IP VPNs allow the service provider to segregate different traffic types from different applications or specific transport protocols to allow tiered QOS on the same route. The inherent level of security of a private IP WAN using MPLS is similar to managed FR or ATM service, and it is significantly better than the public IP Internet. However, MPLS is a shared IP network and is only as secure as its weakest connection/access point. An MPLS VPN would deliver what would be classed as "good enough" security to an end-user on network — effective, but not entirely infallible. Unlike Internet IP VPNs, MPLS VPNs rarely need and thus do not specify packet encryption. However, MPLS does allow added security techniques, such as IPsec, for sensitive or high-value traffic (financial and medical/healthcare). To encrypt packets over MPLS, a whole IPsec overlay would have to be added onto the network. When the MPLS network interconnects with the public Internet, security measures (firewalls) are used at the MPLS network gateways to the public Internet and may occasionally be present at selected MPLS-LAN gateways for critical business locations such as corporate headquarters. These firewalls can include the use of content filtering management, site authentication, virus scan, anti-spoofing, intrusion detection and denial of service protection. Channels for Delivery [return to Table of Contents] The more complex the solution — as in many managed/outsourced services — the greater are the required service provider capabilities. The relatively small and simple nature of Internet IP VPNs, which enable self-management of the VPN infrastructure and operations by business' internal resources, does not present a financially enticing long-term business case for most IT services providers, system integrators (SIs) or outsourcers, or the majority of the carriers. And so, business preferences for an Internet IP VPN service provider tend to favor VPN hardware/software vendors, value-added resellers (VARs) and specialty network consultants to plan, design and implement the technology. A number of ongoing trends will obsolete this approach going forward to the long-term advantage of the larger integrated carriers, including: A growing number of remotely connected sites per client and network complexity Guaranteed performance requirements Need for international reach Sensitive traffic-transmission requirements Synergies of bundling Internet IP VPN remote worker/office access with MPLS network services. Sourcing becomes more difficult for the customer as the overlying application/service needs increase, which is also driving most of the strategic partnerships between competing IT and telecom carriers. The major players in the outsourcing/managed services arena today are the IT services providers (SIs and outsourcers) and the large telecom carriers, each offering wide ranging, and minimally overlapping, expertise, capabilities, processes and financial resources. Each has the expertise of handling most integrated, end-to-end communications solutions with national/international scopes — to a limited degree individually, or more commonly through partnerships. But, most outsourced IP VPN solutions during the next several years will remain relatively "shallow" — generally horizontal (telecom focused) in nature, not vertical (IT/systems/applications integration). This situation plays to the strengths of the integrated carriers during the next several years. The question for a business considering a bundled, managed IP VPN service is how to approach outsourcing — direct from the telecom carrier who may subcontract some or all of the systems integration and LAN management, through a vendor, VAR or consultant with limited telecom provisioning or integration capabilities, or from a SI/outsourcer who subcontracts the telecom component through a carrier. Carriers in strategic partnerships (either ad-hoc contract-specific or industry-specific) with smaller IT SIs and application service providers (ASPs) will dominate the VPN solution market, which is rapidly evolving beyond the typical capability of a vendor or consultant/VAR and not directly in sync with the large SI core competencies. These second tier SI/outsourcers will be more flexible with their relationship (fewer corporate culture issues than their large brethren), offer complementary services for IP VPN solutions, and provide industry-specific experience/processes as needed. The smallest integrators may even be useful to the carrier in a wholesale strategy for the smaller, price-sensitive businesses to maximize market reach/opportunities and revenue potential. Projects for the large enterprise markets that extend deep into the LAN/CPE present a different evaluation dynamic. In these situations, Gartner Dataquest expects the major SIs and outsourcers to be, as a rule, the first choice as the prime contractor for outsourced solutions of the type focused on complex IT infrastructure/systems/applications integration requirements, or highly specialized industry experience/processes — telecom/VPN-specific services being a complementary component. The largest SIs have clear skill set, technology, experience and branding advantages for this type of integration effort and would be difficult to displace in their historical market. Quality Is Key [return to Table of Contents] SLAs based on a specific QOS that may be required for specific applications or type of traffic are increasingly important as customers demand tailored solutions, in addition to flexibility to meet future needs quickly and efficiently. Success for VPN service providers will be measured principally by their SLAs — the breadth of coverage and the level of penalties/hard guarantees these contain. Even minor differences between SLAs are important marketing differentiators in the context of COS, impacting uptake for businesses, and to branding and margins. For managed services, SLAs/QOS vary widely with the reliability of the underlying technology, particularly with IP-based VPNs where standards vary and still are largely under development. In a couple of years, the stand-alone Internet IP VPN packages will be obsolete for all but the smallest, most price-sensitive customers where failure of business processes will not result in a crisis. Handling diverse types of traffic efficiently and cost effectively is the basis for product differentiation. However, before setting expectations, specific SLAs or basic traffic priorities, mission-critical business uses must first be fully determined: What is the network going to be used for? Delay-sensitive services such as videoconferencing need more stringent parameters than simple database access. Is voice part of the portfolio? The genesis of VoIP gateways coupled with the customers' needs to save money by combining voice and data on the same network means that traffic management is more complex. What level of remote office/user connectivity will be required (edge or network-based, CPE-software or edge device-hardware supported), and expansion/contraction requirements? COS [return to Table of Contents] In an MPLS network, COS is critically important for businesses and carriers to prioritize service into levels based on business uses and network requirements: Priority 1 — Highest priority, mission-critical and performance-sensitive traffic with minimal latency and packet loss and requires confirmation of receipt (voice, streaming video, videoconferencing and financial transactions including online transactions) Priority 2 — Mission-critical traffic that only requires an enhanced level of performance (file transfer protocol [FTP], enterprise resource planning [ERP] applications, executive communications and customer communications) Priority 3 — Important traffic for a company's internal and external operations but less time-sensitive than Priority 2 traffic (non-mission-critical financial transactions — payroll, warehousing, database management and employee communications) Priority 4 — No specific prioritization, best-effort, time insensitive traffic (general e-mail, Internet traffic) As differences in distance (local or long-distance), content (voice or data packets look the same), and time (peak or off-peak) continue to fade in importance, these COS categories are the future favored basis for differentiated pricing, with charges per packet/transaction/session levied according to the COS selected by the customer. Depending on the provider and type of access, SLAs also will eventually cover remote access. SLAs are inherently complex agreements, and cover far more than simply network availability. The increased sophistication of the agreements have seen a wider range of parameters becoming standard features, including mean time to respond to faults, mean time to repair faults and the accessibility of help-desk staff (see Table 1).

Table 1
Typical IP VPN Parameters
[return to List of Tables]
Description | Layer 2 Functionality | SLAs | Security | Installation | Traffic Type Applications
MPLS VPN (Network Based) Priority 1 (Highest Priority — Mission-Critical Traffic)
Constant bit rate Guaranteed bandwidth as required Burst not necessary | ATM | Availability: >99.95% Latency (roundtrip): 10-45ms (variable, route specific) Packet delivery: 100% (guaranteed BW) Jitter: 2ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | Broadcast/ streaming video and video- conferencing Mission-critical voice applications Financial transactions and online transactions
MPLS VPN (Network Based) Priority 2 (Mission-Critical Traffic)
Variable bit rate Guaranteed bandwidth = port BW + burst capable > port BW | ATM Enhanced FR SLAs (CIR + nX burst capability) | Availability: >99.95% Latency (roundtrip): 10-45ms (variable, route specific) Packet delivery: >99.95% (guaranteed BW) Jitter: 2-10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | FTP, ERP, CRM Executive and customer communications Compressed video Interoffice voice traffic
MPLS VPN (Network Based) Priority 3 (Important Traffic)
Unspecified bit rate Burst capable = port BW | ATM FR Ethernet | Availability: >99.95% Latency (roundtrip): <45ms (variable, route specific) Packet delivery: >99.9%-99.95% Jitter: 10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | Internet data Corporate data/LAN-remote office connectivity Nonmission-critical financial (payroll) Warehousing and database management Intranet/IP-enabled applications Employee communications
MPLS VPN (Network Based) Priority 4 (No Specific Prioritization; Lowest Priority Traffic)
Unspecified bite rate, best-effort Nonburst capable | ATM FR Ethernet | Availability: >99.95% Latency (roundtrip): >45ms (variable, route specific) Packet delivery: 99.9% Jitter: >10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 Business days <DS3 | Remote worker connectivity Intranet/IP-enabled applications General time insensitive traffic (e-mail)
Internet IP VPN (Edge/CPE-Based)
Unspecified bit rate Burst noncapable Fixed bandwidth | Any access to Internet (dial, PL, FR, ATM, DSL, Cable Modem and ISDN) | Availability: 99% (IP dial); 99.9% (carrier local access); >99.9% (customer access, POP-to-POP) Latency (roundtrip): 55-95ms (U.S. IP backbone edge-to-edge); 95-150ms (U.S./Trans-Atlantic); 120-210ms (U.S./Asia/Pacific) Packet delivery: >99% (typically 99.5%-99.7%) Fault notification time: 15 minutes (U.S.), 30 minutes (international) Restoration time (mean): < 1 Hour Jitter: >10ms Online reporting (with status and performance) | IPsec/L2TP/PPTP Encryption (DES, 3DES, EES, RC-4) Edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 business days <DS1; <60 business days <DS3 | Internet data Corporate data/LAN-remote office connectivity IP-enabled applications Remote worker connectivity