| ID Number: TELC-WW-DP-0286 |
IP VPN: Hitting the Big Time
20 January 2003 Charles R. Carr Corporate intranets and extranets are being expanded and are now primarily IP-based. Gartner Dataquest expects robust growth in managed IP virtual private network revenue during the next four years.
* | Recipients who do not own this document will receive a summary only.
| Browse Topics
| Advanced Search
| Ask an Analyst
| Rate This Document
| Downloads:
|  | 112485.pdf (132.9KB) |

Table of Contents
The Need for Network-Connectivity Flexibility What's in This Acronym — IP VPN? Internet IP VPNs MPLS IP VPNs Data Security — Always the Concern Internet IP VPN MPLS and IPsec Channels for Delivery Quality Is Key COS Strong Growth Is Its Future — Drivers and Inhibitors Gartner Dataquest Perspective Recommendations

List of Tables
Table 1: | Typical IP VPN Parameters

List of Figures
Figure 1: | IP VPN Services Topology

Strategic Planning Assumptions By 2006, carriers must have moved up the managed value chain with bundled MPLS/Internet IP VPN offerings to retain enterprise customers that need national/international reach for remote connectivity (0.8 probability). By 2006, MPLS, using Layer 3 routing and capability to efficiently internetwork with other IP networks, will have evolved solidly into the industry's preferred technology/service for replacing frame relay, private line and to a lesser degree ATM services (0.7 probability). By 2006, nearly all large U.S. enterprises will use enhanced IP services (IP VPNs) in some parts of their network, and one in five of these enterprises will have replaced their frame relay networks with these services (0.7 probability). Within the next three years, businesses' top criteria for MPLS/enhanced IP service decisions will be understandable and readily measurable end-to-end SLAs that are backed-up with significant penalties for nonperformance (0.7 probability). Carriers in strategic partnerships (either ad-hoc contract-specific or industry-specific) with smaller IT SIs and ASPs will dominate the VPN solution market, which is rapidly evolving beyond the typical capability of a vendor or consultant/VAR and not directly in sync with the core competencies of large SIs (0.8 probability). The Need for Network-Connectivity Flexibility [return to Table of Contents] Staying competitive inherently pushes business toward improving productivity and cost-saving solutions for operations and communications. This is forcing more complexity into telecommunication products and is a key trigger driving strategies and development of next-generation networks, connectivity and managed services. Even in a down telecom industry, this market pull is readily evident from service providers and technology vendors searching for their next high-margin offering, and bundled IP virtual private network (IP VPN) services (nonInternet IP/multiprotocol label switching (MPLS) and Internet-based IP VPN) are among the most promising. Going forward, MPLS networks will begin to dominate the core of the wide-area network (WAN), enabling service providers the ability to offer integrated networks that are secure and can provide flexible and customizable high-margin services that are critical to retain business customers. Lower-cost IP VPN services — using single, simplified network infrastructure — enable a wide variety of desirable business applications and benefits: Multimedia services using IP multicast and low-latency IP class data service and video applications including video conferencing or remote training/education Voice over IP Outsourced, managed services converging voice, data and video traffic Content hosting for Internet/intranet/extranet applications and services Multiple traffic classes with "application awareness" for prioritizing traffic types, bandwidth management, and time-sensitive traffic handling capabilities Corporate intranets, and most extranets, are now primarily designed as separate Internet and nonInternet IP-based networks because of security concerns. Enhanced IP network services (IP VPNs) offer the competitive advantages of secure, flexible, cost-effective and easy connectivity extension/contraction for the variety of voice and data traffic required by businesses of all sizes. What's in This Acronym — IP VPN? [return to Table of Contents] IP VPNs are managed or unmanaged Layer 3 (network or customer premises equipment (CPE)/edge-based) offerings, providing a full range of metropolitan-area network/local-area network (MAN/WAN) networking functionality using IP backbone transport technology — either a private carrier-operated network or shared public Internet IP network for a closed (or at least well-defined) community of interest. IP VPN offerings take several architectural forms, depending on their intended use: remote access, internal enterprise networking (corporate intranets), or business-to-business networking (corporate extranets). Generally, managed IP VPNs deliver a common set of features: any-to-any connectivity, fault management, configuration management, security management, edge-device management, edge-to-edge service-level agreements (SLAs), and possibly some project management/professional services. Features available in 2003 will increasingly include management tools such as network/service operations monitoring/status reporting capabilities and even end-user controlled/dynamic bandwidth provisioning and service modifications (adds-deletes-changes) in a managed VPN environment. IP VPN types are varied and may include: Internet-based IP VPNs, typically using IP security (IPsec) Multi Internet service provider (ISP) type — End-user managed or third-party managed Single ISP type — End-user managed (with SLAs for transport), third-party managed or ISP managed (possibly with end-to-end SLAs) NonInternet-based IP VPNs (typically using MPLS WAN) End-user managed (CPE) — Not typical Service provider managed (CPE) — Fully meshed and multiple classes of service (COS) Internet IP VPNs [return to Table of Contents] Internet IP VPN is commonly used to define VPN services that are enabled at the edge (CPE/edge-device hardware or software) and usually only provide a single class of service. This type of IP VPN is viewed exclusively as the implementation of secure, end-to-end connectivity by creating tunnels through the public Internet using encryption methods, such as IPsec, data encryption standard (DES) or 3DES. Standards-based approaches for providing Internet IP VPN connectivity include Point-to-Point Tunneling Protocol (PPTP), tunneling protocol (L2TP) and IPsec). MPLS IP VPNs [return to Table of Contents] MPLS VPNs are fully meshed network-based solutions using Layer 3 routing, with a mix of various vendor-specific and standard-based protocols. MPLS improves private IP network traffic management by creating virtual circuits between MPLS-enabled endpoints on the network (with nearly instantaneous automated provisioning capabilities) — streamlining and optimizing the traffic pathway (traffic isolation) and minimizing congestion (see Figure 1). MPLS provides the ability to establish traffic classes, which allow tiered levels of service quality. Although a less common practice today compared to the use of DiffServe-enabled routers, MPLS can handle multiple protocols such as Layer 2 (asynchronous transfer mode [ATM] and frame relay [FR]); and Layer 3 (IP) over the network and enable the migration of many ATM control plane functions to Layer 3, simplifying network management. MPLS has been implemented as an IP overlay on frame relay and ATM networks.

Figure 1
IP VPN Services Topology
[return to List of Figures]
Notes: GW = gateway; FW = firewall Source: Gartner Dataquest (January 2003

Secure MPLS VPNs can be built on-demand by creating IP "tunnels" within the MPLS network without the necessity of using any encryption. However, at its core, MPLS is an IP service, so when any router in the MPLS network connects directly to the public Internet, the network may be at risk from cyber intrusion. If additional security is needed, encryption over MPLS can be provided by adding an IPsec overlay. Adding DiffServ at the edge router will also permit carriers to add COS discrimination to the network although most MPLS networks today are highly over-provisioned and therefore do not need this extra layer of quality of service (QOS). MPLS networks are discrete to each carrier — each endpoint must be enabled by the same service provider because multi-MPLS network interconnection standards have not yet been developed. There are different proposals for using MPLS to provision IP-based VPNs. One proposal is RFC2547-MPLS/BGP VPN, which enables MPLS VPNs using extensions to the Border Gateway Protocol (BGP). MPLS is used for forwarding packets over the backbone, while BGP is used for distributing routes over the backbone. Another method for using MPLS to create VPNs is based on maintaining separate routing tables for the various VPNs. This scheme, defined by implementing the VPN as a set of virtual routers, does not utilize BGP. Data Security — Always the Concern [return to Table of Contents] Internet IP VPN [return to Table of Contents] Internet IP VPN security is accomplished essentially by tunneling through the IP backbone, which involves using one of several techniques to set up a virtual connection on a shared network by means of encapsulating the data in a secure format. There are several techniques of doing this by using standard tunneling protocols such as PPTP, Generic Router Encapsulation (GRE) and Layer 2 Tunneling Protocol (L2TP). Security for this type of VPN involves authentication, which demands the users be able to prove that they are entitled to access the information (user names and passwords), and digital "tokens." The second method is encryption, where the data in the tunnel is scrambled on transmission and unscrambled by the recipient. Currently, the most popular tunneling and encryption technique is the IPsec, which offers data formats, secure key exchange, and encryption/security methods including header authentication for a very robust secure IP VPN service. Other encryption options for an Internet IP VPN include DES and 3DES, escrowed encryption standard (EES), and the RC-4 encryption standard. Other security measures used in conjunction with encryption commonly include a network-based firewall to provide content filtering management, site authentication, virus scan, anti-spoofing, intrusion detection and denial of service protection. MPLS and IPsec [return to Table of Contents] Network-based MPLS IP VPNs allow the service provider to segregate different traffic types from different applications or specific transport protocols to allow tiered QOS on the same route. The inherent level of security of a private IP WAN using MPLS is similar to managed FR or ATM service, and it is significantly better than the public IP Internet. However, MPLS is a shared IP network and is only as secure as its weakest connection/access point. An MPLS VPN would deliver what would be classed as "good enough" security to an end-user on network — effective, but not entirely infallible. Unlike Internet IP VPNs, MPLS VPNs rarely need and thus do not specify packet encryption. However, MPLS does allow added security techniques, such as IPsec, for sensitive or high-value traffic (financial and medical/healthcare). To encrypt packets over MPLS, a whole IPsec overlay would have to be added onto the network. When the MPLS network interconnects with the public Internet, security measures (firewalls) are used at the MPLS network gateways to the public Internet and may occasionally be present at selected MPLS-LAN gateways for critical business locations such as corporate headquarters. These firewalls can include the use of content filtering management, site authentication, virus scan, anti-spoofing, intrusion detection and denial of service protection. Channels for Delivery [return to Table of Contents] The more complex the solution — as in many managed/outsourced services — the greater are the required service provider capabilities. The relatively small and simple nature of Internet IP VPNs, which enable self-management of the VPN infrastructure and operations by business' internal resources, does not present a financially enticing long-term business case for most IT services providers, system integrators (SIs) or outsourcers, or the majority of the carriers. And so, business preferences for an Internet IP VPN service provider tend to favor VPN hardware/software vendors, value-added resellers (VARs) and specialty network consultants to plan, design and implement the technology. A number of ongoing trends will obsolete this approach going forward to the long-term advantage of the larger integrated carriers, including: A growing number of remotely connected sites per client and network complexity Guaranteed performance requirements Need for international reach Sensitive traffic-transmission requirements Synergies of bundling Internet IP VPN remote worker/office access with MPLS network services. Sourcing becomes more difficult for the customer as the overlying application/service needs increase, which is also driving most of the strategic partnerships between competing IT and telecom carriers. The major players in the outsourcing/managed services arena today are the IT services providers (SIs and outsourcers) and the large telecom carriers, each offering wide ranging, and minimally overlapping, expertise, capabilities, processes and financial resources. Each has the expertise of handling most integrated, end-to-end communications solutions with national/international scopes — to a limited degree individually, or more commonly through partnerships. But, most outsourced IP VPN solutions during the next several years will remain relatively "shallow" — generally horizontal (telecom focused) in nature, not vertical (IT/systems/applications integration). This situation plays to the strengths of the integrated carriers during the next several years. The question for a business considering a bundled, managed IP VPN service is how to approach outsourcing — direct from the telecom carrier who may subcontract some or all of the systems integration and LAN management, through a vendor, VAR or consultant with limited telecom provisioning or integration capabilities, or from a SI/outsourcer who subcontracts the telecom component through a carrier. Carriers in strategic partnerships (either ad-hoc contract-specific or industry-specific) with smaller IT SIs and application service providers (ASPs) will dominate the VPN solution market, which is rapidly evolving beyond the typical capability of a vendor or consultant/VAR and not directly in sync with the large SI core competencies. These second tier SI/outsourcers will be more flexible with their relationship (fewer corporate culture issues than their large brethren), offer complementary services for IP VPN solutions, and provide industry-specific experience/processes as needed. The smallest integrators may even be useful to the carrier in a wholesale strategy for the smaller, price-sensitive businesses to maximize market reach/opportunities and revenue potential. Projects for the large enterprise markets that extend deep into the LAN/CPE present a different evaluation dynamic. In these situations, Gartner Dataquest expects the major SIs and outsourcers to be, as a rule, the first choice as the prime contractor for outsourced solutions of the type focused on complex IT infrastructure/systems/applications integration requirements, or highly specialized industry experience/processes — telecom/VPN-specific services being a complementary component. The largest SIs have clear skill set, technology, experience and branding advantages for this type of integration effort and would be difficult to displace in their historical market. Quality Is Key [return to Table of Contents] SLAs based on a specific QOS that may be required for specific applications or type of traffic are increasingly important as customers demand tailored solutions, in addition to flexibility to meet future needs quickly and efficiently. Success for VPN service providers will be measured principally by their SLAs — the breadth of coverage and the level of penalties/hard guarantees these contain. Even minor differences between SLAs are important marketing differentiators in the context of COS, impacting uptake for businesses, and to branding and margins. For managed services, SLAs/QOS vary widely with the reliability of the underlying technology, particularly with IP-based VPNs where standards vary and still are largely under development. In a couple of years, the stand-alone Internet IP VPN packages will be obsolete for all but the smallest, most price-sensitive customers where failure of business processes will not result in a crisis. Handling diverse types of traffic efficiently and cost effectively is the basis for product differentiation. However, before setting expectations, specific SLAs or basic traffic priorities, mission-critical business uses must first be fully determined: What is the network going to be used for? Delay-sensitive services such as videoconferencing need more stringent parameters than simple database access. Is voice part of the portfolio? The genesis of VoIP gateways coupled with the customers' needs to save money by combining voice and data on the same network means that traffic management is more complex. What level of remote office/user connectivity will be required (edge or network-based, CPE-software or edge device-hardware supported), and expansion/contraction requirements? COS [return to Table of Contents] In an MPLS network, COS is critically important for businesses and carriers to prioritize service into levels based on business uses and network requirements: Priority 1 — Highest priority, mission-critical and performance-sensitive traffic with minimal latency and packet loss and requires confirmation of receipt (voice, streaming video, videoconferencing and financial transactions including online transactions) Priority 2 — Mission-critical traffic that only requires an enhanced level of performance (file transfer protocol [FTP], enterprise resource planning [ERP] applications, executive communications and customer communications) Priority 3 — Important traffic for a company's internal and external operations but less time-sensitive than Priority 2 traffic (non-mission-critical financial transactions — payroll, warehousing, database management and employee communications) Priority 4 — No specific prioritization, best-effort, time insensitive traffic (general e-mail, Internet traffic) As differences in distance (local or long-distance), content (voice or data packets look the same), and time (peak or off-peak) continue to fade in importance, these COS categories are the future favored basis for differentiated pricing, with charges per packet/transaction/session levied according to the COS selected by the customer. Depending on the provider and type of access, SLAs also will eventually cover remote access. SLAs are inherently complex agreements, and cover far more than simply network availability. The increased sophistication of the agreements have seen a wider range of parameters becoming standard features, including mean time to respond to faults, mean time to repair faults and the accessibility of help-desk staff (see Table 1).

Table 1
Typical IP VPN Parameters
[return to List of Tables]
Description | Layer 2 Functionality | SLAs | Security | Installation | Traffic Type Applications
MPLS VPN (Network Based) Priority 1 (Highest Priority — Mission-Critical Traffic)
Constant bit rate Guaranteed bandwidth as required Burst not necessary | ATM | Availability: >99.95% Latency (roundtrip): 10-45ms (variable, route specific) Packet delivery: 100% (guaranteed BW) Jitter: 2ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | Broadcast/ streaming video and video- conferencing Mission-critical voice applications Financial transactions and online transactions
MPLS VPN (Network Based) Priority 2 (Mission-Critical Traffic)
Variable bit rate Guaranteed bandwidth = port BW + burst capable > port BW | ATM Enhanced FR SLAs (CIR + nX burst capability) | Availability: >99.95% Latency (roundtrip): 10-45ms (variable, route specific) Packet delivery: >99.95% (guaranteed BW) Jitter: 2-10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | FTP, ERP, CRM Executive and customer communications Compressed video Interoffice voice traffic
MPLS VPN (Network Based) Priority 3 (Important Traffic)
Unspecified bit rate Burst capable = port BW | ATM FR Ethernet | Availability: >99.95% Latency (roundtrip): <45ms (variable, route specific) Packet delivery: >99.9%-99.95% Jitter: 10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 business days <DS3 | Internet data Corporate data/LAN-remote office connectivity Nonmission-critical financial (payroll) Warehousing and database management Intranet/IP-enabled applications Employee communications
MPLS VPN (Network Based) Priority 4 (No Specific Prioritization; Lowest Priority Traffic)
Unspecified bite rate, best-effort Nonburst capable | ATM FR Ethernet | Availability: >99.95% Latency (roundtrip): >45ms (variable, route specific) Packet delivery: 99.9% Jitter: >10ms Restoration time (mean) Online reporting (with status and performance) | MPLS gateway firewall IPsec/encryption optional MPLS edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 Business days <DS1; <60 Business days <DS3 | Remote worker connectivity Intranet/IP-enabled applications General time insensitive traffic (e-mail)
Internet IP VPN (Edge/CPE-Based)
Unspecified bit rate Burst noncapable Fixed bandwidth | Any access to Internet (dial, PL, FR, ATM, DSL, Cable Modem and ISDN) | Availability: 99% (IP dial); 99.9% (carrier local access); >99.9% (customer access, POP-to-POP) Latency (roundtrip): 55-95ms (U.S. IP backbone edge-to-edge); 95-150ms (U.S./Trans-Atlantic); 120-210ms (U.S./Asia/Pacific) Packet delivery: >99% (typically 99.5%-99.7%) Fault notification time: 15 minutes (U.S.), 30 minutes (international) Restoration time (mean): < 1 Hour Jitter: >10ms Online reporting (with status and performance) | IPsec/L2TP/PPTP Encryption (DES, 3DES, EES, RC-4) Edge firewall option (content filter, virus scan, intrusion detection and authentication) | <40 business days <DS1; <60 business days <DS3 | Internet data Corporate data/LAN-remote office connectivity IP-enabled applications Remote worker connectivity
Note: ms = millisecond, CIR = committed information rate, DES = data encryption standard, EFS = encrypting file system and CRM = customer relationship management. Source: Gartner Dataquest (January 2003)
Download Data ... About Downloading

Strong Growth Is Its Future — Drivers and Inhibitors [return to Table of Contents] Overall, managed IP VPN revenue growth is expected to be robust during the next four years in North America despite the current economic environment and industry problems, and particularly strong growth for CPE (software and hardware)-based Internet IP VPNs. This growth rate will far exceed any other managed or nonmanaged data services growth. Gartner Dataquest forecasts MPLS/Internet IP VPN revenue compound annual growth rate (CAGR) for the United States at 57 percent and for Canada at 78 percent from 2001 to 2006. While these percentage growth rates are on a comparatively small starting revenue base, the actual revenue will be significant compared with other managed services in the United States, growing from about US$700 million in 2001 to almost US$6.8 billion by 2006, and in Canada to almost C$1 billion. At present, the vast majority of this revenue is Internet IP VPN with only a couple percent coming from network MPLS solutions, which will become the major contributor by 2006. These forecasts are illustrative of the ongoing migration toward enhanced IP-managed services, which will increase from about 37 percent of all managed services revenue in 2001 to almost 58 percent in 2006 for North America. Similarly, the emphasis will increasingly be on the management component, compared with edge device/access/transport, for these types of services accounting for over 55 percent of the revenue pie by 2006. IP VPNs have a near universal applicability for small and midsize businesses (SMBs) in an increasingly dispersed global business environment that is highly dependent on remote worker/office connectivity. Recognizing the tight IT/telecom budget and capital expenditure environment, the key business survival phrase has become "do more with less." Recent Gartner Dataquest surveys show a condensed group of core requirements (drivers) for businesses to fill using managed services, and managed IP VPNs. The top five are listed in relative order of importance as follows: Cost-effective, broadband remote worker and remote office connectivity to corporate LANs nationally and internationally using multiple-access methods compared with traditional technologies Flexibility and scalability (expansion and contraction) of networking needs, quick provisioning and bandwidth upgrades. MPLS' automated provisioning capabilities can significantly reduce the provisioning cycle, making it nearly instantaneous. Improved network and remote connectivity security for remote worker/office access using Internet IP VPNs Simplified networking and improved operating efficiency. MPLS improves IP network traffic management, streamlines traffic pathways (traffic isolation), optimizes traffic paths and minimizes congestion. New application enablement for businesses and the opportunity by carriers to cross sell services from their IP portfolio, such as hosting, security services, IP-based applications such as VoIP, IP-private branch exchange (PBX)/Centrex, IP conferencing, collaboration, unified messaging, VoIP and latency sensitive applications requiring any-to-any or peer-to-peer connectivity provided by MPLS. On the other hand, the down side when considering new, complex technologies and large-scale implementation is a range of real world inhibitors to growth, offsetting the hype surrounding managed IP VPN services. The top five in relative order of importance are: Lack of a proven cost-reduction track record or a clear price/cost advantage over existing data services (QOS being equal), particularly for large networks. Typically meshed topologies favor an MPLS approach and average hub-and-spoke networks favor FR on a cost basis. Failure to achieve projected cost-savings is one of the top reasons cited for businesses to drop their managed services. Currently hidden costs (borne by individual business units or dispersed among IT departments) would now be highly visible through management cost line items. Combine this with a tight IT/telecom budget environment in most businesses sectors and resistance to spending on new infrastructure slows near-term uptake. Lingering security concerns (largely false perception at this point). While MPLS security is inherently similar to ATM and FR, at its core it is still an IP service. So if any router in a network connects to the Internet, the MPLS network is subject to attack and will require additional security. Complex pricing/billing models that are difficult to decipher and fully understand (non-intuitive), compared with utility models (pricing per location/port/desktop and pricing tied to predefined deliverables and COS/QOS or pay-per-use/per-diem basis. This issue is already diminishing with newer offerings. Ongoing concerns with management reliability and integration problems for complex IP solutions and still evolving standards. Closely related is the uncertainty about many service providers' ability to ensure quality global support and single point of contact. Lack of trust/confidence in the service provider to deliver on the promises, as exhibited by concerns over diminished control by telecommunications/IT managers, and the difficulty bringing back operations in house if dissatisfied or cost savings do not materialize. Penalties are rarely an effective substitute for performance. Gartner Dataquest Perspective [return to Table of Contents] The overarching goal of major carriers during the next three years must be to stabilize and begin to improve revenue and margins, while retaining their strategic customer base and keeping an eye to Wall Street's expectation of profitable operations. These goals can be achieved, at least in part, through deployment of managed services to stay ahead of the price commoditization curve. Managed IP VPN (MPLS/Internet IP VPN) services offer providers a prime path to ramp their product portfolios with minimal additional investment in their IP infrastructure, and significant product differentiation. MPLS and Internet IP VPNs, as an integrated product set, provide enterprises the clearest promise of a flexible and cost-effective end-to-end networking solution and will be an important element to help the telecom industry regain its market footing. MPLS has gained significant visibility over the last year or two — probably more quickly than it originally deserved at its current maturity, thanks in large part to a significant push by technology vendors, rather than carriers, and without fully articulating the benefits and its limitations to enterprises. The result, however, has been to push carriers to move more quickly on enhanced IP network VPN deployment than would normally be expected. Specifically, MPLS has taken the promise of CPE-based Internet IP VPNs any-to-any connectivity and ease of expansion over the Internet to the next level. Private IP network functionality, typically using MPLS, offers better performance, QOS, stronger SLAs, any-to-any connectivity IPsec defined tunnels, accommodates FR and ATM virtual circuits, and provides a platform for managed services. Unlike Internet IP VPNs, MPLS VPNs rarely need and thus do not specify packet encryption. However, MPLS does allow added security techniques, such as IPsec, for sensitive or high-value traffic (financial and medical/healthcare). To encrypt packets over MPLS, a whole IPsec overlay would have to be added onto the network. Security measures (firewalls) are always provided at the MPLS network gateways to the public Internet. Long-term, Internet IP VPNs will be a valuable remote access complement to IP network services, which provide the site-to-site WAN component. Internet IP VPNs will be almost exclusively for those locations where low-cost and geographic reach is important, and QOS is not. Other factors are as follows: MPLS has accelerated the migration from established/managed data services (FR, ATM and private line), despite its immaturity. With all major vendors and nearly all carriers backing MPLS, it is destined to become the fastest-growing WAN solution for enterprises by 2006 (0.8 probability). Thus it will be critical for carriers to move up the managed services value chain as quickly as possible to retain customers with national/international reach. CPE (software/hardware)/premise-based Internet IP VPNs and revenue will dominate the newer MPLS network-based VPN services through the early part of the forecast period, but both will experience robust growth, and increasingly, Internet IP VPN services will be bundled with MPLS offerings to provide cost-effective national/international reach and easy expansion/contraction (0.8 probability). Enhanced IP/MPLS services have been principally offered as an IP overlay to FR and ATM — a cost-effective WAN alternative to FR and private line services with "organic" growth resulting from increasing demand for any-to-any remote connectivity and expansion of existing networks. By 2006, MPLS, using Layer 3 routing and capability to efficiently internetwork with other IP networks, will evolve solidly into the industry's preferred replacement technology/service for FR, private line and to a lesser degree ATM services (0.7 probability). By 2006, nearly all large U.S. enterprises will use enhanced IP services in some parts of their network, and at least 20 percent of these enterprises will have replaced their FR networks with these services (0.7 probability). The underlying WAN transport technologies are essentially transparent to the end user, and ownership of the infrastructure is increasingly less important compared with guaranteed SLAs. By 2005, the top criteria for MPLS/IP VPN service decisions by businesses will be understandable and readily measurable end-to-end SLAs that are backed by significant penalties for nonperformance (0.7 probability). Because of the "shallow" nature (more horizontal, telecom services focus) of IP VPN solutions during the next several years, carriers in strategic partnerships (either ad-hoc contract-specific or industry-specific) with smaller IT SIs and ASPs will dominate the VPN solution market, which is rapidly evolving beyond the typical capability of a vendor or consultant/VAR and not directly in sync with the large SI core competencies (0.8 probability). Recommendations [return to Table of Contents] Network Service Providers Ensure that the resources to monitor, implement, secure and support the VPN solution are built into the offering before launching the service. There's no second chance in outsourcing this type of service, success comes with the ability to deliver and guarantee SLAs/COS. Provide an easy/pain-free migration strategy for customers from existing data services with minimal capital investment. Sell the service's SLAs/COS and not an underlying technology. MPLS and Internet IP VPNs will provide a compelling entry for internal sales of bundled IP services. Business models should be based on overlaying value-added services, not on transport or access. Use existing channels to market IP VPN services, such as inside sales of customers currently using the carrier-owned ISP or Internet data center. Carriers must plan to offer a complete IP product portfolio around MPLS to address the full market potential by using IP VPNs for smaller remote office/worker connectivity and extranet access, and MPLS network for site-to-site WAN service. There is a need to develop the capability to effectively deliver voice services and public switched telephone network (PSTN) on/off ramps over a converged MPLS platform. End-User Businesses Regarding the uncertainty to date of cost benefits from MPLS network services, enterprises should perform a comprehensive cost-risk analysis using tangible and nontangible costs against a full accounting of their network needs before committing. Businesses should be wary of entrusting their entire communications portfolio to a single service provider. Piloting and a phased approach is the most prudent course to proving the net benefits of outsourcing enhanced IP services such as MPLS and Internet IP VPNs. Negotiate shorter-term contracts, as practical, containing clearly defined exit provisions such as specific performance, failure to meet cost-savings targets and financial difficulty of the service provider. The contract should provide for secure, independent backup network capability in the event of network failure. Require an understandable and clearly defined pricing structure Ensure the SLAs/COS take into account your near-term, but more importantly, long term business needs (national/international reach, business office locations/expansion/contraction). Be proactive in negotiating SLAs at all stages of a phased implementation. Develop a strong relationship with the service provider and evaluate potential candidates using a supportive partnership potential criteria when selecting MPLS or Internet IP VPN services. While it is a buyers' market, price should not be an overriding factor. Key Business Issue How important are managed data services and value-added services in this market?

| Browse Topics: VPN Services Value Added IP Services |
| © 2004 Gartner, Inc. and/or its Affiliates. All Rights Reserved. Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The opinions expressed herein are subject to change without notice. |

Resource Id: 383689