Putting VPNs to Work for
Small Businesses and Offices
WHITE PAPER
By Michael Kennedy, Ph.D.
Director of Consulting Services
Strategic Networks
1998 Strategic Networks. All rights reserved. 3/10/98
Putting VPNs to Work for Small Businesses and Offices
M
odern business processes demand tight links between mobile users, customers and third parties
on both a temporary basis (project-based) and permanent basis. Virtual Private Networks
(VPNs) can provide significant business benefits by overcoming the barriers to achieving
widely-available and secure communication. VPNs provide the appearance of a single network
connecting corporate offices, telecommuters, customers, and even competitors, while using separate
public and private networks. A company retains control of user access and the privacy and integrity of its
data even though the data travels on the public Internet. VPNs can provide as much as 60 percent cost
savings over private leased lines and significantly reduce telecommuter dial-up charges.
VPNs and their many benefits, however, have traditionally been the domain of larger organizations.
These huge companies enjoy access to the capital and scale necessary to build VPNs and have the
technical staff to maintain them. They are able to use VPNs to enhance and sustain their competitive
advantage over their smaller and less technically sophisticated competitors. In practical terms, the
benefits of VPNs have been off limits to small- and medium-size businesses. And, even larger
organizations have had difficulty deploying VPNs in branch offices because they are often too small to
justify onsite IT staff.
The barriers to creating and maintaining a VPN include the need to construct and maintain a secure
physical infrastructure and administer a wide range of data communications services. The infrastructure
challenges include setting up access equipment, firewalls, servers, telecommunications services and
maintaining connections to multiple Internet Service Providers (ISPs) at hundreds or even thousands of
enterprise locations. Administrative challenges include maintenance of servers, synchronization of
software upgrades, replication of Web servers, and sophisticated policy management spanning the whole
network. Services that must be supported include email, directory, internal and external Web, firewall,
ftp, and access control.
Virtual Services Management (VSM) technology and secure VPN transports are making VPNs
realistically deployable for smaller organizations and branch offices. VSM solves the service-related
headaches of multiple points of administration required when setting up multiple sites, users, devices and
Internet Service Providers (ISPs). Through use of low-cost, easily managed, and secure VPNs, the
benefits of improved business management practices can be realized by even medium and small
companies.
Page 2
Emergence of the Virtual Private Network
Figure 1
Today’s Enterprise Networks
Today’s private networks resemble the network in Figure 1. Basic connectivity is provided to a wide
variety of locations, but the overhead costs are severe. The functionality includes:
Remote Access. Remote access has matured from a “nice-to-have” option to a business-critical
requirement to support a mobile workforce and telecommuters. For example, utility companies are
increasing the productivity of their field service workers and eliminating the cost of maintaining
distribution centers by applying remote access technologies. Line crews take their vehicles home with
them and receive their day’s work orders through either telephone or wireless dispatching systems. This
setup eliminates the time it takes to report to the service center, pick up the service vehicle, and drive to
the first job site. Remote access creates a win-win-win situation for the company, worker, and customer.
The utility company realizes increased worker productivity, reduced transportation costs, and reduced
building and land costs. The worker eliminates commuting time and expense, while customers obtain
faster, more responsive service, and lower rates.
Sales and marketing organizations are especially reliant on remote access capabilities. The use of remote
access capabilities and laptop computers enables sales people to complete contracts and obtain real-time
Page 3
technical sales support while being face-to-face with customers—meeting customer needs and resolving
buyer objections through a single sales call and resulting in more successful sales and shorter sales cycles.
Intra-corporate Core Connectivity. Business process reengineering programs and application of
Enterprise Resource Planning (ERP), such as SAP, succeed by eliminating barriers to communications
across departmental boundaries and by replacing slow paperwork procedures with shared electronic
databases. These management practices and the associated computer software require reliable, high-
speed and secure communications among all employees. The same high level of communications
connectivity is required at all of the enterprise’s establishments. This setup typically requires that small
offices and branch offices be upgraded to the higher standards more commonplace at large headquarters
locations. The payoff for successful ERP implementation is an order-of-magnitude reduction in cycle
times, increased flexibility and responsiveness, and sharp reductions in IT overhead costs.
Closed User Groups with Partners, Customers and Suppliers. Some of the most dramatic
improvements in business processes are obtained by eliminating certain sub-processes entirely. The
supply chain is one business process where big improvements are being realized. For example, Boeing
suppliers are required to participate in its supply network. This enables Boeing to eliminate stores and
parts costs entirely by moving those functions back into the supplier’s operation. Similar successes have
been achieved in sales and marketing. In another example, Saturn customers can step through the entire
sales process online. Saturn reduces selling costs and provides prospective customers with full and
accurate examination of options and features independent of high-pressure sales people. Saturn also
offers prospective buyers direct access to engineers and product experts at headquarters.
Highly technical sales organizations can create lock-in relationships with their customers through creation
of closed user groups. For example, semiconductor manufacturers provide online engineering design
tools so that circuit designers can incorporate the manufacturer’s chips directly into finished designs.
Closed user groups not only assure product loyalty, they also provide value to circuit designers by
reducing cycle times.
Public Internet Access. Essentially all functional areas can benefit from public Internet access.
Accounting organizations retrieve forms and advice from federal, state, and local revenue offices. Human
resources organizations use the Monster Board for recruiting. Mechanical designers can peruse online
parts catalogs and download CAD/CAM drawings directly into their blue prints. Energy marketers buy
and sell natural gas through Internet-based trading systems and retrieve weather data from government
and private sources. Pension fund managers follow the financial markets and retrieve stockholder
information from company Web pages. IT professionals stay ahead of industry developments and
product releases by studying computer and software vendors’ online product literature. The business
benefit of most of this activity is faster and better informed decision making.
Internet-based Customer Interaction. Retail sales and service companies operate on thin operating
margins. Their success depends on executing transactions rapidly and at low cost while giving the
customer the appearance of custom-tailored service—this is sometimes referred to as mass customization.
Industries such as airlines, utilities, banks, brokerage, insurance, and mail order retailers know that
market segmentation, customer loyalty, and low transaction costs are the keys to their success (or
survival). Of course, the more time customer service representatives spend with customers and the more
they can learn about customers, the better the market segmentation and the customer relationship.
Unfortunately, this tender-loving care costs money and drives up transaction costs.
Page 4
Well-designed Internet-based customer interaction systems resolve this dilemma by eliminating customer
service staffing costs and simultaneously providing customers with many custom choices. Information
provided by the customer during these online sessions flows directly to the enterprise’s data warehouse
and is used by data-mining tools to further refine the market segmentation models. Brokerage and
financial services firms are especially effective at using the Internet to drive down small-lot trading fees
and eliminate the cost of account representatives. For example, a trade of 100 shares that once cost
several hundred dollars can be done on the Internet for ten dollars. As another example, airlines including
United Airlines, provide Web pages where customers can shop for the best price and schedule, and book
their travel over the Internet.
Web Presence. The public Internet is rapidly replacing mass media including television, radio, and print
as the vehicle for certain product and institutional advertising. While essentially all businesses feel
compelled to have a Web page, it is essential in many industry segments. Use of Web pages is firmly
entrenched in the IT industry itself, financial services, education and government services. The key item
these enterprises share in common is a need for dissemination of large quantities of time-sensitive
information to millions of people.
While these enterprises gain high value from rapid and cheap dissemination of information through
Internet Web pages, they also face large risks. Incorrect or false information could destroy public trust
that was built up over decades. Slow information access or unreliable access could create an image of
ineptitude or unresponsiveness damaging institutional loyalty and trust. Failure to safeguard customer
data and protect privacy could, at best, destroy trust and, at worst cause financial ruin. Thus, a Web
presence can be effective in reaching the mass market, but security and reliability must be assured.
Getting Real Business Value from Virtual Private Networks
The preceding section describes six ways data communications can be used to produce business value.
However, today’s data communications networks are failing to deliver the value, because they are too
complex and costly. VPNs provide more efficient and secure data communications at a fraction of the
cost of today’s network architectures. In particular, VPNs reduce the administrative effort and costs of
building and operating private networks. This is particularly true as customers, suppliers, and third
parties are added to the network. Figure 2 shows the emerging VPN architecture.
Page 5
Virtual Private Network
Figure 2
One difference between the VPN architecture and today’s private network architecture is that the VPN
architecture is seamless. Users in each enterprise, regardless of their location at headquarters or on a
wireless link, obtain the same access and logical view of services, despite being served by a number of
ISPs and through different physical media. Another difference between the private data communications
network and the VPN is that business users never see the network complexity, and network
administrators are freed from complex network engineering tasks.
Virtual Service Management
Many of today’s VPNs have focused only on providing a secure transport, the network “plumbing”. But
in practical terms, the benefits of VPN have been off limits to smaller businesses and organizations with
limited IT staff and resources, because of the technical complexity of setting up and administering a VPN.
Virtual Services Management (VSM) is critical to making a VPN easy to administer and manage across
multiple locations and services.
The administrative challenge of creating and maintaining a VPN is formidable. A single enterprise often
must accommodate headquarters, campuses, branch offices to home offices, and users who want to use a
range of applications and services, and have specific accessing privileges and options. In addition,
modern management practice requires many additional links to suppliers, customers, and third parties, as
well as access to the public Internet with its 100 million computers.
Through a single point of administration anywhere on the network (local or remote), VSM technology
simplifies the administrative burden of setting up multiple branch office e-mail, Web, firewall, and other
Page 6
user services; multiple domain and user names; and coordination among multiple ISPs. It also simplifies
the administrative burden through automatic synchronization of software upgrades, replication of web
servers, and sophisticated policy management. VSM overcomes the barrier to private network
implementation and VPN that could previously be addressed by only a handful of the largest, more
technically-sophisticated enterprises.
VSM can help resellers by making it easy for them to add services without raising the level of technical
support they will need to provide. This can by done with service providers or as a stand-alone value-
added feature. Similarly, service providers can take advantage of VSM and VPNs to provide a value-
added network feature to their customers. VPN services are typically provided on a monthly fee basis
and often require customers to perform the network configuration and route determination for their VPN.
Where the customer is doing much of the work already, customers often acquire the lines and build a
VPN network using CPE products such as those from FreeGate (described below). Many enterprises are
finding if they partner with their service provider to produce a VPN solution, it can be a very effective
way to take development costs out of the equation.
Secure and Reliable Networking Transport
To provide secure and reliable transport across the network, three main issues must be resolved:
• Overall network security
• Wide-area network tunneling
• Class of Service and Quality of Service
Products and standards are in place to provide overall network security while emerging standards will
soon resolve the other two issues.
Four functions are key to overall network security:
1. Authentication - Verify the identity of the user
2. Authorization - Verify which services the user is allowed to access
3. Accounting - Create an audit trail of the user’s network activity
4. Encryption - Protect data privacy
These four functions are typically provided by access control lists in routers that restrict access to data
packets and network segments in both directions. Firewalls provide more sophisticated control of
incoming and outgoing packets at the network’s edge. Authentication and authorization is provided by
services such as PAP or CHAP and by security servers. Proxy-application servers and the network
operating system provide additional network security. These necessary services and products are now
widely deployed in ISPs and private networks.
Wide-area network tunneling is a technique that establishes a secure network connection across the
public Internet. Trade press articles sometimes equate VPNs to tunneling. Our view is that tunneling,
Page 7
while an essential ingredient of the VPN solution, is but one element of the VPN and that administrative
and reliability issues are at least as important to successful VPN adoption. Major networking vendors
have advanced proposed tunneling standards such as PPTP and L2F. Much marketplace confusion has
resulted from these competing standards. Happily, it appears that a compromise approach called L2TP
will resolve the differences between these competing standards and will soon emerge from the IETF
standards setting process.
Implementing the VPN
The key to deploying a VPN is to give the appearance of a seamless network with identical user services
at all locations—headquarters, branch offices, home offices, and those of partners, suppliers, and
customers. One approach to VPN implementation for small and medium-sized organizations is to deploy
FreeGate’s line of all-in-one Multi-services Internet Gateway systems at the network edge between each
enterprise site and the local ISP. The Multi-services Internet Gateway integrates Internet server, firewall,
and networking functionality for organizations that want to take greater advantage of the Internet without
adding a complex and costly assembly of boxes and IT staff.
FreeGate’s VSM software provides a set of tools for single-point administration of VPN services. Figure
3 shows how the three versions of its VSM software -- Branch VPN, Remote VPN and Extranet VPN --
can be used.
Figure 3
Branch VPN connects a company’s remotely-located, LAN-attached offices. This server-to-server
product requires a FreeGate system at each branch location. Class of Service policies, such as access
privileges and priorities, are applied as if the branch users were physically located at headquarters.
Page 8
Security is implemented through the emerging industry-standard IP Security (IPsec) protocol, which will
provide DES encryption, authentication, and key management.
Remote VPN enables mobile workers and telecommuters to dial into a local ISP to access corporate
information and service making it appear as if they were sitting at their desks in the main office. This
client-server product requires a FreeGate system at headquarters and Microsoft’s Point-to-Point Protocol
(PPTP), available with MS Windows clients on the remote user’s desktop or laptop system. A PPTP
server in the FreeGate system authenticates the remote user, then opens an encrypted path through which
traffic flows as if through the LAN.
Extranet VPN opens a corporate network selectively to suppliers, customers, strategic business partners,
and users having access to a limited set of information behind the corporate firewall. VPN Extranet
differs from Branch VPN and Remote VPN in that its use is likely to involve temporary virtual networks
which may be set up for specific projects and dismantled as the projects end.
This solution is simple to deploy because all necessary service management, security, and Quality of
Service functions are combined in each Multi-services Internet Gateway and because all the systems are
administered as they are on a single local network. The supported services include all of the
administrative, security, and reliability requirements of the VPN:
• IP router
• Web server
• Firewall
• Email
• File transfer (FTP)
• Domain Name Service (DNS)
• Dynamic Host Configuration Protocol (DHCP)
• Remote management
Hardware costs are minimized because all the necessary administrative, security and reliable transport
functionalities are combined in a single unit. Administrative and operating expenses are controlled
through the VSM software which permits management of all sites from a single point—minimizing the
need for costly data communications experts.
Conclusion
The VPN supports the business needs of a company by eliminating the technical and administrative
obstacles to rapid electronic information flows within a company and with partners, customers, and
suppliers. The VPN delivers the same networking services to all parties whether at large or small sites
and across multiple ISP networks. Virtual Services Management makes it economical for small- and
medium-sized enterprises to build VPNs and permits delivery of corporate networking services out to
Page 9
even the most remote corporate outpost. The VPN’s low cost and uniform networking environment
supports the implementation of business strategies necessary to achieving and maintaining a sustainable
competitive advantage.
About Strategic Networks
Strategic Networks, headquartered in Rockland, Mass., was founded by Nicholas J. Lippis, III in 1991,
and has emerged as one of the leading consulting firms for the networking industry. The company
provides consulting, advisory services, product testing and analysis, baselining and capacity planning, and
a series of global seminars for both the enterprise and service provider markets. Strategic Networks'
consultants help service providers and equipment vendors plan, deliver and communicate the right
solution to the right market at the right time. The company has developed network architectures for
Global 2000 companies. The consultants are considered leaders in the industry and are quoted often in
industry trade publications and national business press. In addition, they publish regularly in many major
trade publications, including InternetWeek, Data Communications, [Link] and Telecommunications
Magazine, and sit on the planning committee for NetWorld+Interop.
More information on Strategic Networks is available via the World Wide Web at [Link]
Page 10