AT&T service architecture ups the ante

Last month at ComNet/DC '99, AT&T announced its Integrated Network Connection (INC) access strategy and an addition to its virtual private network (VPN) services portfolio called Enterprise Class Services. Sprint, MCI WorldCom and Qwest had already made announcements in the advanced services market. AT&T's new position raises the bar relative to these earlier offerings, but it also raises some questions.

The INC portion of AT&T's announcement is clearly related to the Sprint and MCI announcements of Integrated On-demand Network (ION) and On-Net, respectively. All three are directed at providing multiservice access to small and large sites and lean toward ATM as the integration technology of choice.

Where AT&T has gone beyond its competitors is in the next element of its announcement, Enterprise Class Services, and something it calls IP-Enabled Frame Relay. This is nothing less than the first facility-based IP VPN offering that meets customer definitions of a VPN.

With IP-Enabled Frame Relay, a virtual circuit on the INC integrated access pipe links the customer to a VPN that supports all the sites, regardless of the exact number. The VPN has the properties of a frame relay network in that it is based on virtual connections and has specific quality-of-service (QoS) capabilities. It is also as flexible as an IP network.

IP-Enabled Frame Relay will be based on Multi-protocol Label Switching (MPLS) and built with a combination of Cisco MGX ATM switches and routers, all equipped with MPLS support. The combination will allow AT&T to create MPLS tunnels that can be easily mapped to ATM virtual circuits for QoS management and which also can be directed to routers so VPN routing can be embedded in the network. In pure virtual circuit or tunneling VPNs, VPN routing must be provided by the customer because the VPN addresses are hidden from the network.

The AT&T initiative not only represents the first serious entry of a facilities-based carrier into the VPN space, but it also is the first large-scale nontunneled VPN service. Tunneling over the Internet as a VPN architecture has been a media/analyst obsession for two years, despite evidence that businesses don't find that the approach offers enough security or QoS. Maybe now we can move beyond the hype and start dealing with the issues.

Such as? Well, to start off, the AT&T offering makes it clear that while future IP VPNs probably will incorporate MPLS and virtual circuits, they will also offer routing. How VPN traffic, which contains addresses that aren't necessarily unique, is routed by a VPN carrier without mingling all the users is something that needs to be reviewed. There are a number of standards-based and proprietary approaches to this, none of which has received the attention it deserves because of the "tunneling over the Internet" hype. This should change.

The details of the ATM/MPLS marriage is another issue. Cisco may well field the only "standard" implementation of MPLS on ATM switches, meaning one in which each ATM switch contains IP routing features. Other major vendors are all approaching the ATM/MPLS question in what could be called the "black box" approach, in which their entire ATM network appears as a single MPLS-equipped switch/ router. Are all the black boxes equivalent in features? And how will each measure up against a true standard ATM/MPLS approach?

Finally, there's access. AT&T's IP-Enabled Frame Relay VPN will appear to premises equipment as a network of routers and presumably be accessed by a router. In an obscure announcement, Cisco introduced an IP Manager that would simplify the support of edge routers in service access applications. This is clearly a step toward making access routers a more acceptable VPN access strategy, but a number of vendors think that VPN access should be provided through something other than a router.

AT&T receives nearly two out of every three corporate data service requests for proposal, so its new VPN approach will get a lot of exposure. Competitors will be forced to reveal details of their own IP VPN plans - details that will have to go beyond tunneling over the Internet.