Vendors look to tame VPN technologies

By Tim Greene
Network World, 09/25/00

In the next few months, vendors will add new features and services aimed at making VPNs as simple as ABC.

Equipment makers Intel and Motorola are hurrying to make it easier to set up VPNs and to train corporate IS staff in how to use their gear. The vendors are developing VPN appliances or small routers that plug in to branch-office networks, making it relatively simple to extend secure IP connections across an enterprise. Corporate IT professionals want to install the gear without sending IT staff out to branch offices.

Subscribe to the VPN newsletter

Equipment vendors are also making VPNs manageable by the same platforms that manage their larger VPN equipment. At the same time, the prices of VPN devices are dropping and performance is improving, making VPN access available to more sites.

This all should help network executives make the leap to at least try VPNs, which are secure networks that run over a shared public IP infrastructure including the Internet that can save on the cost of network transport. Interest seems high - customers are expected to spend $1.2 billion in VPN services this year, and that is estimated to grow to $8.8 billion in 2004, according to IDC in Framingham, Mass. Customers are predicted to spend $1.8 billion on VPN gear this year and $7.2 billion in 2004, IDC says.

One vendor helping this cause is Check Point Software, which has written a slimmed-down version of its venerable Check Point Firewall-1 and VPN-1 software to reduce cost by requiring less-powerful processors. The light versions are called Firewall-1 Small Office and VPN-1 Small Office, and lack some of the features of the originals. The company says small offices don't need features, such as the ability to lash two boxes together so if one fails the other picks up the load.

Check Point is licensing these firewall and VPN products to other manufacturers that are building products around them. During the next three months, Ramp Networks, for example, plans to install the software in DSL hardware. So customers can sign up for a DSL service, place a Ramp 2700 router between the DSL modem and the LAN, and enable the site for a VPN and protect it with a firewall.

Ramp is also putting Check Point's Firewall-1 Small Office software on a router that includes a DSL modem. This device, the Ramp 610i, would be installed by service providers. If customers want a managed firewall service, the carrier could turn on the firewall. Later, Ramp plans to add VPN-1 Small Office to the box as well.

The devices can be centrally managed by Check Point's Site Manager and Provider-1 management software. Enterprise users or service providers can manage the remote boxes as part of wholly owned VPNs or part of VPN services.

Ramp charges $1,098 for the 610i, $998 for the 1700 and $1,798 for the 2700.

Meanwhile, Intel this month will boost the capabilities of its small-office routers by adding its own IP Security VPN software to its 8200 and 9500 Express routers for an extra $499.

The company is also introducing a new product line called NetStructure that includes a branch-office VPN router, NetStructure 3110, which is priced at $3,495. It can handle up to 100 simultaneous tunnels and process packets at 2M bit/sec, fast enough to fill dedicated connections such as T-1 lines or typical DSL links. NetStructure 3120 ($10,995) is for larger sites and can handle 20M bit/sec throughput and 2,000 simultaneous tunnels.

In addition, NetStructure includes two central-site-sized VPN routers, the 3125 and 3130 ($20,995 each), which can handle up to 95M bit/sec throughput. The VPN equipment comes with built-in firewalls.

The gear also comes with PC client software with features that make it easy to distribute and simpler to work with for end users. The client software can be deployed via e-mail and updated automatically when users log on to the VPN. The software will also automatically log users on to specific Windows NT domains within the VPN so they don't have to log on themselves.

Also entering the VPN field is Motorola with a small office/home office box called the Vanguard 340. It is designed to support dedicated Internet connections such as T-1 or DSL and supports IP Security tunneling. It includes a firewall, as well. It costs $1,700, and will be part of a series of VPN products Motorola plans to announce in November.

Faced with customers who lack the time and resources to implement VPNs on their own, service providers who haven't offered VPN services before are developing them to roll out by year-end.

Comdisco, noted for its disaster-recovery services, is branching out into managed VPN services, for instance. While the company has been building and managing VPNs for corporate customers on a case-by-case basis, it will standardize these services later this month.

The company plans a telecommuter service based on Nortel Networks gear and a site-to-site service built around Cisco equipment. Pricing has not been set.

New types of VPN service providers are cropping up as well. OpenReach, a start-up that supplies VPN software to turn PCs into VPN gateways, this month is expanding the features it offers to include a firewall, certificate-based authentication and online reconfiguring of the VPN.

These features are being added to OpenReach's TrueSpan service at no cost above its existing fee of $99 per month per site.

TrueSpan is designed for companies that want a simple VPN, says OpenReach's CEO Mark Tuomenoksa. OpenReach requires only that customers have a dedicated Pentium-class PC, Internet access and use of a Web browser. Armed with these basic weapons, customers download software that turns the PC into a VPN server that they distribute to sites they want connected to the VPN.

OpenReach assigns each PC gateway an IP address and distributes a list of IP addresses of the other gateways in each VPN so a network administrator doesn't have to do it by hand. The gateways use digital certificates issued by OpenReach to identify themselves.

The expanded features are intended to make the service even simpler to use. The previous version of TrueSpan worked with other vendors' firewalls but required reconfiguring the firewalls. With the new service, customers tells OpenReach the rules it wants enforced and OpenReach handles the configuration.

Similarly, a start-up called e-Tunnel is introducing a service this month called VPN-On-Demand, a VPN provisioning platform that allows service providers to provision customer VPNs. Service providers, such as ISPs, buy VPN-On-Demand from e-Tunnel and sell VPNs to their ISP customers.