Service providers want your VPN business, 09/27/99

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.

If the server does not wish to make this information available to the client, the status code 403 (Forbidden) can be used instead. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address.

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.

By TIM GREENE
Network World, 09/27/99

Some ISPs offer packages that connect all your sites over their wholly owned IP backbones, thereby avoiding the Internet. That option lets you skirt the uncertainty of Internet performance and gives you some recourse if the link fails.

ISPs such as AT&T, GTE Internetworking and UUNET even offer service-level agreements, although the SLAs are limited to availability, lost packets and the speed with which your traffic crosses their networks. VPN SLAs don't give priority to individual applications.

What's more, the SLAs don't provide guarantees against security breaches. Such guarantees are pretty much ruled out for legal reasons. It's too difficult to define what a security breach is and to determine what value to place on whatever losses you can identify, says Rob McKinney, director of VPN and Internet security for GTE Internetworking.

It's no doubt easier to let an ISP serve up a VPN than to build one yourself, but there is a drawback: A service provider may take security shortcuts.

If the service provider doesn't tunnel your traffic until it reaches its network, that leaves your data insecure between your sites and the carrier network, says Chris Liljenstolpe, a senior network engineer for Cable & Wireless and a member of the VPN test team at NetWorld+Interop '99 in Las Vegas.

The problem is surmountable. You could let the service provider start the tunnel at your site with a VPN server it controls. If you want to go this route, Liljenstolpe suggests setting up a demilitarized zone so the tunnel server is isolated from the corporate network by a firewall.