'Net QoS hurdles cripple enterprise VPNs

Virtual private networks (VPN) are supposed to give us the ability to use the Internet as an enterprise-quality WAN without the expense or the management headaches of a private intranet.

Yet there are a number of issues that must be answered before VPNs become a serious alternative to large, meshed, leased-line intranets. Perhaps the most important issue is guaranteed quality of service (QoS).

If you are implementing or considering installing or deploying VPNs in the near future, heed this warning: Because of systemic problems with today's Internet infrastructure, ISPs cannot yet guarantee enterprise-class QoS required for enterprise VPNs.

QoS is the capability of a network to define and negotiate levels of performance, reliability and predictability between the user and the provider. If VPNs are to use the Internet effectively as a future enterprise infrastructure, they need to deliver the same levels of guaranteed service that network managers expect from their tried-and-true leased lines.

If anything, the QoS requirements would become even more stringent as customers start putting next-generation applications such as distance learning and multimedia on the 'Net. For most mission-critical applications, the cost savings from VPNs are negated if users must sacrifice QoS beyond certain limits. It does no good telling your chief financial officer you saved hundreds of thousands of dollars in line charges, only to have to turn around and say the company lost several times that in revenue because the average sales transaction time doubled due to substandard Internet performance.

Recognizing the importance of QoS, most VPN hardware and software vendors are already emphasizing the QoS aspects of their products. A common technique is to offer some form of traffic shaping to help prioritize important traffic over less important traffic before it hits the Internet.

The problem is that a single VPN connection may travel over several ISP networks. Unless they all agree to provide, say, a uniform Priority 1 service, the best service level for that connection is limited to the ISP providing the worst service level. Even if ISPs were to attempt end-to-end QoS, it is a tough task because there is no standard to implement end-to-end QoS.

Ultimately, guaranteeing QoS is a task for future public network providers. ISPs and standards bodies are already building infrastructures and enhancing Internet protocols to support QoS, such as GigaPop from the Internet 2's QoS workshop. Once such standards are in place, ISPs can standardize on procedures for negotiating interprovider QoS. Until then, VPNs will remain unsuitable as an alternative to today's enterprise intranets.