As one of the most popular enterprise-class VPN appliance lines, Nortel's Contivity VPN gear historically has been hampered by awkward and inconvenient configuration and management wares. With the release of Contivity Configuration Manager Version 2 this summer, Nortel has to a degree simplified configuration and control of multiple Contivity devices.

CCM comprises a simple, client/server architecture, with a small database and configuration server running on Windows or Solaris servers and a Java-based client configuration tool. We installed CCM on a Windows 2000 Server and used a second Windows system to run the client configuration tool. We pointed CCM at our Contivity 2600 and 1100 systems, imported their existing configurations and easily started managing them.

If you're familiar with Contivity's built-in Web-based user interface, CCM will be easy to learn and use. CCM exposes an almost-identical series of screens that display the Contivity configuration data and lets you change it. This is a strength and a weakness of CCM. VPN managers will be able to pick up and use CCM almost instantly. However, CCM doesn't extend the object-oriented configuration model of Contivity across multiple units. For example, you can't group Contivity devices and apply like settings, such as a logging server, to them. CCM does have a multi-device configuration tool, but the tool is really just a way of speeding the process of manually changing a setting across multiple devices. With Nortel's object-oriented GUI in the Contivity boxes so ahead of its time, seeing CCM ignore the potential was very disappointing.

We also were disappointed with the VPN-specific management features in CCM. Because the main purpose for having dozens or hundreds of Contivity appliances is to have them running in a multi-site VPN environment, we expected some powerful tools to build and maintain site-to-site VPNs. CCM lets you define a mesh VPN, but it's a one-time push of configuration information. You can't then modify the VPN as an object to change its configuration. If you want to do that, you have to go to each device in CCM and make the changes individually. Other types of VPNs (such as hubs and spokes) are not supported except through a manual definition process.