National Gypsum wins the 2004 Extended Enterprise Innovator Award for constructing a massive VPN that pushes SSL remote access across the board.
| |||||||||||||||||||||
At National Gypsum, a leading wallboard manufacturer, the corporate mission is to provide “excellence across the board.”
Striving to meet this corporate standard has put Mike Brannon, senior manager of e-commerce, on top of the latest trends and technologies for extending access to the enterprise. Of late, that has meant embracing SSL VPN technology, while ousting a legacy IPSec VPN. The SSL VPN has become the basis of a secure, easy and cost-effective extended enterprise for thousands of users. Launched in 2002 with a price tag of $60,000, the SSL VPN has been expanded today to include new information delivery options, such as speech access and Web services, he says.
These latest efforts culminate more than five years of work National Gypsum has put toward extending the enterprise. In the process, the number of individuals who can tap business data and applications remotely has grown from 150 employees to more than 9,000 people including employees, retailers and shipping companies. The company is reaping the benefits. “In a highly commoditized industry, we have created strong preference for our product via improved customer service and dramatically increased customer service responsiveness and availability of delivery information,” Brannon says.
National Gypsum wins our 2004 Extended Enterprise Innovator Award for visionary use of emerging connection technologies to better customer relationships.
Basic building block
National Gypsum’s transformation into an extended enterprise started in 1997. That’s when the company set up an advanced call center in the headquarters’ city of Charlotte, N.C., and started transitioning from paper orders and invoices via fax and mail to online order entry and invoicing. Rather than dealing with a local sales office via paper, customers began conducting business with the call center’s Web-based agents. National Gypsum completed the transition from the regional offices to the national call center in 2001 and now delivers 86% of invoices electronically, with a goal of soon eliminating all paper in its invoicing process, Brannon says.
In the next phase of its extended enterprise evolution, National Gypsum decided to give sales representatives remote access so they could place orders, check invoices and track shipments firsthand. This project began with a dozen representatives in Florida using well-established remote-access gear from 3Com and toll-free number dial-in.
Because of the remote access, National Gypsum no longer needed to maintain as many physical sales offices and, by this year, had shuttered 67, Brannon says. This eliminated rent, heat and electric bills and in some cases taxes by removing the company’s physical presence from certain states altogether. The company’s 150 sales agents became teleworkers, which in turn set off successive deployments of three different remote-access technologies as National Gypsum sought new technologies to meet their growing needs, he says.
Initially, National Gypsum outfitted the salespeople with laptops and had them dial via a toll-free number to a 3Com Total Control remote-access server with 16 inbound lines. The sales staff downloaded their e-mails, then logged off to read the e-mails and write responses. They then dialed in a second time to upload the responses.
Within 18 months, the company fleshed out the remote-access menu with Microsoft Access, Office and homegrown customer sales/customer service using Citrix thin-client software and servers. Later the company added terminal emulation. The load quickly got up to the neighborhood of 650 to 700 people using dial-up remote access, as marketing staff, engineers and others also found the broadened application access useful, he says.
“One of the unanticipated affects was all of a sudden these guys were online a lot of minutes where before it was dial and dump. When you’re doing this with 800-number access, you’re paying for that for every minute that these guys are thinking,” Brannon says.
By 2001, the monthly bill for the toll-free-number access had grown to $60,000 per month, up from $30,000 initially, Brannon says. Offering customers dial-up access would have been cost-prohibitive, he says. “We realized that as we scaled it up, there was no way that would be affordable,” he says.
The next step
The company figured that a remote-access IPSec VPN would cut out the toll-free calling fees because employees could gain access via the Internet, which could be reached via a flat-fee service plus a free local phone call. So in late 2001, National Gypsum installed a Cisco 3005 VPN concentrator, and the VPN reduced the monthly connection fees from $60,000 per month to $6,000 per month.
|
But because the VPN required properly configured VPN software on each end-user machine, it wasn’t a great option for extending access to customers and carrier-logistics partners – the shipping companies that deliver products to customers. “We couldn’t really go to our carrier-logistics partners and our external customers and say, ‘You guys need to have all this stuff set up on your machines that represents our software,’ ” Brannon says.
So while providing IPSec VPN-based access to employees, the company issued external users Internet-based remote access using software from Axent Technologies (later bought by Symantec). The software, which could be installed on most types of machines, served as a reverse proxy sitting in front of the company’s Web servers, Brannon says. This prevented those servers from being exposed to the Internet, he adds.
In all, 250 customers eventually used the system, but the licenses for the software proved too pricey to scale up to the thousands of users the company wanted to serve, Brannon says.
In 2002, Brannon turned to SSL remote-access gear from VPN specialist Neoteris (later bought by NetScreen Technologies, which Juniper acquired early this year). This breed of VPN allows secure Internet access via standard Web browsers with no other client software required. From the licensing perspective, it sets no limit on how many unique users can access the gateway. Instead, the license is based on how many users the gateway supports at the same time. SSL VPN made perfect sense for National Gypsum, Brannon says.
Cementing the access solution
National Gypsum has been transitioning the 250 Axent and 350 Cisco VPN users to SSL for two years, and expanding the total number of authorized users to include more than 9,000 people. These are the employees of companies who buy National Gypsum products and who need direct access to the company’s extranet to do their jobs, Brannon says. The gateway checks the remote machines for anti-virus software and policy settings under Windows XP. “Once they pass that test and we get them configured and checked out, then we connect them to the network,” he says.
One selling point of the SSL VPN gear, now called the Juniper NetScreen 5000, was that with vendor customization, the gateway can tap existing SQL databases of user profiles, Brannon says. “It doesn’t require us to maintain a whole bunch of security-profile stuff on a separate box in order to get a person into our network. That was a big boon,” he says.
Between 75 and 100 users come into the same box concurrently. Based on their authentication profiles, they gain access to data pertaining only to their accounts and their roles. Customer authentication profiles don’t require the computers to submit to an SSL gateway scan, as is the case when company-issued laptops attempt access, Brannon says.
Once authenticated, customers connect to the self-service extranet and can monitor order status, find the location of loads scheduled for delivery, check invoices and billing statements, and get summary reports of their business history. Today, National Gypsum syncs the extranet every few milliseconds with new transactions and captures GPS order locations from its 95 contract carriers twice per hour for each load in transit, Brannon says.
The call center is still important, but the Web access has expanded. Via the customer Web pages, customers can request notification of when orders have shipped and when they will be delivered. These notices can be pushed to e-mail accounts or read over the phone via text-to-speech software. In the works is a Web service that National Gypsum will use to push notifications as XML files, says Brannon, who notes that the company delivered nearly 1 million “event notifications” – meaning orders, invoices and statements – in 2003.
In the works
In addition to transitioning nearly all remote access to SSL, National Gypsum uses another feature of the same equipment to support Web conferencing. The company had used the WebEx Communications conferencing service several times per week for training and paid up to $200 per meeting. “We’re now converting everyone over to taking advantage of this SSL VPN box that has the ability to do that essentially for free,” he says. The company still has to coordinate the audio portion of conferences, but that is a feature of its Avaya PBX.
Also on the agenda is presence technology, which National Gypsum hopes to use for connecting customers to the correct call agents when they can’t get what they want from the Web pages, Brannon says. He wants to use Microsoft Exchange, Outlook and Share Point portal software features to build pages that display an agent’s availability when a customer clicks on the agent’s name. “I want hooks from the meeting product to allow us to connect up and share screens and collaborate in real time, tying in to” instant messaging, Brannon says. “I’d like that extended to customers who are in our Web site and customer service people who are on our network.”
National Gypsum’s efforts make it possible for extranet users to request automatic daily updates on open orders and notification of individual customer sites about order arrivals. “We’ll send a message to a cell phone or e-mail with a PDF,” Brannon says. “We’re looking at [interactive voice response]/speech servers where you could say, ‘I want you to call me at a particular phone number and let me know what’s going on.'”
For traveling employees, National Gypsum has outfitted its latest issue of portable PCs with wireless LAN cards for hot-spot connectivity.
Whether they are in the office or not, National Gypsum’s VPN offers all users excellent connectivity, across the board.
