Why does a wireless system need extra VPNs?

Q: My current LAN contains VPNs at various locations throughout the enterprise. Why does our wireless infrastructure need to incorporate additional VPN functionality? – Adam, Rancho Santa Margarita, Calif.

A: Conventional VPN architectures were designed to provide secure remote access. To that end, they are expected to be deployed at the edge of the network and support a limited number of users simultaneously. While this approach has proven effective for small wireless deployments (with wireless platforms supporting pass-through VPNs), it will not scale for significant wireless enterprise networks for several reasons:

• Using existing VPN technology to support wireless users places additional strain on VPN concentrators. In most instances, they were not designed to handle hundreds to thousands of simultaneous network users.

• VPN concentrators are often physically located at the edge of a corporate network. Backbone congestion could easily become a problem as IPsec traffic is required to traverse the corporate network on its way to an edge concentrator.

• Client administration becomes more burdensome as each individual corporate user requires VPN software for the wireless network and the remote access network.

• When VPN traffic is backhauled to an edge contractor, a delay exists that can cause ill-fated timeouts or require constant re-authentication. In addition to being a nuisance, this could prevent the deployment of time-sensitive applications, such as voice, video, and real-time data.

Some wireless systems resolve these issues by terminating VPN sessions directly within the wireless network. This enables distinct VPN infrastructures to be deployed for wireless and remote access. IPsec traffic no longer has to be backhauled to the edge of the network, ensuring maximum network performance (i.e. less congestion and reduced latency), with minimal effort. In addition, some systems can maintain performance with the new security protocols, such as WPA and AES, which require specialized hardware acceleration to run effectively. These platforms use dedicated hardware throughout the system – not only to accelerate security at Layer 2, but to ensure the delivery of time-sensitive applications such as VoIP, multicast and video.

Unlike traditional VPN approaches, a mobile VPN system lets users roam within a network – even across subnets – and still maintain VPN connectivity. This ensures maximum network flexibility and meets wireless user requirements.