How we did it

How the various remote-access VPN solutions were tested.

To evaluate remote-access VPN solutions, each vendor sent us a VPN concentrator, management system and any software or hardware clients available. We installed management systems and configuration graphical user interfaces, where possible, on a Windows 2000 SP3 server. The VPN concentrator was installed on a public network at Opus One, protecting a routed network with multiple subnets designed to simulate a realistic corporate infrastructure.

To evaluate support for typical corporate authentication systems, we used a combination of Remote Authentication Dial-In User Service (RADIUS) and public-key infrastructure (PKI)-based authentication. For RADIUS, we used Opus One’s RADIUS server, a standards-based RADIUS authentication and accounting server. For PKI-based authentication, we used Entrust/PKI v6.0 as our certification authority, along with Schlumberger SmartCards and readers.

To verify operation in a fairly typical ISP environment, we used 128K bit/sec ISDN lines with Lucent Pipelines as our ISDN access devices. The Pipelines handed out “private” (RFC 1918) addresses and performed a Network Address and Port Translation (NAPT) function on all traffic. Inside of one Pipeline devices, we set up the hardware client provided by the vendor (if they had one), with a Macintosh laptop sitting inside of the hardware client. On the other Pipeline device, we used a Windows 2000 Professional system with the SmartCard reader for both RADIUS and PKI-based authentication.

Once installed, we evaluated the entire remote access package from an enterprise, large deployment point of view, looking at manageability and scalability from 1,000 to 10,000 simultaneous VPN users. We compared deployment and management functions, as well as the ability of the network to grow to support large user populations. We also looked at flexibility, to evaluate how well the proposed VPN solution could meet a variety of Internet and corporate environments, including addressing, NAPT, authentication and enrollment. Finally, we compared products for enterprise-scale features, such as fault tolerance, integrated firewall, auditing and accounting, and management and controls.