All rights reserved © 2000, Alcatel 1 CPE-based VPNs Hans De Neve Alcatel Network Strategy Group

All rights reserved © 2000, Alcatel 2 Contents t Global VPN requirements t Deployment View t What does a typical CPE VPN look like ? t Network View t What sort of connectivity does it provide ? t Technology View t What are the underlying technologies ? t Differentiation and Success Factors t Where are the factors today, what will they be in future ? Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 3 Global VPN requirements t Connectivity t IP connectivity between geographically dislocated sites using private addressing t transparent to underlying shared infrastructure t => tunnelling mechanism t Security t data privacy (e.g. encryption) t authentication and integrity t Scalability t Management t... Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 4 Proposed Technology : IPsec t IP security offers t tunnelling (forwarding in shared internet is normal IP forwarding) t authentication and integrity t cryptographic encryption t IPsec can be used with IKE t IKE = Security Association negotiation and Key Exchange Protocol Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 5 Branch Office Dial-up VPN clients BusinessPartner VPN Site-Site VPN gateway Internet Uplink PVC InternationalSales DomesticSales Dial-up VPN clients VPN gateway Headquarters ASP Data center Finance server Corp. server 256K Policy manager Policy manager 256k CPE VPN Deployment View LAN-based VPN client Customer WebSurfers 512K 128K 512K LAN-based VPN client VPN gateway Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 6 CPE VPN Network View L2 Access Network Service Provider Network L3 Access + Distribution + L3 Edge CPE L2 Access Network L3 Access + Distribution + L3 Edge IP routing / MPLS Traffic Engineering IPSEC Connectivity Customer Premises Equipment based Virtual Private Networks CPE IP header IP datanew IP header IPsec header IP header IP data possibly encrypted

All rights reserved © 2000, Alcatel 7 CPE VPN Network Topologies Internet Customer Premises Equipment based Virtual Private Networks Site 1 Site 2 Site 3 Site 4 HUB and SPOKE topology IPsec tunnel

All rights reserved © 2000, Alcatel 8 CPE VPN Network Topologies Internet Customer Premises Equipment based Virtual Private Networks Site 1 Site 2 Site 3 Site 4 Full Mesh topology IPsec tunnel

All rights reserved © 2000, Alcatel 9 CPE VPN - Dial up VPN Client L2 Access Network Service Provider Network L3 Access + Distribution + L3 Edge CPE L2 Access Network L3 Access + Distribution + L3 Edge IPSEC IP over PPP L2TP IP Option 1 Option 2 Dial Up Client Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 10 CPE VPN Gateway Technologies t IKE Daemons t Phase I, Phase II negotiations to generate/update IPSEC keys and setting up of Security Associations (IPsec tunnels) t Use of certificates v/s shared secret for authentication t Proposal exchange and agreement, exchange of proxy ids t IPSEC Drivers t Handling of IP packets based on IP header and proxy ids t Encryption using IKE negotiated keys and encryption algorithm t Encapsulation of IP packets using IPSEC headers Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 11 CPE VPN Gateway Differentiation & Success Factors - Today t Number of concurrent IPSEC tunnels supported t Maps to memory and CPU required to maintain state for tunnels t Critical for dial up scenarios and large number of branch offices t Critical for multi tenant MAN service networks t Throughput over the IPSEC tunnels t Maps to encryption/decryption speeds of the CPU/ASIC t Critical for the HUB site or in case of gigabit campus networks t Critical for gigabit IP access service networks t Restoration of tunnels in case of VPN gateway failure Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 12 t Enterprise market as a pure IP overlay VPN solution t Number of IPSEC tunnels, throughput over IPSEC tunnels, recovery t Dynamic membership of sites to a VPN for Site-Site VPNs t Integration with PKI infrastructure, AAA for VPN Clients t Carrier/Service Provider market as a vehicle for IPVPN services t Integration of configuration with service provisioning solutions t Integration with IPVPN service functionality such as Firewall, QoS t Integration with data collection for services (assurance + billing) CPE VPN Gateway Differentiation & Success Factors - Future Customer Premises Equipment based Virtual Private Networks

All rights reserved © 2000, Alcatel 13 Policy server Policy route r Installation team Security team Network team Billing data SLA info. IS enterprise management HR: n WW users n adds/changes IS Dept: n US security policy mgmt. IS Dept: n Asia security policy mgmt. Service provider management IS Dept: n Europe security policy mgmt. New York Headquarters Web serve r Policy router Corp. serve r Geneva office office Policy route r Tokyooffice Policy route r Internet CPE IPVPN Vehicle for IPVPN Services Customer Premises Equipment based Virtual Private Networks