APPLICATION NOTE. Overcoming Application Performance Challenges with Application-Assured Business VPN Services

Transcription

1 APPLICATION NOTE Overcoming Application Performance Challenges with Application-Assured Business VPN Services

2 Abstract Operators face many challenges as they strive to keep pace with the demand from small, medium and large enterprises for business services. In this very dynamic market, operators must respond with solutions that meet many criteria, including high availability, security, cost effectiveness, quality, manageability, scalability and, most recently, the ability to assure the operation of business applications. This application note focuses specifically on this last requirement and describes how the Alcatel-Lucent Application-Assured Business VPN Services solution offers operators the ability to move up the value chain by enhancing their existing virtual private network (VPN) service offerings for enterprises with application assurance. Most enterprises have little or no visibility of their business applications or how these applications are performing over the wide area network (WAN). Operators can address this shortfall and differentiate their services by offering application performance assurance for their business VPN services. One option for enabling application assurance is to rely on costly standalone WAN optimization appliances, which essentially provide a quick fix. However, as this paper illustrates, operators would be well advised to implement an integrated network-based approach for the delivery of applicationassured VPN services. VPN-based application enablement reduces the cost for operators in comparison with standalone solutions, and is readily aligned with the enterprise s application performance goals without significant additional complexity. By offering this comprehensive, end-to-end assurance solution, an operator can more effectively address the enterprise s application-centric requirements and differentiate its VPN services from the competition.

3 Table of contents 1 1. Enterprise challenges provide opportunities for operators 2 2. Transitioning from service-aware to application-assured VPNs Comparing network-based application assurance solutions with CPE-based WAN optimization solutions 5 3. Alcatel-Lucent Application-Assured Business VPN Services solution Application identification Application monitoring and reporting Application assurance New revenue potential with the Alcatel-Lucent AA-BVS solution Market opportunity Service penetration and revenue Associated service installation and operation costs Conclusion Abbreviations

4

5 1. Enterprise challenges provide opportunities for operators While enterprises are increasingly reliant on their business applications for successful day-to-day operation, most enterprises have little or no visibility of how the applications are performing over the wide area network (WAN) services they purchase. Business applications continue to grow and place greater demands on the enterprise WAN. Applications are being centralized at data centers, and real-time voice, multimedia and business-critical data applications are converging on a unified communications infrastructure. Furthermore, the highly distributed and collaborative nature of business makes it critical that applications be optimized for availability and performance across multiple locations, via the WAN. These applications are the lifeblood of the enterprise and the impact of poor application performance can result in higher operating costs and often translates directly into lost business. Maintaining visibility of these business-critical applications to ensure optimized performance and to detect application issues can be a huge challenge for IT departments. Many enterprise IT departments have limited resources and cannot afford to proactively monitor the performance of their applications across the WAN. As a result, they have tended to only address an application issue when they encounter a problem that is impacting users and business processes. Operators have an opportunity to capitalize on this gap by enhancing their existing WAN service offerings with the ability to monitor and address application performance issues. According to a recent study by Ovum-RHK, enterprises are willing to pay for this kind of service from operators, as shown in Figure 1. By outsourcing this function to the operator, the enterprise can free up valuable resources and reassign its internal operational support teams. Enterprises will place considerable trust in operators that can assure application performance. The Ovum study interviewed 150 enterprises located in Europe and the United States of America, including a mix of small, medium and large enterprises. The study looked at the adoption of WAN optimization as a managed service overall, and specifically what enhancements enterprises would be willing to pay for. A very significant 30 percent of enterprises claim that they would pay extra for improved quality of service (QoS) to guarantee the performance of mission-critical applications and 27 percent would pay extra for improved ability to optimize bandwidth and justify bandwidth upgrades. Twenty percent would be prepared to pay extra for consultancy services to help them with application performance monitoring/reporting and for solutions that improve the performance of applications. This study shows not only a willingness to pay, but that the might be willing to pay segment is very large and will be sensitive to the value of the offering. Figure 1. Enterprises are willing to pay for WAN optimization as a managed service (Ovum-RHK) Source: Ovum: The adoption of WAN Optomization as a managedervice. July Enterprises in USA and Europe Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 1

6 As further proof that there is a market for application assurance solutions, IDC s U.S. WAN Manager Survey, 2008 found that 51 percent of 368 enterprises stated that they would use a managed WAN optimization service from an operator, and 37 percent would use a combination of a managed service from an operator and an in-house solution. The remaining percentage of enterprises would continue to use a solution managed by their in-house IT staff, for now. A recent study from In-Stat, WAN Management/Security Solutions Survey, Sep 2008, also identified that: The majority of IT managers are under pressure to maximize the value of existing resources and contain costs, while the lack of application visibility has led to unpredictable and failed projects, and cost overruns. The top issue for a majority of IT directors is achieving consistent end-to-end application performance. However, most IT directors did not know what applications were running on their WANs, making it difficult for them to address this issue. The majority of WAN optimization deployments to date have been implemented by enterprises themselves because the alternative options from operators have either been limited in capability and scale or very costly. (IDC currently tracks this market to be approximately one billion United States dollars.) Recent service models by some operators have relied on costly standalone solutions or poorly scalable WAN optimization appliances as a quick fix way to get started. The Alcatel-Lucent network-based application enablement approach delivers application-assured virtual private network (VPN) services and aligns with the enterprise s application performance goals. This more strategic approach gives operators a very cost-effective way to differentiate their business VPN service offering. 2. Transitioning from service-aware to application-assured VPNs To be in a position to offer cost-effective, managed WAN optimization services, operators must transition their services from service-aware VPNs to application-assured VPNs 1. Moving to application-assured VPNs expands the reach and value of an operator s business VPN service portfolio, and enables the operator to transition from a connectivity provider to a provider of both connectivity and business application intelligence to the enterprise. Table 1 summarizes the key attributes that are associated with service-aware VPNs and application-assured VPNs. Table 1. Comparing attributes in service-aware and application-assured business VPNs Service-aware business VPN Network availability (either for the entire VPN or on an individual site basis) Service-level visibility Packet loss (per class of service) Roundtrip delay Jitter Mean time to repair Service operations, administration and maintenance (OAM) No, or limited, ability to diagnose on a per-application basis Application-assured business VPN All of the service-aware VPN attributes, plus: Per-application identification/recognition Application reporting, including application traffic mix and problem identification and localization Application assurance, including per-application fine tuning to optimize performance Application protection, encompassing the identification of unwanted traffic and controlling access to the VPN to those applications defined to run on the VPN The primary responsibility of service-aware VPNs is to ensure the operator s network and service performance objectives are met. There is limited focus on applications: it is assumed the application performance is acceptable if the service performance objectives are met. The VPN service assigns different classes of service (CoS). The CoS defines the service pipe into which applications will be classified by a trusted customer premises equipment (CPE) device, which in turn determines its prioritization (for example, Gold, Silver, and Bronze). This does not help address the enterprise s top issue (as identified by In-Stat), which is to have per-application visibility and control, without some form of costly CPE-based application-aware classification. 1 These VPN services encompass IP VPNs, Carrier Ethernet VPNs (including Virtual Private LAN Services (VPLS) and Pseudowire Emulation Edge to Edge (PWE3)), and IPSec. 2 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

7 An application-assured VPN ensures per-application performance objectives are met through application recognition and optimization. This is enabled through a network-based approach that provides per-application classification and end-to-end assurance from both trusted and untrusted CPE devices, that is, it ensures managed end-to-end application performance, in addition to the network assurance attributes identified for service-aware VPNs. An application-assured business VPN solution provides many benefits, including: Tiered business VPN service plans, as shown in Figure 2, ranging from basic VPNs and Service- Aware VPNs to Application-Assured VPNs, offering profitable customer contact with positive up-sell opportunities Service differentiation, enabling the operator to avoid VPN commoditization and price erosion against competitive offerings New service revenue through application reporting and assurance at significantly lower deployment costs, compared to standalone WAN optimization appliances, with faster time to market, enabling incremental revenue streams with lower overhead Greater upsell opportunities for VPN connectivity itself as ICT Directors can readily justify WAN services as they relate directly to application and business performance for the CIO. Enhanced customer loyalty, by becoming a strategic partner to the enterprise, with incremental value Figure 2. Increased revenue and customer loyalty with application-assured VPNs Meeting enterprise application-centric requirements Operator revenue Service-aware VPNs Applicationassured VPNs Tiered VPN services Application signatures Flow-based Layer 4-7 VPLS, VPWS, IP VPN (Layers 2 and 3) MPLS-enabled carrier Ethernet Service attributes (HA, H-QoS, OAM, scale) Application assurance + Network assurance Basic VPNs Connectivity IP VPN Commodity pricing VPN services 2.1 Comparing network-based application assurance solutions with CPE-based WAN optimization solutions Network-based application assurance differs from the first wave of application optimization/acceleration solutions available, which are based on standalone CPE appliances. These first-generation deployments are WAN overlays with a specialized appliance, generically referred to as a WAN optimization controller (WOC), which require an up-front capital expenditure (CAPEX). The different approaches are summarized below and illustrated in Figure 3. Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 3

8 CPE appliance approach An application optimization and acceleration solution where WOC appliances are deployed on premises usually at both the enterprise s data center and branch office locations. Existing WAN optimization solutions, which are widely accepted for networking of large sites served by T1/E1, T3/E3 or STM-x/OC-x connections, have not proven cost effective for deployment in a multi-site, distributed network. For sites with low speed or broadband access, the hard cost payback period is long or uncertain due to the cost of the additional appliances. Also, managing hundreds or thousands of devices across the distributed network introduces complexity which can tax already overburdened support staff. Additional costs include truck rolls to each CPE location adding to the burden of deployment, configuration, ongoing monitoring, and maintenance of yet another network device at each site. As well, many CPE solutions employ proprietary end-to-end encapsulation and flow control techniques that prevent service interoperability with other CPE appliances. Network-based approach A VPN application identification, reporting and assurance solution where capabilities are embedded within the operator s IP/MPLS network to support hundreds or thousands of enterprise VPNs. The combination of a VPN and WAN optimization intelligence at the network service edge can deliver a highly cost-effective, application-aware enterprise networking solution. It enables the operator to cost-effectively deliver application assurance SLAs for prospective customers who may be sensitive to the higher costs of a dedicated WAN optimization appliance. In addition, once deployed, it can easily be activated for new sites, or new customers through remote management, with visibility and control through a simple service portal. This eliminates the need for truck rolls and dramatically reduces the time to market. This approach is provided by integrating WAN application assurance technology within network provider edge (PE) nodes. Figure 3. Comparing the delivery of network-based application assurance and CPE-based application optimization Network-based HQ Dedicated CPE appliances HQ App servers App servers WOC CPE CPE Application assurance in PE WAN WAN Book-ended per site 7450 ESS 7450 ESS 7450 ESS 7450 ESS CPE CPE CPE CPE WOC WOC Remote locations Remote locations 4 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

9 A network-based application assurance solution can be extremely effective for deployment in a multi-site, distributed network enabling the operator to realize the following benefits: Application visibility, which enables per-application traffic analysis and reporting on a per-vpn, per-site or per-customer basis Support for all business VPN services, regardless of the access type connecting the enterprise site, which can range from less than 2 Mb/s to 10 Gb/s Matching of the VPN service to per-site specific application needs (such as volume of use by time and application) Scalable performance, dependent on the operator s specific infrastructure; for example, an operator with Alcatel-Lucent 7750Service Routers (SR) and Alcatel-Lucent 7450 Ethernet Service Switches (ESS) can scale up to 70 Gb/s of application processing per node to support hundreds and thousands of enterprise VPN sites. Reduced time and investment to operationalize the solution. Integrating the application intelligence into the network nodes reduces complexity and eliminates the need for truck rolls to CPE locations. Also, an integrated service management capability minimizes the installation and provisioning times. The ability to offer service portals at an incremental charge to enterprise customers to enable them to monitor their application statistics, download customized application performance reports, and manage their VPNs themselves through application-based policy control. The network-based solution is deployed once by the operator and can be offered to all enterprise customer VPN sites at minimal cost. Also, the application assurance service can be activated in minutes remotely, without requiring onsite installation. 3. Alcatel-Lucent Application-Assured Business VPN Services solution The existing Alcatel-Lucent Business VPN Services (BVS) solution enables operators to support the convergence of IP voice, data and video over Layer 2 and/or Layer 3 business VPNs. Enhancing the BVS solution with application assurance to deliver Application Assured Business VPN Services (AA-BVS) enables operators to leverage their existing IP/MPLS network and service management infrastructure and offer application-level visibility and policy control with minimal incremental investment. It also enables the operator to tailor VPN services to each enterprise s unique application performance requirements. The Alcatel-Lucent AA-BVS solution provides the ability to recognize applications and application flows through the network. This in turn enables the operator to report on the applications and/or apply application-level QoS controls. The AA-BVS solution supports multiple small, medium and large enterprise customers and hence provides dramatic cost savings over a comparable WOC appliance approach. Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 5

10 Figure 4. Network-based application assurance provides greater VPN coverage at a fraction of the cost High CPE-based WAN optimization Cost ($$) Low Network-based AA-BVS Existing VPN services Reporting Optimization Acceleration Application awareness function The network-based Alcatel-Lucent AA-BVS solution enables operators to cost-effectively address the majority of enterprise VPN sites Figure 4 illustrates the potential costs faced by an operator when deploying dedicated CPE WAN optimization appliances at the enterprise s premises in comparison to deploying the Alcatel-Lucent AA-BVS solution. Given that the majority of the reporting and control capabilities needed by most sites can be offered at a much lower price, operators deploying the Alcatel-Lucent and 7450 ESS are able to provide application assurance to the majority of enterprise VPN sites supported over their network. Additionally, the ongoing operational savings through deployment simplification (logistics, installation, provisioning, assurance and maintenance) of a network-based solution are very compelling. The use of network-wide AA-BVS reporting, which is operationally simple and cost-effective to configure, provides a level of insight into network use not available in today s VPN service networks. This enables the operator to target specific up-sell opportunities to other premium services, including a complementary portfolio of CPE devices that can be offered in specific cases. An example of this would be for data compression. If the objective for the enterprise is to send less data for the same amount of information over the WAN service, this can only be accomplished in the CPE. The Alcatel-Lucent AA-BVS solution relies on the Application Assurance feature set of the Alcatel-Lucent Service Router Operating System (SR-OS), including the purpose-built Alcatel-Lucent Application Assurance Integrated Services Adapter (). The is an integrated processing adapter for the Alcatel-Lucent 7x50 routing and switching portfolio. The is a hardware module that can be hot-inserted into the existing chassis of the Alcatel-Lucent 7450 ESS or Alcatel-Lucent to provide application assurance. It provides stateful, pattern- and stringbased identification of applications to enable dynamic per-service, per-site and per-application QoS policy control. Target application traffic flows are directed to the module via the router s backplane and fabric so no external connections are required. Traffic flows are identified and subjected to a set of Application QoS Policy (AQP) rules comprising match and action criteria that determine the QoS treatment applied. This enables any combination of passive monitoring and reporting, active bandwidth and/or flow policing, and flow-based QoS re-marking to enable per-application services all at line speed. Each module has a total traffic processing capacity of up to 10 Gb/s and is able to handle thousands of VPN sites. The can be configured in 1+1 redundant configurations to provide high availability, or N+1 configuration as well with up to seven active modules per chassis to scale the throughput up to 70 Gb/s, providing an industry first for this level of scalability and performance. 6 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

11 The Alcatel-Lucent AA-BVS solution is enabled and operated by the service and application management capabilities of the Alcatel-Lucent 5620 Service Aware Manager (SAM) management suite, which includes the Alcatel-Lucent 5670 Reporting and Analysis Manager (RAM). Together, these products provide a comprehensive management solution that enables the operator to extend its existing service network to encompass the AA-BVS. The extended functionality includes the ability to offer application-level reports to customers via self-service portals. The primary functions of the network-based Alcatel-Lucent AA-BVS solution, shown in Figure 5 and discussed in more detail in later sections, are: Application identification provides visibility of applications and their performance behavior over the WAN VPN Application monitoring and reporting provides both application traffic mix statistics, and application problem identification and isolation; generates reports to help enterprise CIOs make informed decisions regarding application performance over the WAN and the services they require. Application assurance enables per-application fine tuning to optimize the performance over the WAN or to prioritize one application above other applications within the same service class; enables true application-level QoS Figure 5. Alcatel-Lucent Application-Assured Business VPN Services solution Metro IP/MPLS service edge IP VPN VPLS VLL (PW) (PE) IP VPN application view SAP Netmeeting FTP HTTP IM VPLS VLL (PW) 7450 ESS (PE) 10 GigE Metro IP/MPLS service edge IP/MPLS WAN backbone 7450 ESS (PE) Data center Self care portal IP VPN VPLS VLL (PW) (PE) (PE) IP VPN HQ Accounts dept Manufacturing dept Sales dept HR dept IT dept VPLS VLL (PW) 7450 ESS (PE) Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 7

12 The network example shown in Figure 5 illustrates: Integrated application recognition and assurance functions into the Alcatel-Lucent and 7450 ESS situated at the edge of the network. The number of managed network elements and overall power consumption can be dramatically reduced. The interoperates with all existing interfaces on the Alcatel-Lucent and 7450 ESS to enable stateful application traffic flow inspection and application assurance for small, medium or large enterprise Layer 2 or Layer 3 VPN services. Complete application management by the Alcatel-Lucent 5620 SAM and 5670 RAM management suite; operators do not need to maintain multiple management interfaces and configurations. The AA-BVS solution enables the operator to offer a service web (self care) portal to its enterprise customers who can then view application performance reports per site, per VPN or per application group. 3.1 Application identification To address the performance of an enterprise customer s applications over the WAN, the operator must first have visibility of the applications. Most enterprises do not know how their applications behave because they have poor visibility of them. With a CPE-based solution, even prior to defining the application SLA, the operator has to deploy expensive equipment to enable application visibility and analyze end-customer application behavior. The Alcatel-Lucent network-based AA-BVS solution enables visibility through its per-application identification. This is provided using: Real-time analysis on OSI Layers 3 to 7, to dynamically identify and intelligently meter traffic flows, applications and underlying protocols The ability to identify business applications or traffic flows using IP address prefixes and ports, HTTP strings, Differentiated Services Code Point values or traffic direction in addition to protocol signatures to detect end-to-end application and flow performance behavior Advanced application identification techniques based on flow pattern and packet behavioral analysis (for example, IPSec) and statistical or algorithmic analysis New application detection and distinctive verification of applications relying on the well-known TCP/UDP port application identification, as well as identification of rogue or unwanted traffic Enterprises are looking to the operator for better visibility of application performance over the WAN and are willing to pay for this service, as discussed earlier in this paper. The flexible Alcatel- Lucent AA-BVS solution enables the operator to implement application assurance as a permanent feature of a purchased Layer 2 or Layer 3 VPN service or as a value-added feature for an additional monthly fee. With the Alcatel-Lucent AA-BVS solution, shown in Figure 6, the service-aware VPN (top) can be easily and cost-effectively transitioned to an application-aware VPN (bottom), providing the operator with full visibility of the enterprise applications running over the WAN VPN. This provides the following immediate benefits: Identification of applications and their performance behavior (that is, real-time volume and performance statistics per customer, per VPN, per site) Better understanding of how the enterprise customer s applications are traversing the WAN and deeper insight into how to base-line business-critical application traffic to improve performance Ability to identify business applications and prioritize them appropriately to ensure the enterprise experiences consistent end-to-end application performance 8 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

13 Figure 6. Enabling visibility through per-application identification on the Alcatel-Lucent 7450 ESS and Service-aware VPN CPE 10 Mb/s IP VPN CIR = 10 Mb/s PIR = 10 Mb/s Voice (EF) Video (EF) Business data (AF 2) HSI (BE) Seamless integration 7450 ESS and SME or large enterprise Upgrade to Application-aware VPN File transfer CPE SME or large enterprise 10 Mb/s IP VPN CIR = 10 Mb/s PIR = 10 Mb/s Voice (EF) Video (EF) Business data (AF 2) HSI (BE) SAP Videoconferencing CIFS Citrix Remote access Oracle HTTP VoIP Streaming video Scavenger apps Corporate Private E-Learning YouTube IM Web browse 3.2 Application monitoring and reporting The Alcatel-Lucent AA-BVS solution relies on application identification to provide a network-based application monitoring and reporting capability. This information is critical for enterprises as they are faced with operational challenges alongside increasing cost constraints. Without an application reporting capability, they are running blind. The Alcatel-Lucent AA-BVS solution provides extensive flow accounting and statistics reporting capabilities for both overall application performance and bandwidth usage, including: Per-protocol, per-application, and per-application-group volume and performance statistics; these are generated using the Alcatel-Lucent SR OS accounting for Layer 2 and Layer 3 VPNs (every byte, packet and flow for every application is counted, not sampled) End-to-end application volume statistics between VPN sites and servers Individual IP flows or an aggregated snapshot of IP flows for each VPN site The modules in the Alcatel-Lucent or Alcatel-Lucent 7450 ESS aggregate the application flow information. A comprehensive set of application statistics are then sent to the Alcatel-Lucent 5620 SAM at predetermined reporting intervals, which can be as frequent as every five minutes. This allows for maximizing aggregation benefits when mapping extremely large volumes of per-flow traffic counters. This information is passed to the Alcatel-Lucent 5670 RAM, for network-wide correlation and aggregation into graphical usage reports, trending information, and so on, as shown in Figure 7. The wealth of application usage and performance information that can be collected through the Alcatel- Lucent AA-BVS solution is very valuable for SLA reporting and helps enterprises determine how their applications are performing over their WAN VPN. Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 9

14 Figure 7. Alcatel-Lucent AA-BVS solution provides fine-grain application monitoring and reporting Enterprise self service portal Run reports via Web browser Application assurance stats Aggregated application assurance stats Multi-format file reports 5620 SAM redundant servers 5670 RAM aggregator and data warehouse 5670 RAM report/ Web server Threshold crossing triggered reports and notification 7450 ESS Branch Multiple policy touch points HQ IP VPN Metro aggregation IP/MPLS backbone 7450 ESS Web apps Figure 8 provides just a small sample of application reports that the operator can create and access via the web with the Alcatel-Lucent AA-BVS solution. The reports help the operator to ensure enterprise application performance metrics are met, to optimize WAN performance, and to identify and correct application-level faults quickly. The operator can offer an extensive array of detailed reports, through consultancy for example, to help the enterprise plan its WAN VPN service needs, based on the usage and growth of its business-critical applications. Figure 8. Detailed application reports the operator can view Per-VPN reporting Per-site analysis reporting Application analysis reporting 10 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

15 Table 2 highlights the type of information available in each sample report shown in Figure 8. Table 2. Type of information collected by reports shown in Figure 8 Per-VPN reporting Per-site analysis reporting Application analysis reporting This type of report provides information on: This type of report provides information on: This type of report provides information on: Top applications per VPN Trend and usage within a specified time span Application trend and usage within a specified All applications and protocols Top applications per site time span Top source and destinations sites per application Multimedia application distribution Instant messaging application distribution With the application report management engine delivered by the Alcatel-Lucent AA-BVS solution, operators have the option, via a web-based interface, to create, run, schedule, view, and organize pre-defined or customized reports to help differentiate their VPN service and meet the exacting application reporting requirements of their enterprise customers. The Alcatel-Lucent 5670 RAM, in conjunction with the Alcatel-Lucent 5620 SAM, has the capacity to raise an alarm (or threshold) when specific data rate limits for a VPN service or application are reached. This enables the operator, through the Alcatel-Lucent 5620 SAM, to apply a policy to react to real-time conditions and optimize network VPN behaviors related to the CoS. The Alcatel-Lucent AA-BVS solution enables the operator to add further value with a web-based service portal providing the enterprise with access to regularly distributed reports, as shown in Figure 9. The service portal enables the enterprise to: Monitor applications on a per-vpn or per-site basis View near-real-time reports and archived reports Request or change application treatment as well as request application diagnostics Figure 9. Enterprise web (self care) portal Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 11

16 Providing these monitoring and reporting tools through a self serve portal on an operator s existing VPN service greatly enhances the operator s value to the enterprise, because it gives the enterprise clear and factual information regarding its applications. Without having to incur truck roll-outs, and the CAPEX associated with a full CPE-based solution, enterprises are willing to pay for these monitoring and reporting tools as they provide an immediate benefit to them. With this information, the enterprise can optimize business operations through enhanced application monitoring and performance. For the operators, the ability to report and monitor applications within the VPN provides numerous benefits, including: New revenue potential providing performance and capacity planning reports to enterprise customers, helping IT directors to understand how their applications are performing, so they can make informed decisions for bandwidth optimization. Decisions within the enterprise become more fact-based and focused on the business relevance of a given application for the core business. Value-added service through the enterprise web portal Incremental pull-through revenue on the base VPN services being offered as enterprises can understand where and when incremental bandwidth will have the desired effect on application performance, and more readily justify VPN services costs to their CIO. VPN service differentiation to avoid price erosion and solidify customer loyalty 3.3 Application assurance The third capability delivered by the Alcatel-Lucent AA-BVS solution is the ability to control the applications within the customer s Layer 2 and Layer 3 VPN service. This assurance capability enables the operator to apply specific AQP rules to achieve the desired performance result for an application. The Alcatel-Lucent AA-BVS solution enables operators to deliver: Extensive per-application policy enforcement with granular bandwidth shaping, policing and prioritization defined on a per-vpn basis, to intelligently control and categorize application traffic based on policy. The operator now has the ability to align the enterprise s application services with its business needs, and to treat application traffic accordingly without introducing costly CAPEX, and with a quick time to market for an immediate benefit. Deterministic end-to-end application behavior through application performance optimization, application-based network path selection, application admission control and application-level mirroring The Alcatel-Lucent AA-BVS solution enables the operator to define per-application SLA guarantees to ensure consistent end-to-end performance of business-critical applications. In the following example the enterprise customer has bought Application Assurance Reporting and Control as a service from the operator. Figure 10 illustrates how one of the enterprise s VPN service forwarding classes is selected and directed to the module. The application flows within the forwarding class are identified and then subjected to a set of AQP rules comprising match and action criteria that determine the QoS treatment applied to each application all at line rate. 12 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

17 Figure 10. AA-BVS solution provides application assurance for business and Internet traffic Divert P2, P0 AQP E-Learning Service #1 Service #2 Branch office CPE 10 Mb/s Tenant #1 IP VPN CIR = 6 Mb/s PIR = 6 Mb/s Service #2 VPLS CIR = 4 Mb/s PIR = 4 Mb/s IP/MPLS service aggregation and edge (7450 ESS or ) Voice (P5) Video (P4) Business data (P2) HSI (P0) Business data HSI SAP Netmeeting FTP E-Learning IM Web browsing YouTube P4 P2 P2 P2 P2 P0 P0 Rate limit Internet (YouTube) HQ The branch office CPE, on the left, provides limited classification for the IP VPN service and has no visibility of the individual applications. The IP VPN service is aggregated on the operator s Alcatel-Lucent Ethernet Service Switch or Service Router at the metro or service edge. The SAP business application needs to be assigned a higher priority to meet the enterprise performance SLA. The SAP application is currently assigned to Priority 2 (P2) forwarding class. The operator has already diverted the P2 Business traffic to the and can quickly identify any performance issue with the SAP application using the Alcatel-Lucent 5670 RAM. The identifies the SAP application based on its unique signature and the operator defines a policy to re-mark the SAP application traffic from P2 to the higher priority P4 forwarding class, while leaving other P2 Business traffic alone. The traffic flow is then forwarded as normal all at line rate performance. The SAP application traffic now receives a prioritized treatment over the WAN IP VPN service in line with the enterprise SLA. The Alcatel-Lucent 5620 SAM ensures the application QoS policy is maintained until the operator is ready to change it. The IT director of this enterprise has also identified to the operator that it relies on an e-learning service provided over the Internet to train its staff. The current performance of the e-learning application is unacceptable and the staff is reluctant to take the training, which is affecting the competitiveness of the enterprise. The operator, after investigating the situation, takes the following action: High-speed Internet (HSI) traffic, which includes e-learning, is currently classified as best-effort and assigned to priority class P0. The operator diverts the P0 HSI traffic to the and can quickly identify any performance issue with the e-learning application using the Alcatel-Lucent 5670 RAM. Using the monitoring and reporting capability, the operator also identifies that YouTube activity is very high and uses up valuable bandwidth. The can distinguish the e-learning application from all other Internet traffic by stateful monitoring of IP flows and matching the specific HTTP string for the e-learning Internet application. The operator defines a policy to re-mark the e-learning application traffic from P0 to the higher priority P2 forwarding class while leaving other P0 HSI traffic alone. The operator also defines a policy to police YouTube traffic, which helps optimize overall bandwidth usage. The e-learning traffic now receives a prioritized treatment over the WAN VPN service in line with the enterprise SLA. The Alcatel-Lucent 5620 SAM ensures the application QoS policies are maintained until the operator is ready to change them. Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 13

18 Another challenge facing this enterprise is the effect on bandwidth availability and performance of its site VPN connection once they deploy teleconferencing. The enterprise needs to be assured that it can control the number of teleconferencing sessions so they don t overwhelm the 10 Mb/s bandwidth, which could cause unnecessary congestion and impact other business-critical applications. The enterprise wants to add teleconferencing without paying for additional bandwidth. The AA-BVS solution enables the operator to address this issue by applying application session admission control and classification specific to the site VPN interface. The example shown in Figure 11 illustrates how the AA-BVS solution can control the number of video application sessions, for example, to a maximum of two 5 Mb/s video sessions on the 10 Mb/s VPN service. The AA-BVS monitoring and reporting capability will provide full visibility of the video application flows and the performance impact on the other applications to that site. This capacity planning capability is provided without resorting to CPE marking or deploying an expensive CPE application-aware appliance. Figure 11. Application session admission control on the enterprise site VPN connection Operator view 5620 SAM 5670 RAM Branch Divert video (P4) Video Voice CPE 10 Mb/s Video flows IP VPN Voice (P5) Video (P4) Business data (P2) HSI (P0) Teleconference, video (5 Mb/s) SAP server 7450 ESS or aggregation Teleconference, video (5 Mb/s) Branch Overbooked resources need application-based session control beyond what DiffServ QoS provides. With the AA-BVS solution, the operator can now enable intelligent application flow control based on: Application-level admission control in line with available site VPN bandwidth and the agreed overbooking metric Admission control on the maximum number of session flows allowed, such as limiting to two video flows, as shown in Figure 11. The third video flow is policed and identified in the Alcatel- Lucent 5670 RAM reports Admission control on the rate of session flows set up within a given timeframe for example, the operator can limit the network to admitting ten video session flows every 10 minutes to ensure consistent performance 14 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

19 Enterprises will appreciate this improved level of responsiveness from the operator and the ability to optimize the performance of their business-critical applications over the WAN VPN service. Enterprises can experience the value first hand and will be willing to pay the additional fee for application reporting and control, which the operator is able to provide more cost effectively than the enterprise would be able to do in-house. 4. New revenue potential with the Alcatel-Lucent AA-BVS solution The Alcatel-Lucent AA-BVS solution enables the operator to realize additional VPN revenue quickly and at a lower cost while addressing the enterprise s application performance requirements. As identified earlier in this paper, enterprises are willing to pay for application visibility and optimization over their WAN VPN service. The financial business case described below examines the commercial value to operators of offering new application assurance service options that augment their current Layer 2 and Layer 3 business VPN services. The business case looks at the following two new billable service options, enabled by the AA-BVS solution: Application reporting service the reporting service provides detailed application monitoring, reporting and analysis of data traversing the enterprises VPN. Enterprise customers are able to view detailed application-centric reports via a web portal provided by the operator. Application reporting and control service In addition to full reporting capabilities, the enterprise can control the use of its VPN resources in alignment with its business application priorities, via the same web portal. Operators can up-sell these new application service options for an existing or new VPN service and garner additional service revenue with a small investment. The new application service options can be structured as an incremental monthly recurring charge applied as a percentage of the base VPN monthly recurring charge for each site that uses these service options. In this business case, a five percent incremental charge is incurred for customers purchasing the application reporting service, and a ten percent incremental charge is incurred for the application reporting and control service. For example, if a customer currently pays a 500 United States dollars per month fee for connecting one of its branch offices to its business VPN at an access speed of 2 Mb/s, the customer would now have the option to purchase a reporting service for an additional 25 United States dollars per month, or a reporting and control service for 50 United States dollars per month for that branch office. For reference, typical monthly recurring charges for VPN connectivity and for new application assurance services used in this business case are shown in Table 3. Table 3. Baseline monthly recurring charges for a VPN site Access speed for VPN site Monthly recurring charge Monthly recurring charge Monthly recurring charge for FOR VPN connectivity FOR reporting service REPORTing and control service (IN UNITED STATES DOLLARS) (IN UNITED STATES DOLLARS) (IN UNITED STATES DOLLARS) 2 Mb/s Mb/s Mb/s Mb/s Mb/s Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 15

20 4.1 Market opportunity The financial business case data is based on a European operator with a revenue base of approximately 250 million United States dollars and 35,000 customer sites for its VPN service in The VPN service sites are expected to gradually grow over the forecast period to reach about 45,000 sites. In spite of reasonable site growth, revenue is forecasted to grow only marginally to account for a two percent year-over-year price erosion on VPN services (see Figure 12). Figure 12. Operator VPN revenue and site forecasts Service provider VPN revenue forecast Service provider VPN site number forecast ,000 Revenue in millions of United States dollars ,000 30,000 20,000 10,000 Number of sites In this business case, application reporting and application reporting and control services are targeted at medium and large businesses. As per IDC s Western European IP-VPN Forecast report, medium and large enterprises constitute over 92 percent of total VPN sites (see Figure 13). Therefore 92 percent of customer VPN sites are assumed to be addressable, for this operator, by the AA-BVS solution. 4.2 Service penetration and revenue Based on market requirements and the attractiveness of the application reporting or application reporting and Figure 13. VPN customer distribution by size of business Business category Small Medium Large Number of employees Percentage of total VPN sites Addressable segments control services to VPN customers, they are forecasted to achieve a penetration of 30 percent of the addressable VPN sites by Year 3, with penetration hitting a peak of 50 percent by Year 8. Of those enterprises who do purchase the incremental services, it is assumed that 75 percent will purchase the application reporting service, while the remaining 25 percent are expected to purchase the application reporting and control service. The application reporting and application reporting and control services show very healthy revenues, reaching 3.5 million United States dollars in Year 3 and 7.8 million United States dollars in Year 8 (see Figure 14). Cumulative revenues for the eight-year period exceed 41 million United States dollars. < % 36.7% 56.1% 16 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note

21 Figure 14. Application assurance service revenue forecasts Total AA-BVS revenue forecast Reporting and control service revenue Reporting service only revenue Revenue in millions of United States dollars Associated service installation and operation costs The operator has deployed the base VPN service over a network based on Alcatel-Lucent s or 7450 ESSs. To enable the application assurance services at all sites, the module is installed in each Alcatel-Lucent 7x50 system deployed at the edge (PE). Also, the Alcatel-Lucent 5670 RAM is installed to provide application reporting and management. All capital costs associated with the incremental Alcatel-Lucent 7x50 hardware, 5620 SAM licensing and 5670 RAM software and SUN hardware (for the Alcatel-Lucent 5670 RAM) have been taken into account. The total capital costs add up to 930,000 United States dollars over eight years. The operation costs, which include initial project costs (IT integration, network integration) and ongoing maintenance, service activation, marketing and customer care, add up to 2.4 million United States dollars over eight years (see Figure 15). Also, the weighted average cost of capital is set at a conservative rate of 12 percent. Figure 15. Application services cumulative discounted cash flow 9 Cumulative discounted cash flows Revenue in millions of United States dollars Year Revenues Expenses Investments CDCF Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note 17

22 The overall business case is highly profitable for the operator. With cumulative revenues in excess of 41 million United States dollars on a capital investment of just 930,000 United States dollars and operating costs of 2.4 million United States dollars, operators get a very healthy net present value of million United States dollars over the duration of the project. Return on investment is achieved in a relatively short period of only 20 months. Consequently, providing the new application reporting or application reporting and control services to VPN customers presents an excellent opportunity for operators to grow their revenue. In addition, by strengthening their VPN service offering, operators increase customer satisfaction, which in turn contributes to customer retention. Significant service differentiation also provides protection from VPN service price erosion. Enterprises benefit as they now have the necessary tools to identify and manage their application traffic over their WAN VPN service effectively, leading to improved application performance and cost-optimized usage of VPN resources. 5. Conclusion Application enablement with the Alcatel-Lucent Application-Assured Business VPN Services solution delivers real benefits to help operators align their service offerings with enterprises business objectives and application performance goals. By enabling network-based application performance assurance for business VPN services, operators can clearly differentiate their VPN service offerings from competitors. Operators can do this while cost effectively reaching the majority of their customers sites and dramatically shortening the time to market in comparison with comparable CPE-based approaches. The Alcatel-Lucent AA-BVS solution meets head-on one of the key business challenges for enterprises today: ensuring that their business applications are operating as efficiently and cost-effectively as possible. With the solution in place, operators can tell enterprises exactly what applications are running on their VPNs and how they are running, and they can deliver detailed reports on the efficiency of their business services. They can also provide enterprises direct access to this information through self-serve web portals. The Alcatel-Lucent AA-BVS enables operators to introduce a variety of tiered business VPN service plans, aligning application services with stringent SLA requirements. This enables the operator to support enterprises business objectives more directly, and helps the operator to strengthen its relationship with its customers. This enhanced relationship provides increased opportunities for up-selling services to the enterprise. The new service capabilities also translate directly to increased revenue opportunities, at minimal cost, and with a faster time to market. By entrenching a competitive differentiator in its service offerings, the operator is safeguarding future revenue streams from price erosion, and reinforcing customer stickiness something that is extremely valuable in today s highly competitive market. 18 Overcoming Application Performance Challenges with Application-Assured Business VPN Services Application Note