Winning Strategies for Delivering Premium VPN Services to the Always-on Enterprise By R. Latraverse Technology executives in always-on enterprises face daunting challenges as they transition to an all-ip world, develop high-performance application delivery strategies and implement security measures for the new converged environment, while ensuring business continuity and controlling costs. Given the pressure to improve business efficiency and quickly respond to shifting market opportunities, new, multimedia and on-demand applications are becoming integral to every process of the modern enterprise. This new environment shifts technology management focus away from a network-oriented to an application-oriented paradigm. Despite this shift, the new orientation raises the importance of the network, because network performance and high availability in the converged, around the clock environment are directly linked to Quality of Experience (QoE) and the bottom line. Strategies that directly address these new market dynamics require more than single-purpose, commodity-networking services. A cutting-edge network service provider offers a portfolio of managed Premium VPN services that underpin additional value-added services and applications. Key attributes of Premium VPN services include: Resiliency and reliability for always-on and secure services Any mix of Layer 2 Carrier Ethernet VPN services and Layer 3 IP VPN services over a single (or multiple) access facility to meet enterprise preferences Service-oriented QoS to meet simultaneous requirements of multiple diverse applications Ubiquitous access from any enterprise location End-to-end Service Level Agreements (SLAs) that demonstrate what is paid for is delivered End-to-end service management for rapid fault isolations, provisioning and reporting Web-based customer portals to allow enterprise visibility and control in an outsourced business model The Drive Toward Convergence With an eye on cost control, enterprise technology organizations are choosing managed Premium VPN services for the convergence of multiple autonomous networks. These VPN services typically save 25-45% over a non-converged legacy network solution and enable additional savings. For example, increased bandwidth provided via Ethernet access to the VPN enables server centralization, saving both capital (CAPEX) and operational (OPEX) expenditures. Internet access for an enterprise can be provided from a single central location, and accessed from other locations via their VPN, to eliminate duplicate Internet access costs. Security, management and administration are also simplified, and technology staffing requirements are reduced. However, convergence offers more than cost savings. Premium VPNs provide the voice, video and data bandwidth needed for unified communications and the new breed of collaboration and presence-based services. The challenge is how to achieve the benefits of convergence without sacrificing the performance inherent in built-to-task networks. enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 1
44% of enterprises have at least partially converged their voice and data networks. 51% of enterprises will do so within a year. Source: 2006, WAN Manager Survey, IDC Premium VPN services are more demanding on IP networks than those deployed in the late 1990s and early 2000s. They rely on the combined cost benefits, simplicity, transparency and scalable bandwidth of Ethernet with the stable quality, reliability and scalability of IP/MPLS. The three key services of a Premium VPN portfolio are: Layer 3 IP-VPNs (RFC 4364, superseding RFC 2547bis) Layer 2 Carrier Ethernet VPNs enabled by VPLS (RFC 4762) a Metro Ethernet Forum (MEF) E-LAN service Virtual Private Wire Service (VPWS) also known as Virtual Leased Line (VLL) an MEF E-Line service Layer 2 and Layer 3 VPNs in the Service Mix The fact that VPLS-enabled Carrier Ethernet VPNs and IP VPNs both provide any-to-any services raises a question: can the service portfolio be simplified further by offering just one of them? Research from Alcatel-Lucent and others consistently confirms that both are needed in the service mix to address the needs of different enterprises. Two principal selection criteria for choosing a VPLS-based Carrier Ethernet VPN are: Desire to maintain routing control as currently with legacy services The need to carry non-ip traffic However, for some organizations, such as many small and medium enterprises, neither criterion is an issue, and IP VPNs are the preferred option. Other organizations need both Carrier Ethernet VPN and IP VPN services. Alcatel-Lucent research of very large enterprises indicated a preference for Layer 2 Ethernet services for high bandwidth requirements between main corporate centers, but Layer 3 IP VPN services to reach numerous small sites like sales offices or retail outlets. These findings confirm that service providers must offer both types of multipoint service to address market requirements fully. Regardless of the preference, the service requirements are often the same. In fact, leading service providers offering both IP VPN and VPLS-enabled Carrier Ethernet VPN services are offering both with feature parity with respect to bandwidth offered, QoS policies, SLAs and even price. QoS Essential for Superior Quality of Experience The variety of applications sharing the converged network mandates that it provide differentiated performance levels. For example, VoIP and video are unusable with excessive network delay (latency) or jitter; interactive applications such as SAP or Citrix are insensitive to jitter but slow response times often relate to latency and directly tie to quality of experience. Yet other applications, such as email, are more tolerant of network performance. enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 2
Figure 1: H-QoS Enabled Service Bundling Over a Converged Ethernet Uplink Prioritize services and applications Service aggregate traffic parameters Individual applications get reserved bandwidth Service-aware H-QoS allows for creation of tailored service bundles Service #1 Voice Service #1 IP-VPN CIR = 30 Mb/s PIR = 30 Mb/s Video Data CPE GbE Service #2 VPLS CIR = 10 Mb/s PIR = 10 Mb/s Internet Voice Data Internet GbE 7750 SR Service #2 IP/MPLS Service Network Service providers have offered multiple QoS levels for many years to address varied application requirements, but adoption has not been universal. Many enterprises preferred to accept the limitations of a single QoS level, or use a site-specific WAN acceleration appliance to boost local performance. However, large-scale introduction of enterprise VoIP and increased outsourcing are two trends that limit single-level QoS as a viable enterprise solution. One Third of Organizations are committed to moving entirely to VoIP. Source: 2007 Nemertes Research According to Nemertes Research, one third of U.S. organizations are deploying VoIP and are committed to moving to it entirely; 20% have already done so. To accommodate growing VoIP and videoconferencing requirements, 70% of enterprises have identified the need for a QoS level strategy that includes real-time performance, according to a 2007 survey by Heavy Reading (Table 1), in addition to other QoS levels to support their business applications. Simple, port-based QoS is insufficient to meet enterprises emerging network convergence requirements. For maximum flexibility, the service provider must support tiered SLAs that accommodate multiple services (e.g., a mix of Carrier Ethernet VPNs or IP-VPNs, E-Line or Internet access) via a common access facility with multiple levels of QoS within each service. In contrast to routers designed for enterprise or Internet-only applications, service routers supporting all these services plus QoS with hierarchical scheduling (H-QoS) meet this need and give service providers the flexibility to tie network performance to application requirements. enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 3
Table 1: QoS requirements over the next 18 months. 2007, Heavy Reading QoS Level Bronze (best effort) Silver (regular data) Gold (premium data) Platinum (real-time applications) Platinum plus (business-critical) % of Respondents 23.2 40.9 34.5 70.4 33.1 Ubiquitous Managed Access While all enterprise locations need access to the corporate VPN, it may not be feasible to offer direct Ethernet-over-fiber to locations outside metropolitan centers. Customer-located equipment (CLE) managed by the service provider can provide a solution by providing an Ethernet hand-off at the customer site using a variety of last-mile access technologies (Figure 2). Service providers effectively extend the reach of their VPN services across the enterprise regardless of location, providing an Ethernet demarcation, common service performance, SLAs and manageability. Figure 2: Ubiquitous Managed Access Service-Aware Manager Ethernet over Copper and xdsl Active Ethernet over Fiber Internet GPON Enterprise VPN Enterprise VPN Enterprise VPN Ethernet over MPLS IP/MPLS Network Frame Relay/ ATM SONET/SDH enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 4
Reliability is Mandatory Service providers must provide uninterrupted services to meet stringent SLA commitments and ensure access to business critical applications and services. Extremely high reliability is especially critical in a converged environment since application support is concentrated on a single network. Service reliability must be built into every element of network design to ensure services are protected against service outages caused by hardware, IP routing or link failures; malicious denial of service (DoS) attacks; software upgrades; or router configuration errors. Service providers must also ensure they have the management systems to minimize costly downtime by quickly and efficiently diagnosing and troubleshooting problems. Three key operational areas have an impact on assuring always-on services: Network outage mitigation Timely fault isolation Streamlined operations and maintenance Service router role in mitigating network outages Robust service router design minimizes outages by ensuring high hardware availability and routing resiliency in addition to providing mechanisms that mitigate unavoidable network faults. Critical capabilities include: Non-stop routing Non-stop services In-service software upgrades MPLS fast reroute (FRR) Link aggregation groups (LAG) and multi-chassis LAG (MC-LAG) Non-stop routing and non-stop service are intelligent hitless solutions to eliminate the possibly catastrophic effects of control plane failures. In contrast to earlier solutions such as graceful restart and non-stop forwarding, this means that if a software or hardware control complex fault occurs, there are no resulting service outages and no SLA violations. Link resiliency features in the network design including MPLS fast reroute, LAG and MC-LAG ensure that services can remain up and running even in the presence of unavoidable link failures. While network faults do occur, these features enable service providers to address them in the background while their enterprise customers remain always-on. Timely fault isolation Service-aware OAM tools are key to helping operators identify, isolate and troubleshoot service and network faults. This minimizes downtime during planned and unplanned network events. A comprehensive toolkit will include service-level OAM tests and network-level OAM tests, plus support for standards such as IEEE 802.3ah to allow service providers to isolate faults and remedy the affected customers quickly. Working with network and service management applications, such OAM tools, allows the operator to establish proactive monitoring policies, efficient service provisioning, verification policies and advanced fault isolation practices to ensure rapid resolution without compromising SLAs. enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 5
Streamlined operations and maintenance Managing a VPN service portfolio is complex. Service providers require a solution more advanced than the usual physical layer management functions normally offered by traditional elementmanagement systems. An advanced IP management solution should be more than a collection of many point solutions that increase costs and take time to deploy. To scale effectively, service providers must ensure their management systems not only provide effective element, network and service FCAPS (Fault, Configuration, Accounting, Performance, Security) control, but also provide the correlation between the layers as well (Figure 3). Figure 3: VPN Service Management System Managing Services in Context of the Network Infrastructure Service Management (Managing Customer Service) Network Management (Managing Logically Linked Nodes) Element Management (Managing Physical Hardware) Value is the Correlation Between Layers Service Aware Management The Need for Service Portals Enterprises welcome the opportunity to outsource network operations, but technology managers are unwilling to relinquish control and visibility of network performance completely. A portal to monitor or request changes to their VPN service can address technology managers concerns. Web-based customer service portals that address this requirement can make a difference. A 2006 Alcatel-Lucent survey of large enterprises revealed that 61% had access to a service portal, but only 25% of technology managers indicated they were happy with their portal s control features. Key elements of an effective service portal include: Detailed monitoring and reporting by user, port, service, application, location or QoS level to evaluate current performance and anticipate future needs SLA performance tracking Trouble ticket entry and monitoring Flexibility to change bandwidth allocations by service or QoS level to respond to ad-hoc requests Flexible billing Service order entry and tracking Inventory tracking enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 6
These customer portal features enable the enterprise to outsource services while retaining as much control as they need. Ideally, a service portal allows technology managers to do away with premisesbased performance reporting applications and appliances. The resulting CAPEX and OPEX savings justify the price of a premium portal solution. Alcatel-Lucent Managed Networking Services Alcatel-Lucent is at the forefront of providing Premium VPN solutions, including Premium IP-VPNs, Carrier Ethernet VPNs based on VPLS and Virtual Private Wire Services that address current and future enterprise and service provider challenges. Premium VPNs are a key component of the Alcatel-Lucent Managed Networking Service Solution. The Alcatel-Lucent Service Routing portfolio includes the 7750 Service Router (SR), 7710 SR, 7450 Ethernet Service Switch/Router (ESS) and 5620 Service Aware Manager (SAM), complemented by a comprehensive access portfolio and professional services. This combination of capabilities enables best-in-class services to assure high quality of experience and uninterrupted services for the always-on enterprise. Rene Latraverse is Director-Solutions Marketing, IP Division, (Ottawa, Ontario), Canada. Email: rene.latraverse@alcatel-lucent.com Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent logo are trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners. The information presented is subject to change without notice. Alcatel-Lucent assumes no responsibility for inaccuracies contained herein. 2007 Alcatel-Lucent. All rights reserved. enriching communications > volume 1, issue 2 > 2007 http://www.alcatel-lucent.com/enrich 7