Performance and bandwidth issues can emerge as a result of laying secure VPN tunnels over public Internet connections. This tip, which originally appeared on SearchNetworking.com, provides troubleshooting help for value-added resellers (VARs) and systems integrators.
The emergence of robust VPN solutions and the proliferation of broadband Internet connections have allowed organizations to provide cost-effective remote access to corporate applications via the global Internet. Utilization of broadband (DSL, cable modem, etc.) in conjunction with VPN technology provides an alternative to building a separate WAN backbone. Instead of buying a bunch of routers and connecting them with expensive leased lines, organizations can use the public Internet as the transport and lay secure VPN tunnels over it. However, this does pose some problems, and one of the key areas that must be addressed is bandwidth. Broadband Internet connections, while costing much less than a private line connection, do not provide high-bandwidth options. In addition, the broadband connection ultimately connects to the public Internet, which utilizes best effort delivery of IP traffic. In other words, your business traffic will be competing with Joe Shmoe who may be downloading games from the Internet.
There are other issues as well. You are now sending traffic over the public Internet, therefore the traffic will need to be encrypted over a tunnel (IPsec, L2TP, etc). This is standard operating procedure, as you have to tunnel the traffic over the Internet. However, encapsulation of traffic into a tunnel has an impact on performance. Many folks equate performance to bandwidth restrictions, but this is an incorrect assumption concerning tunnel encapsulation. Performance issues can be resolved by ensuring that the VPN solution you purchase supports rapid encryption at wire speed.
If you have a site-to-site VPN you can control the bandwidth at the hub-and-spoke end if the technology allows it. This requires a VPN platform or VPN-capable router sitting between the users and the broadband connection to the Internet. In most site-to-site VPN solutions, there are bandwidth-control mechanisms that allow you to control how much bandwidth each user can get, and some provide the granularity to support Quality of Service (QoS) for prioritizing applications. If you have a router that supports QoS, you can take matters in your own hands, but this scenario is not cost effective if you have to purchase VPN gear and a router to enable bandwidth management.
The most difficult bandwidth problem to solve is a scenario where an end user has VPN client software loaded on their PC and a standard broadband connection to the Internet. This is common for remote sites that are small (five-10 employees) and do not warrant a router or VPN device deployed at the site. It's just 10 folks with a broadband Internet connection. They utilize the Internet connection intermittently to connect back to corporate, but when they need the bandwidth, they need the bandwidth. This scenario requires the VPN client to support bandwidth controls in coordination with the VPN concentrator. This allows the administrator to allocate bandwidth constraints to the users to prevent the Internet surfer from hogging the business bandwidth.
All of the scenarios above relate to a do-it-yourself model. However, most carriers today offer VPN (site-to-site and remote-access) solutions that should be investigated prior to any final decision. Most carriers will offer some form of bandwidth management to assist the customer in utilizing the service effectively.
The bottom line is that VPN bandwidth is a serious challenge when the VPN is set up over broadband Internet connections rather than using a private VPN. Vendors and carriers tout the ability to provide bandwidth controls and QoS. However, you must keep in mind that the traffic will be going over the Internet. Unless you have purchased a VPN that provides QoS as a part of the package, your mission-critical traffic will be in the same queue as any other Internet traffic. You can only control the traffic as it leaves your sites. This must be considered when evaluating broadband VPN (i.e. over the Internet) versus traditional VPN (private line, leased-line mesh).
About the author
Robbie Harrell (CCIE#3873) is the National Practice Lead for Advanced Infrastructure Solutions for SBC Communications. He has over ten years of experience providing strategic, business and technical consulting services. Robbie resides in Atlanta, and is a graduate of Clemson University. His background includes positions as a Principal Architect at International Network Services, Lucent, Frontway and Callisma.
This tip originally appeared on SearchNetworking.com.
