Viop phone - Voice Over IP

Although we’re presenting some typical numbers here, you should run the numbers using your own particular configuration. The most beneficial comparisons of a VPN occur when compared to a dedicated, line−based network or one that makes extensive use of long distance dial−up lines. If you are already using a shared network (Frame Relay or ATM), the cost savings are not so striking. Consider that a VPN box at each location might cost $5,000 including installation; multiplied by seven sites is equal to $35,000. Now, how long will it take to save this cost if you substitute your ISP charges for each location and subtract the cost of your existing T1 or Frame Relay network? If you had six T1s at $5,000/month, you might now have seven T1 access lines from your ISP at $3,000 or $4,000/month. The $7,000/month savings will pay off the $35,000 investment in 5 months. If your Frame Relay service is costing $1,000/month per location, the break−even point doesn’t happen in any reasonable period. Using remote access server and dial−up lines is cheaper to install, costing about $6,000 to $7,000 for about 20 users to install at the central location. Now comes the big bite, which is the long distance charge from all the remote locations. This could easily grow to $5,000/month if each of the users spent two hours online. Each working day at $0.10/minute is about $8,000/month. Plug in your own assumptions as to duration and cost of telephone calls here. (Even at 1 hr/day and
$0.06/minute, that is $2,000/month for 20 users). A VPN system might cost $14,000 to install, including licenses for PC software at each location. The ISP charges that are $20/user/month, plus an ISDN line at the home shop for $100/month, means that we are saving $1,500 in monthly charges. We can pay off the system in 10 months. Again, do not assume that it will pay off in all cases. But, in all cases, it is worth the effort to perform the calculations. viop Your VPN will definitely require more network management than a dial−up system, so the cost of perhaps an additional system administrator may have to be added.

Proprietary Protocols
Most VPN products are designed strictly around IP. They will often handle other protocols, such as AppleTalk and IPX, by tunneling them inside of IP packets. This introduces both overhead and delay. If the amount of “foreign” protocol traffic is small, then this is not significant. If the bulk of your network is IPX or Apple talk, we recommend you investigate VPN vendors who will support these protocols in native mode.

VoIP VPN
The justification for doing VoIP on a VPN is primarily security, along with the reduced cost of VoIP. Depending on usage, voice generates relatively large amounts of traffic. Be sure to include this additional traffic in your sizing estimates. Our discussion of VoIP applies to whether we have a VPN or not. With a VPN, the delays due to encryption are larger, and therefore we would expect that the performance of voice over the VPN would be worse than VoIP. If we have chosen a network provider who will offer a SLA with QoS, there is a better chance for success, but the delays due to encryption and basic packet switching will still be there. With the exception of international calling, one must have a very large calling volume to make it worthwhile to put voice over the Internet and suffer the attendant quality
reduction.

Summary

VPNs can provide a cost−effective solution to have secure communications across the Internet. Performance can be improved by utilizing a national/international ISP that will offer SLAs and QoS. Choosing hardware−based over software−based VPN equipment will generally provide better performance. Choosing VPN vendors who embrace standards and support multiple standards increases your flexibility to your vendor/equipment choices. Knowing your current and anticipated traffic volumes permits you to make improved cost performance studies.

read comments (0)

The goal of any network is to support users in a flexible, reliable, secure, and inexpensive manner:

• Network managers want the network to be flexible.
• Users want the network to be reliable and secure.
• Management wants the network to be inexpensive.

A balance of these often−competing goals can be achieved, provided a good dialog is maintained among the participants. It is an exercise left to the reader to select from the list those applications and users who are to be served. The network list indicates that these users and applications could be interconnected by any of these network technologies. As indicated previously, dedicated networks are expensive and rarely fit the need perfectly. Frame Relay and Asynchronous Transfer Mode (ATM) are shared network technologies that can be very cost effective, depending on the geography and traffic volume. Dial−up telephony can be a networking technology for highly mobile, low−volume users. Normally, we would like to have a backbone network with direct access for various users and dial−up remote access for infrequent users. We will discuss these alternatives in the following sections.

Shared Networks

The advantage of shared networks is that organizations do not have to incur the entire cost of the infrastructure. For that reason, Frame Relay has been extremely popular. Because it (like X.25 before it) is virtual circuit based, there is little concern about misdirected or intercepted traffic. Still, Frame Relay service is not universally available and access charges to a point−of−presence (POP) can be expensive. However, compared to the cost of dedicated networks, shared networks offer equivalent performance and a much lower cost.

Internet

The next logical step is to use the Internet as the private network. It is almost universally accessible, minimizing access charges. From our discussion of the Internet in Chapter 29, “Synchronous Optical Network (SONET),” two things are clear

• No one is watching the traffic or performance of the Net as a whole.
• The path our data takes across the network is quite unpredictable.

This leads to the conclusion that performance will be unpredictable and that our precious corporate data may pass through a router on the campus of “Den−of−Hackers University.” (It is not the intent here to malign university students, but only to offer the observation that they are bright, curious, love a challenge, and may have time on their hands and access opportunity to do a little extra curricular research on the vulnerability of data on the Internet.) There are then two problems: performance and security.

Performance

The performance issue poses the problem of sizing the bandwidth on each link, which becomes a major task as the network grows. Unfortunately, few network managers have a good handle on the amount of traffic flowing between any given pair of locations. Typically, they are too busy handling moves and additions to the network, which frequently leads to performance problems. Because the network grew without the benefit of a design plan, invariably, it means that portions of the network, including servers, become overloaded.

A dedicated line network is expensive, requires maintenance, and necessitates a backup plan should a line or two fail. Using a shared network does not alleviate the problem of traffic analysis. On the contrary, we now have to worry about the capability of the Internet to provide the bandwidth we need when we need it. Selecting our ISP to provide the performance we need becomes an important issue.

Outsourcing

One solution is to outsource the network to a network provider (the analogy to a voice VPN here is strong). The most popular previous solution was to lease Frame Relay service. The benefit was that the network provider took care of the management of the network and even provided levels of redundancy (for which you paid) within its network. Unfortunately, to make most efficient use of this service, one still needed to have a handle on traffic volumes. For example, a committed information rate (CIR) that was too low resulted in lost data and retransmission, while a CIR set too high was a waste of money.
A national or international carrier with its own Internet backbone then becomes a good choice as a VPN provider. One negotiates service level agreements (SLA), which include quality of service (QoS) guarantees. Some ISPs even provide Virtual IP Routing (VIPR) in which they permit you to use internal, unregistered IP addresses. If one builds a completely independent, internal (intranet) network, one could use any set of IP addresses one might choose. This alternative is attractive to large corporations that are constrained to using class C addresses. If these private addresses were to get out onto the Internet, chaos would quickly ensue. VIPR permits the flexibility to continue to use this unregistered set of addresses transparently across the Internet. This is strongly analogous to having one’s own dialing
plan on a voice VPN. There are many possibilities and choices here. We can outsource the whole network, including the VPN equipment on each site, or outsource pieces.
Standard Outsourcing Issues A few points are worth making about outsourcing. One must take a realistic look at the task at hand:

• If the internal staff possesses the capability to implement the VPN, do they have the time?
• If you outsource the whole network, how permanent will the relationship be?
• To what extent will the internal staff become involved in the design and maintenance of the VPN?

Choose your vendor carefully. Evaluate responsiveness in the areas of presale support, project management, and post−sale support. As in any procurement process, writing a system specification and Request for Proposal (RFP) is essential. Also, make up the evaluation criteria ahead of time. You may (or may not) choose to publish the evaluation criteria in the RFP. Select the vendor who is most responsive to your requirements. Here is a good opportunity for the vendor to do the traffic analysis so that a traffic baseline for design can be established. Always include growth in the RFP. Ongoing support will be critical. If the network spans multiple time zones, specify the minimum support requirements. For example, 9 A.M. to 5 P.M. CST is of little use to offices located in Taiwan. What training is offered as part of the package? The more knowledgeable the internal staff can be, the better they will be able to support the VPN — even when they are outsourcing support. It is important to have a coordinated security plan so that we have an integrated and consistent view across our firewalls, proxy servers, and VPN equipment

Security

The basic concept of a VPN is to provide a secure, point−to−point connection across the network between communicating entities. A couple of questions about security are important to keep our paranoia in check. The first question is how much security is enough? To answer that question, wemust consider the impact on our business if the data we are sending is

• Simply lost. Is there a backup mechanism for sending or recovering the data?
• Found by another business (not a competitor).
• Found by a competito

In the last case, we must ask how much effort is the competitor willing to invest to get our data? The answer to these questions will help us decided how much security is enough. Note that in the foregoing example, one can equally substitute the word hacker for competitor. What About Security Issues? Turning to security, remote access to a system must have integral security to protect the network and users from unauthorized access and penetration. We have all heard about the teenaged hackers who have been creating havoc in the data processing and Internet business. These young hackers break into systems for the sheer pleasure of challenging the system and showing their prowess with the modem. And it works, because they do it every day. We, therefore, have to consider these issues before opening a door. We must start with different techniques such as VPNs, encryption, authenticating servers, and secure firewalls. The key technologies that compose the security component of a VPN are

• Access control to guarantee the security of network connections
• Encryption to protect the privacy of data
• Authentication to verify the user’s identity as well as the integrity of the data

What Can We Do to Secure the Site? Remote access users sitting in a distant site need to know how to use the system, so training is important. A company with salespersons who travel frequently would provide 800 number access. Hardware considerations vary, depending on what networking you’re using, the number of users, and whether the users need desktops or laptops at the remote location. Standardization is essential — you don’t want three or four different platforms, and you don’t want to have to support 47 varieties of software. We want to leave the variety of flavors to the ice cream manufacturers! Additionally, a firewall service will offer a bastion router capability to filter the packet, the protocol, or the user id and address. These systems will help to keep out unwanted guests. Firewalls can be in different places, as we will see. They can also be integrated or CPE solutions. Security must also be ensured while the data is in transit. Therefore, we need to use a form of encryption so that an eavesdropper cannot listen in on our data and intercept it. By using Internet Protocol Security (IPSec) techniques, we introduce up to five different forms of encryption and digital signatures. These will be sufficient to delay any access to the data and by the time the code could be broken, the data will have little value.
Authentication is also a very effective tool that challenges the caller and requests a key−coded response. In a security dynamics environment, a challenge and response can be issued by default every 30 seconds or user variable to effectively manage the logged−on users. What Are the Risks? The risks posed on data integrity and security take many forms. We usually think of data protection in terms of the corruption or total loss of data. However, other areas of concern may be from the undetected interception of the data by hackers or crackers. Moreover, the inaccessibility of our data from the denial of service attacks has become more prevalent in the security issues facing the IT manager. Lastly, there are also issues of invasions on our LANs or WANs when a promiscious device is attached to the network and picks off all data packets regardless of the addressee. These sniffers, as they are called, can capture all data packets from
the network, usually undetected.

• Hackers
• Crackers
• Salami attackers
• Denial−of−service attacks
• Sniffer

read comments (0)

Internet−Based VPN

the same time. The philosophical point is that a dedicated network will be overbuilt in some areas and underbuilt in others. A shared network offers the hope that we can spread the overall cost out while getting the benefits of a private network. Historically, this accounts for the popularity of shared data networks beginning with X.25, Frame Relay, ATM, and now the Internet. The Internet has become a popular, low−cost backbone infrastructure.
Because of its ubiquity, many companies now want to use a secure Virtual Private Network (VPN) over the public Internet. The challenge in designing a VPN is to exploit the technologies for both intracompany and intercompany communication while still providing security. Of course the rule of thumb we now use in an Internet Protocol (IP) network is “IP on everything.” A VPN is an extension of an organization’s private intranet across a public network (that is, the Internet), creating a secure connection essentially through a tunnel. VPNs securely convey information across the Internet connecting remote users, branch offices, and business partners into the corporate network.

VPNs are owned by the carriers, but used by corporate customers, as though the customers owned them. A VPN is a secure connection that offers the privacy and management controls of a dedicated point−to−point leased line, but actually operates over a shared routed network. In the past we saw traditional networks being built as part of a leased line, point−to−point network. This was expensive and risky. A single link error brought the network down. Later a virtual networking scenario emerged using a packet−switching technology called Frame Relay. This demanded that presubscribed links were established by being premapped in logic. VPNs are created using encryption, authentication, and tunneling, a method by which data packets in one protocol are encapsulated in another protocol. Tunneling enables traffic from multiple organizations to travel across the same network, unaware of each other, as if enclosed inside their
own private steel pipe. It is easy to jump to the conclusion that the Internet is free and, therefore, there are tremendous cost savings to be had from this free shared network. Later, we will explore some cost comparisons, but as one might guess, the relative cost benefit depends very much on each network’s geography and traffic volume.

read comments (0)

A network is a series of interconnections that form a cohesive and ubiquitous connectivity arrangement when all tied together. That sounds rather vague, so let’s look at the components of what constitutes the telecommunications network. The telecommunications network referred to here is the one that was built around voice communications but has been undergoing a metamorphosis for the past two decades. The convergence of voice and data is nothing new; we have been trying to run data over a voice network since the 1970s. However, to run data over the voice network, we had to make the data look like voice. This caused significant problems for the data because the voice network was noisy and error−prone. Reliability was a dream and integrity was unattainable, no matter what the price.
Generally speaking, a network is a series of interconnection points. The telephone companies over the years have been developing the connections throughout the world so that a level of cost−effective services can be achieved and their return on investment (ROI) can be met. As a matter of due course, whenever a customer wants a particular form of service, the traditional carriers offer two answers:

• It cannot be done technically.
• The tariff will not allow us to do that!

Regardless what the question happened to be, the telephone carriers were constantly the delay and the limiting factor in meeting the needs and demands for data and voice communications. In order to facilitate our interconnections, the telephone companies installed wires to the customer’s door. The wiring was selected as the most economical way to satisfy the need and the ROI equation. Consequently, the telephone companies installed the least expensive wiring possible.

Because they were primarily satisfying the demand for voice communications, they installed a thin wire (26−gauge) to most customers whose locations were within a mile or two from the central office. At the demarcation point, they installed the least expensive termination device (RJ−11), satisfying the standard two−wire unshielded twisted pair communications infrastructure. The position of the demarcation point depended on the legal issues involved. In the early days of the telephone network, the telephone companies owned everything, so they ran the wires to an interface point and then connected their telephone equipment to the wires at the customer’s end. The point here is that the telephone sets were essentially commodity−priced items requiring little special effect or treatment. When the data communications industry began during the late 1950s, the telephone companies began to charge an inordinate amount of money to accommodate this different service. Functionally, they were in the voice business and not the data business. As a matter of fact, to this day, most telephone companies do not know how to spell the word data! They profess that they understand this technology, but when faced with tough decisions or generic questions, few of their people can even talk about the services. How sad, they will be left behind if they do not change quickly. New regulations in the United States, in effect since the divestiture agreement, changed this demarcation point to the entrance of the customer’s building. From there, the customer hooked up whatever equipment was desired. Few people remember that in early 1980, a 2400 bps modem cost $10,000. The items that customers purchase from myriad other sources include all the pieces
we see during the convergence process. In the rest of the world today, where full divestiture or privatization has not yet taken place, the
telephone companies (or Post, Telephone, and Telegraph [PTTs]) still own the equipment. Other areas of the world have a hybrid system under which customers might or might not own their equipment. The combinations of this arrangement are almost limitless, depending on the degree of privatization and deregulation. However, the one characteristic that is common in most of the world to date is that the local provider owns the wires from the outside world to the entrance of the customer’s building. This local loop is now under constant attack from the wireless providers offering satellite service, local multipoint distribution services (LMDS), and multichannel multipoint distribution services (MMDS). Moreover, the CATV companies have installed coaxial cable or fiber, if new wiring has been installed, and they offer the interconnection to business and residential consumers alike. The Competitive Local Exchange Carriers (CLECs) who survived the bloodbath and fallout of 2000 and 2001 still remain as formidable foes to the local providers. They are installing fiber to many corporate clients (or buildings) with less expense and long−term write−off issues. The CLECs are literally walking away from the telephone companies’ local loop and using their own infrastructure. Add the x−Type Digital Subscriber Line (xDSL) family of products to this equation and the telephone companies are running out of options. The Community Antenna Television (CATV) companies are still outpacing the installation of Internet cable modems compared to the use of DSL services by the Regional Bell Operating Company (RBOC) and the CLECs. The numbers will probably change over time, but the current rate of installation is in the favor of the cable companies. This is where the CATV companies see the convergence occurring.

read comments (0)