VPN Support in the ISP Environment
The cheapest VPN would be obtained if the campus sites simply connected to the Internet and used encrypted tunnels to carry their traffic across the Internet. However, given the wide variety of threats that exist on the open network, as well as the wide performance fluctuations, it is much more likely that the VPN service would be offered on a private network physically separate from the one that the ISP uses for global Internet connectivity. A customer network would have access to both the public Internet and the ISP-private network. Several customers would be multiplexed on to the ISP-private network. This would reduce the overall cost to the ISP of maintaining its network, and the ISP would be able to offer VPN access to the customer at a reduced cost over having his or her own private intranet.
Such a scenario is shown in Figure 4.5. You see an ISP offering VPN services to two customer enterprises on an ISP-private network. The first customer (Customer A) has three sites connected to the network. The second customer (Customer B) has two sites connected to the network. The ISP connects to other peer ISPs at an exchange point, but typically supports the private connections from the customers within its own network. The customer sites are connected to the ISP-private network and through firewalls to the ISP-public network. The firewalls connecting the customers to the Internet typically belong to the customer. At the access routers connecting the customer to the ISP-private network, the ISP has the onus of making sure that the customers are protected from each other. For the sake of brevity, I have shown the access routers and firewalls only at the first campus of both customers. It's implied that a similar structure needs to be in place on each campus.
){kind=link}
Figure 4.5
A VPN Deployment Scenario
The high-level policies for deployment—in this case, for the ISP—would be to define the correct set of VPNs and to enable access among its customers in the environment shown in Figure 4.5. Such a solution can be obtained by using IKE and IPsec-based encrypted communication.
The low-level security policy for the ISP deploying the VPN service would be the configuration of the access routers, which provides for insulation among the different customers. On the ISP-private network, only the campuses that belong to the same customer are allowed to talk to each other. Therefore, the various access routers in the network must be configured to enforce these criteria.
Our assumption here is that the access routers would implement IKE and IPsec functions to support the VPN service. Therefore, the appropriate low-level policy for each box would be the specification of the IKE configuration, as described previously. These would consist of the specification of the phase one and two characteristics, transform lists, and tunnel descriptions. These need to be obtained so as to support the VPN definitions as required by the supported set of customers.