Views

Difference between revisions of "VPN Site-to-Site networking"

The Wiki of Unify contains information on clients and devices, communications systems and unified communications. - Unify GmbH & Co. KG is a Trademark Licensee of Siemens AG.

Jump to: navigation, search
(Important informations)
 
(9 intermediate revisions by 2 users not shown)
Line 1: Line 1:
<div class="breadcrumb">
+
{{Breadcrumb|0|0|Communications Systems}}
{{up}} [[Platforms]]
 
</div>
 
 
 
__TOC__
 
= VPN Site-to-Site networking =
 
  
 
== VPN without normal Internet traffic ==
 
== VPN without normal Internet traffic ==
  
This Site-to-Site networking scenario lets an enterprises to use:
+
This Site-to-Site networking scenario lets enterprises to use:
  
* HiPath 2000 as [[VPN]] Site-to-Site gateway both for Voice and Data traffic.
+
* HiPath 2000 as Site-to-Site [[VPN]] gateway both for Voice and Data traffic.
* HiPath 2000 as a cost-effective gateway to route [[VoIP]] traffic by means of use [[CorNet]]-IP trunking between sites over VPN trunk.
+
* HiPath 2000 as a cost-effective gateway to route [[VoIP]] traffic by performing SIP and [[CorNet]]-IP IP trunking between sites over [[VPN]] trunk.
* HiPath 2000 as gateway to access enterprise resources and applications available on the company’s VPN networked sites.
+
* HiPath 2000 as gateway to access enterprise resources and applications available on the company’s [[VPN]] networked sites.
  
 
=== Overview ===
 
=== Overview ===
  
VPN Site-to-Site networking ''without'' normal Internet traffic '''Overview''' ''here''
+
[[Image:H2k_VPN_StS_Networking_1.png|HiPath 2000 VPN Site-to-Site networking scenario without normal Internet traffic]]
  
 
=== Important informations ===
 
=== Important informations ===
  
 
* Basic bandwidth reservation for Voice can be implemented on HiPath 2000 setting:
 
* Basic bandwidth reservation for Voice can be implemented on HiPath 2000 setting:
** Outgoing Bandwidth Control
+
** Outgoing Bandwidth Control.
** B-Channels limitation
+
** B-Channels limitation.
* No external Firewall is required at site (HiPath 2000 features firewalling service)
+
* No external Firewall is required at site (HiPath 2000 features firewalling service).
 
* If, at some point, ''normal'' Internet traffic (like Web navigation, Mail server access, etc.) is required by the Customer, then Hipath 2000 VPN Site-to-Site networking implementation must be designed according to [[#VPN with normal Internet traffic|VPN with normal Internet traffic]] scenario. In that case:
 
* If, at some point, ''normal'' Internet traffic (like Web navigation, Mail server access, etc.) is required by the Customer, then Hipath 2000 VPN Site-to-Site networking implementation must be designed according to [[#VPN with normal Internet traffic|VPN with normal Internet traffic]] scenario. In that case:
** Customer need to ensure itself with additional ISP connection to Internet
+
** Customer need to ensure itself with additional ISP connection to Internet.
 
** Customer need to ensure additional devices/services like:
 
** Customer need to ensure additional devices/services like:
*** Router, necessary to route LAN hosts normal data traffic to Internet
+
*** Router, necessary to route LAN hosts normal traffic to Internet.
*** Firewall, necessary to protect LAN hosts and implement [[DMZ]] at site
+
*** Firewall, necessary to protect LAN hosts and implement [[DMZ]] at site.
*** Proxy, necessary to implement Internet traffic policies
+
*** Proxy, necessary to implement Internet traffic policies.
  
 
== VPN with normal Internet traffic ==
 
== VPN with normal Internet traffic ==
Line 40: Line 35:
  
 
* Normal Internet traffic completely separated from Voice traffic by means of second Internet connection to ISP:
 
* Normal Internet traffic completely separated from Voice traffic by means of second Internet connection to ISP:
** Voice quality over VPN is preserved from normal Internet traffic side effects (No Voice/Date traffic congestion, no burstly data traffic or high downstream can jam Voice connections)
+
** Voice quality over [[VPN]] is preserved from normal Internet traffic side effects (No Voice/Date traffic congestion, no burstly data traffic or high downstream can jam Voice connections).
** HiPath 2000 can manage VPN Bandwidth entirely (No Bandwith share with normal Internet traffic)  
+
** HiPath 2000 can manage [[VPN]] Bandwidth entirely (No Bandwith share with normal Internet traffic).
** HiPath 2000 lightweight processing power requirements handling and routing only Voice traffic over VPN Trunk.
+
** HiPath 2000 lightweight processing power requirements handling and routing only Voice traffic over [[VPN]] Trunk.
* Routing/Security policies demanded at additional Proxy/Firewall devices for normal Internet traffic handling
+
* Routing/Security policies demanded to external Proxy/Firewall devices for normal unencrypted Internet traffic handling.
  
 
== VPN with normal Internet traffic and QoS support ==
 
== VPN with normal Internet traffic and QoS support ==
Line 53: Line 48:
 
=== Important informations ===
 
=== Important informations ===
  
VPN Site-to-Site networking ''with'' normal Internet traffic and QoS support '''Important informations''' ''here''
+
* The [[ISP]] must support [[QoS]] to ensure sufficient voice packet quality (According to specific [[SLA]])
 
+
* HiPath 2000 as [[VPN]] Site-to-Site gateway to a single ISP access, used for both:
* HiPath 2000 V1.0 as VPN gateway for voice and data and Internet gateway
+
** Voice and Data traffic.
Cost-effective cross-traffic with IP trunking via VPN route
+
** Normal Internet traffic.
Access to central resources (file servers, HiPath applications) at the company’s head office
+
* HiPath 2000 as a cost-effective gateway to route:
Shared Internet access for Internet traffic and VPN (intranet traffic)
+
** [[VoIP]] traffic by performing [[CorNet]]-IP trunking between sites over VPN trunk.
Operation of public servers in a separate network (DMZ) is possible
+
** normal Internet traffic to ISP.
Proxy must be transparent for VPN
+
** traffic to [[DMZ]] at site.
The ISP must support QoS to ensure sufficient call quality
+
* External additional Proxy/Firewall:
 
+
** must be capable to handle traffic carried by [[VPN]] transparently.
Customers advantages
+
** offer high level of Security for normal unencrypted Internet traffic
 
+
* HiPath 2000 as gateway to access enterprise resources and applications available on the company’s [[VPN]] networked sites.
High level of security with use of an additional firewall for controlling the unencrypted traffic to and from the Internet
+
* The ISP access can be overloaded (Available bandwidth could be used by massive or bursty downloads) affecting Voice quality first (Bursty data traffic, high downstream can jam Voice connections).
Installation and administration of firewall and virus scanner at one site only
+
* Operation of public servers on ([[DMZ]]) is only recommended QoS can be provided by [[ISP]] and access Router is able to support bandwidth control for both Voice and Data traffic.
Cost savings with use of a shared Internet access for Internet traffic and VPN (intranet traffic)
+
* Not all ISPs are able nor have a suitable infrastructure ready to offer adequate/any [[QoS]] features on their Internet access.
 
 
Important hints:
 
The Internet access can be overloaded by downloads from the Internet. The quality of calls is massively impaired during the downloads.
 
Operation of public servers in a separate network (DMZ) is only recom-mended if the ISP provides QoS and the access router supports a band-width control for voice/data.
 
Internet connections that support QoS are not offered by every ISP and are also more expensive than conventional Internet connections.
 

Latest revision as of 10:54, 24 April 2011

VPN without normal Internet traffic

This Site-to-Site networking scenario lets enterprises to use:

  • HiPath 2000 as Site-to-Site VPN gateway both for Voice and Data traffic.
  • HiPath 2000 as a cost-effective gateway to route VoIP traffic by performing SIP and CorNet-IP IP trunking between sites over VPN trunk.
  • HiPath 2000 as gateway to access enterprise resources and applications available on the company’s VPN networked sites.

Overview

HiPath 2000 VPN Site-to-Site networking scenario without normal Internet traffic

Important informations

  • Basic bandwidth reservation for Voice can be implemented on HiPath 2000 setting:
    • Outgoing Bandwidth Control.
    • B-Channels limitation.
  • No external Firewall is required at site (HiPath 2000 features firewalling service).
  • If, at some point, normal Internet traffic (like Web navigation, Mail server access, etc.) is required by the Customer, then Hipath 2000 VPN Site-to-Site networking implementation must be designed according to VPN with normal Internet traffic scenario. In that case:
    • Customer need to ensure itself with additional ISP connection to Internet.
    • Customer need to ensure additional devices/services like:
      • Router, necessary to route LAN hosts normal traffic to Internet.
      • Firewall, necessary to protect LAN hosts and implement DMZ at site.
      • Proxy, necessary to implement Internet traffic policies.

VPN with normal Internet traffic

Overview

VPN Site-to-Site networking with normal Internet traffic Overview here

Important informations

  • Normal Internet traffic completely separated from Voice traffic by means of second Internet connection to ISP:
    • Voice quality over VPN is preserved from normal Internet traffic side effects (No Voice/Date traffic congestion, no burstly data traffic or high downstream can jam Voice connections).
    • HiPath 2000 can manage VPN Bandwidth entirely (No Bandwith share with normal Internet traffic).
    • HiPath 2000 lightweight processing power requirements handling and routing only Voice traffic over VPN Trunk.
  • Routing/Security policies demanded to external Proxy/Firewall devices for normal unencrypted Internet traffic handling.

VPN with normal Internet traffic and QoS support

Overview

VPN Site-to-Site networking with normal Internet traffic and QoS support Overview here

Important informations

  • The ISP must support QoS to ensure sufficient voice packet quality (According to specific SLA)
  • HiPath 2000 as VPN Site-to-Site gateway to a single ISP access, used for both:
    • Voice and Data traffic.
    • Normal Internet traffic.
  • HiPath 2000 as a cost-effective gateway to route:
    • VoIP traffic by performing CorNet-IP trunking between sites over VPN trunk.
    • normal Internet traffic to ISP.
    • traffic to DMZ at site.
  • External additional Proxy/Firewall:
    • must be capable to handle traffic carried by VPN transparently.
    • offer high level of Security for normal unencrypted Internet traffic
  • HiPath 2000 as gateway to access enterprise resources and applications available on the company’s VPN networked sites.
  • The ISP access can be overloaded (Available bandwidth could be used by massive or bursty downloads) affecting Voice quality first (Bursty data traffic, high downstream can jam Voice connections).
  • Operation of public servers on (DMZ) is only recommended QoS can be provided by ISP and access Router is able to support bandwidth control for both Voice and Data traffic.
  • Not all ISPs are able nor have a suitable infrastructure ready to offer adequate/any QoS features on their Internet access.