Remote Access Design
When designing the remote access block, you must ensure that the network users have transparent access to the network from wherever they are, just as when they are connected to the actual network. The users must be able to reach the resources they are authorized to use as they would from the enterprise campus.
In order to provide these services, the connection requirements must be analyzed carefully in order to ensure that they are fulfilled. Typical requirements include the following:
- VoIP support
- VPN support
- High-volume traffic or low-volume traffic
- Permanent connection (needed or not?)
- Type of flows
VPN Network Design
Even though the VPN concept involves security most of the time, unsecured VPNs also exist. Frame Relay is one example because it provides private communications between two locations but it might not have any security features on top of it. Whether you add security to the VPN connection depends on the specific requirements for that connection.
VPN troubleshooting is difficult to manage because of the lack of visibility in the provider infrastructure. The service provider is usually seen as a cloud that aggregates all the network locations’ connections. When performing VPN troubleshooting, you should first make sure the problem does not reside on your devices, and only then should you contact your ISP.
Types of VPN technologies include the following:
- Site-to-site VPNs or Intranet VPNs, for example, Overlay VPNs (such as Frame Relay) or Peer-to-Peer VPNs (such as MPLS). These are used to connect different locations over the public infrastructure. When using peer-to-peer infrastructure, you can communicate seamlessly between sites without worrying about IP addressing overlap.
- Remote Access VPNs, for example, Virtual Private Dial-up Network (VPDN), which is a dial-up approach for the VPN that is usually accomplished with security in mind.
- Extranet VPNs, to connect to business partners or customer networks.
With VPNs, traffic is often tunneled in order to send it over an infrastructure. The tunneling methodology for Layer 3 is called Generic Routing Encapsulation (GRE). GRE allows traffic to tunnel but it does not provide security. In order to tunnel traffic and provide security, you can use a technology called IP Security (IPSec). This is a mandatory implementation component of IPv6, but it is not a requirement for IPv4. IPSec is also used in conjunction with AAA services that allow tracking of user activity.
The main benefits of VPNs include the following:
- Scalability (you can continuously add more sites to the VPN)
- Flexibility (you can use very flexible technologies, such as MPLS)
- Cost (you can tunnel traffic through the Internet without much expense)
WAN Backup Design
WAN connectivity can achieve backup through the following approaches:
- Dial-up backup activated when the primary link fails
- Secondary WAN link used for backup and/or load balancing
- Shadow VPN, used when the ISP establishes a second permanent virtual circuit (PVC) but the user is only charged for its usage; this can be useful when the main PVC fails, or in situations where more bandwidth is needed (bandwidth overflow)
Enterprise Branch Module Design
Branch modules are sized based on the number of users it needs to accommodate, for example:
- Enterprise teleworker (1 user)
- Single-tier (tens of users)
- Dual-tier (hundreds of users)
- Multi-tier (thousands of users)
As the number of users in the branch modules grows, additional layers might be needed. Branch offices can even have a full-layer architecture (i.e., Access, Distribution, and Core Layers), as in the enterprise campus module.