RESELLER CHANNEL: VPNs Are Hot

Posted: 6/2003

VPNs Are Hot
Resellers Tap Managed Revenue Stream

By Tara Seals

Resellers always are looking for high-margin, high-value "sticky" services that are virtually hassle-free to implement and support. They've found just that in managed IP-based Virtual Private Networks -- outsourced versions of the network technology layered with managed services.

IP VPNs, which use a shared IP network with user authentication, tunneling and encryption technology for security, generally are more cost effective than traditional private networks, offer any-to-any connectivity and support voice, video and converged services on one network, giving users economies of scale. Offered as a managed service, IP VPNs give users control over security, class of services and other key aspects while offloading equipment maintenance, network monitoring systems and IT staff associated with deploying a wide area network.

"The drivers for this kind of service are cost and manageability -- do you have the resources in-house?" says Cliff Young, CEO at ClearPath Networks Inc. "Many times they don't and the branch locations are small -- you have to have software, hardware, people."

For these reasons, the slow drip of VPN service uptake among enterprises has become a full-force flood as customers continue look for alternatives to pricey, legacy private line and frame relay for remote access and meshed wide area networking. A new study by InfoTech projects the U.S. market for managed IP VPNs to explode, from $1.5 billion in 2002 to $11 billion by 2005. "Enterprises that currently manage their private line and frame relay data networks are starting a major transition to IP VPNs managed by service providers," reads the report. "Enterprises look for these managed IP VPNs to reduce IT budgets and support resources, particularly at their small remote sites and branch offices."

Most of that revenue is from data networking, InfoTech reports, but by 2005, 75 percent will be from converged networks supporting voice and video too.

FREE-FLOWING APPLICATIONS

In today's business economy, CFOs want to know how technology can enable business. To sell technology, resellers thus must lead with the applications.

"IP VPNs are probably the hottest area in wide area networking today," says Henry Goldberg, a senior analyst with In-Stat/MDR. "They enable organizations to establish connectivity for site-to-site Intranets, remote users and Extranets."

Goldberg says 21 percent of end users planning an IP VPN in the next two years expect to use an outsourced VPN service. "To increase market share, service providers must overcome end-user concerns about control of security issues, and clarify the advantages of outsourced services," he says.

The broadband-intensive managed VPN offers have become platforms for applications -- and additional reseller revenue streams, beyond the VPN itself. By virtue of being IP-based, providers can layer IP voice and video services, high-margin extranet services and more on top, in addition to managed security and network monitoring.

"The possibilities are nearly limitless," says Jeff Wilson, executive director at Infonetics Research, who notes managed VPN service increase the end user's dependency on and loyalty to the service provider.

In June, managed IP VPN service provider SAVVIS will launch a white-label reseller program with a two-pronged approach: Applications and vertical markets.

"This is an application-managed solution," says Don Goodwin, vice president of the alternate channel at SAVVIS. "Customers with rich media applications or ASP applications that need this to deliver advanced software solutions when the best efforts of the Internet have not done well for them are the targets. This allows resellers to deliver higher-quality service to support real-time, mission-critical applications."

SAVVIS has signed Polycom Inc. reseller iVCI, which embeds SAVVIS' private network capabilities in the video offer.

"That's a model we want to build. We're looking to duplicate that, that's the focus for the second half of the year," says Goodwin.

Similarly, ClearPath targets systems integrators to sell its service, who want to recommend applications. "That's what's driving the delivery of the infrastructure," says ClearPath's Young. "This is a turnkey application infrastructure layer that gives you affordability, management and connectivity."

BellSouth Corp. recently launched the BellSouth Managed Network VPN Service, which is designed for advanced data networking. The services suite supports remote access, intranet, Internet and extranet business applications, using a region-wide private IP backbone running MPLS. Connectivity services include network VPN site-site service, network VPN remote user service, AAA hosting and Internet access with integrated firewall.

BellSouth's managed VPN is available to resellers and other companies looking to add value-added services to their portfolios. For instance, Lynk Systems Inc., a payment processing company with a fleet of point-of-sale terminals and ATMs, now sells the "DataLynk" service for its customers based on the BellSouth service which offers merchants real-time terminal status messages, consumer transaction data and terminal management data over the VPN.

"BellSouth's Network VPN service enables us to provide a secure, fast and cost-effective communications solution to our customers," says Ken Paull, Lynk's executive vice president. "Security, speed and cost are critical issues to our customers, and therefore, to the continued growth of our business. We also see the opportunity for our customers to leverage this service beyond payment processing to add other valuable data applications."

ClearPath meanwhile offers closed user groups, so companies can decide which sites can see each other, making it practical for credit card transactions and extranet partners. It includes quality of service (QoS) by using ATM over a private backbone, then layers managed services such as reporting, firewalls and filtering.

"The application is the driver for the network quality of service. Network-based applications like point of sale, ERP and CRM are more in vogue," says Young. "It used to be e-mail, where you didn't need QoS, just straight Internet access."

Use of IP VPNs
Source: IDC's U.S. WAN Manager Survey, 2002

LOW MAINTENANCE GATHERS STEAM

With applications driving interest, the underlying technology takes a back seat. Managed offers increase the value proposition for the enterprise by eliminating customer premise equipment overhead and the extensive support, maintenance and IT crew it takes to keep up with it.

Recognizing this challenge, NTT/Verio Inc. is rolling out a fully managed, yet CPE-based, IP VPN, dubbed SafeGuard VPN.CPE. It targets medium and large businesses with multiple branch office locations and is available through Verio's reseller base.

The offer protects organizations' corporate data with security devices located on customer premises, IPSec tunneling and encryption. The VPN uses a Cisco IP VPN security device that acts as an IP router, VPN gateway and Content-Based Access Control (CBAC) firewall, supporting dedicated access speeds from T1 to OC3.

However, Verio gets around CPE overhead by proactively handling all management functions remotely, so the solution offers the same advantages as its network-based cousins. "This latest VPN service provides businesses with full CPE support, including hardware acquisition, management and field replacement," explains Susan May, director of security products for Verio's Broadband Services unit. "The automated solution is easily scaleable, which is something customers repeatedly emphasize."

The savings can be significant. In-Stat/MDR estimates large organizations with in-house IP VPNs will spend an average of $250,000 per year on customer premise IP VPN equipment.

With the same low-overhead ends in mind, some carriers have rolled out network-based managed VPNs that use multiprotocol label switching (MPLS) and other in-core technologies to provide CPE-level security, plus intelligence.

Global Crossing, for example, will integrate its two IP VPN offers into one in the June timeframe. The SmartRoute service offers class of service and QoS, maps to Global Crossing's global network of 200-plus cities and 27 countries, and works with network node interfaces. Express Route is MPLS-based and can be Layer 2 or Layer 3.

"We're going to integrate these so there's MPLS, routing and switching at the core, and security/remote access at the edge, so the customer gets all the benefits of SmartRoute with the throughput of MPLS," says Anthony Christie Sr., vice president of product and offer management at Global Crossing Ltd.

Managed services, such as network monitoring, reporting and management are included. Global Crossing is wholesaling to service provider customers that need a global backbone, such as RBOCs and PTTs.

In another example, MCI's new private IP, network-based VPN service makes life easier for both customer and reseller. It comes bundled with real-time traffic management and performance reporting capabilities. The Private IP Platinum service, available through MCI resellers, offers a Web-based interface so customers can review and evaluate VPN metrics like latency, throughput, circuit usage and packet loss, in real time. The view of the network systems includes the physical network, operating environment, provisioning, alarm systems and traffic routing mechanisms.

These network-based offers require the reseller partners private-labeling the service to have little to no VPN expertise and support infrastructure.

"Access to VPN expertise is scarce and many service providers have had a difficult time building out their own infrastructure," explains Infonetics' Wilson. "Outsourcing helps service providers get to market quickly, reduce the costs of building and operating services and provide a high level of service flexibility."

For example, Avaya Inc. offers the Service Provider Managed VPN resale solution, specifically geared for service providers to extend a managed IP VPN service to customers, while leaving the actual integration, implementation and management to Avaya. Resellers also can strengthen the offer by bundling their own network access offers with the VPN.

"Service providers can collaborate with Avaya to deepen their value proposition by offering the features and functionality that enterprises want in new and more attractive ways, while reducing operational costs and building incremental revenue," says Forouz Firoozi, vice president of service provider solutions at Avaya. "Enterprise customers want Avaya features, but they want more than just an expense model -- they want the option to outsource the management and technology. So, from both the service provider's and enterprise's perspective, the Avaya Service Provider Managed VPN Solution is a cost- effective way to achieve secure communications without additional capital expense to develop and maintain an in-house VPN network."

REFRESHING THE RESALE MARKET

Selling managed VPN service also opens up new customer segments for resellers. Whereas most large organizations already have WANs, remote access networks or other connectivity options in place, small and midsized businesses have found networking beyond the LAN to be prohibitively expensive. With no hardware, software or ongoing maintenance requirements, managed IP VPNs are bringing the larger networking opportunity to these smaller organizations for the first time by offering a subscription-based model.

For instance, BellSouth's new managed VPN service costs around $100 to $1,000 per month, per site depending on access -- DSL to T3 speed. Remote users that already have access can be added to a corporate VPN for $15 to $20 per month, per user.

"While most enterprises do not dispute the value of IP VPN services, actually quantifying the return on investment -- how, and to what degree, IP VPNs can improve their bottom line -- has been a challenge for many," says Steven Harris, research manager at market research firm IDC.

IDC examined the return on investment from operational and other efficiencies and found that it can be quite powerful. For instance, the firm examined companies switching from frame relay to managed service provider SAVVIS' VPN service, and found an average payback of 201 days. For those enterprises moving from Internet-based IP VPN solutions to SAVVIS, the payback period was 226 days. And the average three-year savings was $2.8 million to $3 million.

Managed VPN offers also drive broadband adoption in these markets. InfoTech's 2002 report, "Managed VPNs: Enhanced Revenue Opportunities for Service Providers," says that customers deploying VPNs will buy broadband Internet connections for remote users and sites, including those that weren't connected before the VPN was installed.

BTopenworld, British Telecom plc's mass market Internet business, has employed the strategy. It bundles Avaya's managed IP VPN resale solution in a broadband Internet package, the BTopenworld Teleworker. This solution specifically targets small and medium-sized enterprises to offer fast, secure and cost-effective access between home and the office. BT says BTopenworld provides Internet access to more than 1.6 million users.