But as VPNs become larger and more complex, services that help secure and manage them become more attractive. Unlike other data services such as frame relay or asynchronous transfer mode, VPNs require that all users have client software on their PCs. Ensuring that each user configures the software correctly, maneuvers the maze of VPN security precautions, and connects to the VPN when needed isn't terribly difficult to manage when there are fewer than 100 users. But the managerial and logistical headaches accumulate exponentially as more users are added to the VPN and as more addresses, locations, and security measures are instituted.

As a result, large regional Internet service providers such as GTE Internetworking, incumbent providers such as Bell Atlantic Corp. and MCI WorldCom, and even VPN service specialists such as Concentric Network Corp. and Savvis Communications Corp. have stepped in to help companies handle VPN activation, security, and management. They also offer deals on local access to help companies avoid the exorbitant costs of private lines or long-haul connections. Throw in a service-level agreement, and many enterprises requiring secured communications find it difficult to resist outsourcing a VPN.

Inherent in VPNs are benefits such as Layer 3 switching and routing for high-speed Internet access, service-level management, security, and application integration with service providers' networks. The Internet Protocol's global reach also outstrips frame relay and ATM. Maaz Sheikh, VPN product manager at Concentric Network, says it's easy to sell the superiority of VPNs by talking up the complications of managing large frame-relay implementations, the spotty availability of network-to-network interfaces on frame-relay networks, and frame relay's lack of scalability and ubiquity in comparison to IP.

"Putting in leased lines or frame relay means substantial cost," says Tom Stribling, manager of network services at Lorde Co., a manufacturer of motion- and vibration-control devices in Cary, N.C. "It's cheaper to link via the Internet."

The savings, he says, come from a lower per-minute cost for links made over the Internet vs. having users dial a toll-free number for remote access. Using VPN services also lets Lorde try out the technology before making an infrastructure investment in a VPN of its own.

Stribling has migrated 100 of his company's 400 dial-access users to a VPN using GTE Internetworking's VPN service. "We signed a year's contract, so by December we'll make a decision about whether to go it alone or extend the contract," he says.

Many companies are testing VPNs to get a feel for the technology and to see if it proves useful, says Jeff Wilson, an analyst at Infonetics Research. "As they scale up their deployments, they go to a service provider and talk about a much larger VPN that they manage themselves, or they buy a completely managed service," he says.

Apparently, a lot of IT managers are having that conversation, or will be soon. VPN service revenue worldwide is expected to grow to nearly $30 billion by 2003, up from $5 billion this year, with an annual growth rate of more than 80%, according to Infonetics.

One slice of the VPN services market consists of the customer retaining possession and control of the VPN access platform, which serves as a front end to a carrier IP backbone. The service provider in this scenario provides a network interface at the customer's site; an access line to the VPN; and design, integration, and WAN management services. The service provider and customer work out the details of who manages the VPN clients, gateway, and firewalls, sometimes sharing responsibility. Such customer premises-based approaches constitute the fastest-growing VPN services segment, according to Infonetics, and will account for nearly half the market's revenue by 2003.

VPNs get more complex as they grow. Some IT managers opt for outsourcing in order to avoid the cost of training and education. Other buyers cost-justify VPN services by pointing out that the services save their employers money through private-line consolidation, an exercise similar to one they may have gone through if they bought frame relay 10 years ago.

But the build-vs.-outsource decision is a bit different for an IP network than it is for frame relay. With frame relay, customers relinquish only a switch or a frame-relay access device. VPNs are a different story. Routers and gateway devices need to be considered. There are firewalls and certificate servers for security, and client software and the associated management systems to track performance and reliability. When service providers start dangling carrots such as service-level agreements, help-desk support, and WAN access troubleshooting, it helps build the business case for outsourcing.

Just a few years ago, Hitachi Metals America Ltd. in Purchase, N.Y., used a bridged, 56-Kbps network to connect 12 sites around the country. The network was slow and prone to congestion. "We were dying," says Roy Milano, manager of IS at Hitachi Metals.

continued...page 2

Photo of Stribling by Roy Campbell