 the use of the Internet, which is a public network, to convey data on behalf of a private network. VPN tunneling is not intended as a sub- stitute for encryption and decryption. In cases where a high level of security is nec- essary, the strongest possible encryption should be used within the VPN, and tunneling should serve only as a convenience. Some tunneling protocols include HQ Office Internet Server-to-Server VPN Tunnel Notebook and Modem Client-to-Server VPN Tunnel Remote Office Figure 9.15 VPN tunneling Chapter 9 IP Services encryption: PPTP includes MPPE (Microsoft Point-to-Point Encryption, based on RC-4), and IPsec specifies a tunnel mode typically used in gateway-to-gateway (but not client-to-gateway) communications (VPN security is covered in detail later in this chapter.) Customers and providers can employ various flavors of point-to-point tunnels to serve as logical links in an IP VPN. An IP VPN tunnel connects two sites or a user to a site by imposing a separate tunnel header on the VPN data packet at the source site and disposing of the tunnel header at the destination site. This lets VPN data packets travel opaquely through the public Internet, independent of their pay- load or header content. Applications of VPNs A VPN is an architecture, a series of products and software functions tied together and tightly calibrated. Managing a VPN entails dealing primarily with two issues: monitoring security policies and parameters, and ensuring that applications func- tion within the latency requirements. It is important to be able to effectively and easily manage the VPN environment. You need to consider how easy it is to track a VPN's tunnel traffic, support policy management, track QoS, track security infrac- tions, and support public key certificate authorities (CAs). Managed VPN ser- vices-the one-stop-shopping approach to VPNs-are designed to lock in users and to reduce costly customer churn, but with this approach, interoperability is very restricted. Managed VPNs provide capabilities such as IP con