o one of three categories: Internet-based VPNs, provisioned VPNs, and IP-based VPNs. The following sec- tions define the nature of these types of VPNs. Internet-Based VPNs In an Internet-based VPN (see Figure 9.11), smaller ISPs provide local access services in defined geographical regions, requiring an enter- prise to receive end-to-end services from multiple suppliers. An Internet-based VPN uses encryption to create a form of closed user group, thereby isolating the enterprise traffic and providing acceptable security for the enterprise across public shared packet network. However, because it involves multiple ISPs in delivery of the VPN, the performance is unpredictable. The biggest problem of hav- ing multiple suppliers is the inability to define and meet consistent end-to-end bandwidth or performance objectives. Figure 9.12 shows what is involved in providing an Internet-based VPN. The customer has on the premises a wide variety of servers that dish up the corporate content, the finance systems, the customer service systems, and SO on. A VPN is Customer Location 3 Customer Location 1 Tier 2/3 Tier 2/3 Internet Tier 1 Tier 1 Peering Points Peering Points Tier 2/3 Internet Exchange Tier 2/3 Network Access Points (NAPs) Customer Customer Location 2 Location 4 Figure 9.11 An Internet-based VPN Remote Dialup Users Private Line to Internet POP Internet or to Internet POP IP Backbone Laptops and PCs with client VPN encapsulation Private Line to Internet POP Central Site CSU/DSU and security software or token cards Router CSU/DSU Users Firewall Remote Router Users Firewall Other Servers Other Servers VPN Server Authentication and (encapsulation Access Control Server Authentication and and security) (RADIUS) VPN Server Access Control Server Figure 9.12 The parts of an Internet-based VPN Chapter 9 IP Services responsible for the encapsulation of the information and hence the security aspects. Remote Authentication Dial-in User Services (RADIUS), an authentication and access control server, is used to authenticate a us