sed on predetermined locations create closed user groups and work well to carve out a VPN in a public shared network by limiting access and usage to the provisioned VPN community. However, encryption is still required to securely pro- tect the information from theft or modification by intruders. A provisioned VPN is differentiated from an IP-based VPN by its ability to sup- port multiple protocols and by the fact that it offers improved performance and management. These VPNs are characterized as having excellent performance and security, but the negative is that a single vendor may not offer the necessary reach and breadth in terms of service offerings. Figure 9.14 shows what the CPE looks like for a VPN based on Frame Relay or ATM. The customer has an IAD that allows voice and data to be converged at the customer premises. The IAD feeds into the data communications equipment, over Customer Customer Location 1 Location 3 Service Provider Network Internet Virtual Circuits Between Locations Customer Customer Location 2 Location 4 Figure 9.13 A provisioned VPN Remote Users Dialup to Service Provider POP FR or ATM Internet POP Virtual Circuit (VC) Service Remote Provider Access Device Service Provider Laptops and PCs Network with client VPN encapsulation FR or ATM VC FR or ATM VC Management and security software or token cards Service Provider POP Service Provider POP Remote Remote Access Device Private Line, Access Device FR, or ATM VC Central CSU/DSU Remote CSU/DSU Router or Packet classification, Integrated Access Router or Device priority, and bandwidth Integrated Access Device management done here Voice Other Traffic Traffic Traffic Traffic Types Customer access to Voice Other network management Traffic Traffic Traffic Traffic Types Figure 9.14 A Frame Relay- or an ATM-based provisioned VPN Chapter 9 IP Services which a circuit goes to the service provider's POP. At the service provider's POP is a multiservice access device that enables multiple protocols and interfaces to be sup- ported and that provides access