-provisioned class of VPNs. Today's provider-provisioned and provider-managed VPNs are intended to emulate whatever LAN or WAN connectivity a customer desires. The following sections discuss key VPN concepts, types of VPNs, and VPN security. Key VPN Concepts A VPN uses a shared carrier infrastructure. It can provide additional bandwidth on demand, which is an incredible feat, compared to the weeks it normally takes to Chapter 9 IP Services add bandwidth to dedicated networks. Carriers build VPNs with advanced surviv- ability and restoration capabilities, as well as network management tools and sup- port, SO that QoS can be considered and service-level agreements (SLAs) can be administered and met. There are two major models of VPNs: Customer edge model-This customer-based model requires the CPE to be fully capable of configuring and provisioning the VPN and thereby results in higher operating expenses for the enterprise user. The routing intelligence resides at the end-user's site. Service providers install gateways, routers, and other VPN equipment on the customer's premises. Because this requires the service provider to manage onsite equipment, the cost associated with the onsite visits from field engineers can be high. This approach is generally pre- ferred where the customer wants to have control over all aspects of security. Provider edge model-In this model, the VPN intelligence resides at the provider's edge, where it can be extended out to many end-user locations. The carrier houses all the necessary equipment at a point of presence (POP) near the customer's location. This offers the advantages of scalability, sup- port of an increasingly diverse range of IP-based services, and efficient pri- oritization of traffic. It provides the foundation needed to integrate fixed and mobile VPN communications into one seamless framework. This approach is generally preferred by customers who want to take advantage of the carrier's VPN economies of scale. VPN Frameworks Contemporary VPNs can be described as belonging t