nection and transport services, routers, firewalls, and a VPN box at the customer site. Benefits of this approach include the fact that it involves a single service vendor, SLAs, guaranteed latency and bandwidth, and the security of traffic being confined to one network. VPN applications provide maximum opportunities to save money and to make money-by substituting leased lines with Internet connectivity, by reducing costs of dialup remote access, and by stimulating new applications using extranets. These savings can be substantial. The three major applications of VPNs-intranets (i.e., site-to-site VPNs), remote access, and extranets-are examined in the following sections. Intranet VPNs Intranet VPNs are site-to-site connections (see Figure 9.16). The key objective of an intranet VPN is to replace or reduce the use of leased-line net- works, traditional routers, and Frame Relay services. The cost savings in moving from private networks to Internet-based VPNs can be very high, in the neighborhood of 50% to 80% per year. Remember that Internet-based VPNs allow less control over the quality and performance of applications than do provisioned VPNs; this is a bit of a deterrent, and many clients still want to consider Frame Relay- or ATM-based VPNs, which provide better QoS. The savings might drop a bit, but the cost of a pro- visioned VPN would still be substantially less than the cost of using leased lines. Headquarters Field Sales Firewall Router to ISP Mail Server Intranet Web Proxy Server Web Server Router Internal Router Users Laser Printer Internal Network External Network Branch Office Figure 9.16 An intranet VPN There are two key barriers to building more intranets based on VPNs: First, there is a variance between vendors' products that leads to interoperability prob- lems, and second, today's Internet is unable to provide end-to-end QoS. Remote Access VPNs The most interesting and immediate VPN solution for most customers is the replacement of remote access servers. VPN remote access implementations can save 