customers from 30% to 70% over traditional dialup remote access server deployment. Remote access servers provide access to remote users, generally via analog plain old telephone service (POTS) lines, or, perhaps, ISDN connections, including dialup protocols and access control for authentica- tion (administered by the servers). However, a remote access server requires that you maintain racks of modems, the appropriate terminal adapters for ISDN ser- vices, or DSL-type modems for DSL services. You also need remote access routers, which connect remote sites via a private line or public carriers and provide proto- col conversion between the LANs and WANs. To have an internal implementation of remote access, you have to acquire all these devices, as well as the talent to maintain them. If an enterprise needs remote access connections outside local calling areas, and/or if it needs encrypted communications, it is generally fairly easy to justify a VPN service rather than an enterprise-based remote access server. The initial cost Chapter 9 IP Services of hardware for a VPN approach is about 33% less than the cost of hardware for a traditional dialup remote access server deployment. The customer also saves charges for local access circuits, and costly toll and international charges are eliminated. By virtue of supporting a greater range of customers, a service provider that offers VPN-based remote access is more likely to support a wider variety of broad- band access options, including xDSL, cable modems, and broadband wireless. VPN-based remote access also reduces the management and maintenance required with modem banks and remote client dial-in problems. For these reasons, remote access represents the primary application for which customers turn to VPNs. Fig- ure 9.17 shows an example of a remote access VPN. Extranet VPNs Extranet VPNs allow an external organization to have defined access to an enterprise's internal networks and resources (see Figure 9.18). There are three major categories of extranets: supplier extran