The simplest example is a single-switch VLAN, which means that the VLAN operates only inside one
switch. The computers on the VLAN are connected into the one switch and assigned by software into
different VLANs (Figure 8-6). The network manager uses special software to assign the dozens or even
hundreds of computers attached to the switch to different VLAN segments. The VLAN segments function
in the same way as physical LAN segments or subnets; the computers in the same VLAN act as though
they are connected to the same physical switch or hub in a certain subnet. Because VLAN switches can
create multiple subnets, they act like routers, except the subnets are inside the switch, not between
switches. Therefore, broadcast messages sent by computers in one VLAN segment are sent only to the
computers on the same VLAN.
Virtual LANs can be designed so that they act as though computers are connected via hubs (i.e., several
computers share a given capacity and must take turns using it) or via switches (i.e., all computers in the
VLAN can transmit simultaneously). Although switched circuits are preferred to the shared circuits of
hubs, VLAN switches with the capacity to provide a complete set of switched circuits for hundreds of
computers are more expensive than those that permit shared circuits.
We should also note that it is possible to have just one computer in a given VLAN. In this case, that
computer has a dedicated connection and does not need to share the network capacity with any other
computer. This is commonly done for servers.
8.4.1 Benefits of VLANs
Historically, we have assigned computers to subnets based on geographic location; all computers in one
part of a building have been placed in the same subnet. With VLANs, we can put computers in different
geographic locations in the same subnet. For example, in Figure 8-6, a computer in the lower left could be


put on the same subnet as one in the upper right—a separate subnet from all the other computers.
A more common implementation is a multiswitch VLAN, in which several switches are used to build
the VLANs (Figure 8-7). VLANs are most commonly found in building backbone networks (i.e., access and
distribution layers) but are starting to move into core backbones between buildings. In this case, we can
now create subnets that span buildings. For example, we could put one of the computers in the upper left
of Figure 8-7 in the same subnet as the computers in the lower right, which could be in a completely
different building. This enables us to create subnets based on who you are, rather than on where you are;
we have an accounting subnet and a marketing subnet, not a Building A and a Building B subnet. We now
manage security and network capacity by who you are, not by where your computer is. Because we have
several subnets, we need to have a router—but more on that shortly.


FIGURE 8-6 VLAN-based backbone network architecture
Virtual LANs offer two other major advantages compared to the other network architectures. The first lies
in their ability to manage the flow of traffic on the LAN and backbone very precisely. VLANs make it much
simpler to manage the broadcast traffic, which has the potential to reduce performance and to allocate
resources to different types of traffic more precisely. The bottom line is that VLANs often provide faster
performance than the other backbone architectures.


FIGURE 8-7 Multiswitch VLAN-based backbone network design
The second advantage is the ability to prioritize traffic. The VLAN tag information included in the
Ethernet packet defines the VLAN to which the packet belongs and also specifies a priority code based on
the IEEE 802.1q standard (see Chapter 4). As you will recall from Chapter 5, the network and transport
layers can use Resource Reservation Protocol (RSVP) quality of service (QoS), which enables them to
prioritize traffic using different classes of service. RSVP is most effective when combined with QoS
capabilities at the data link layer. (Without QoS at the hardware layers, the devices that operate at the
hardware layers [e.g., layer 2 switches] would ignore QoS information.) With the Ethernet packet's ability
to carry VLAN information that includes priorities, we now have QoS capabilities in the data link layer.
This means we can connect VOIP telephones directly into a VLAN switch and configure the switch to
reserve sufficient network capacity so that they will always be able to send and receive voice messages.
The biggest drawbacks to VLANs are their cost and management complexity. VLAN switches also are
much newer technologies that have only recently been standardized. Such “leading-edge” technologies
sometimes introduce other problems that disappear only after the specific products have matured.
8.4.2 How VLANs Work
VLANs work somewhat differently than the traditional Ethernet/IP approach described in the previous
chapters. Each computer is assigned into a specific VLAN that has a VLAN ID number (which ranges
from 1 to 1005 or to 4094, depending on whether the extended range standard is used). Each VLAN ID is
matched to a traditional IP subnet, so each computer connected to a VLAN switch also receives a
traditional IP address assigned by the VLAN switch (the switch acts as a DHCP server; see Chapter 5).


Most VLAN switches can support only 255 separate VLANs simultaneously, which means each switch can
support up to 255 separate IP subnets, which is far larger than most organizations want in any single
device.
MANAGEMENT FOCUS 8-2
VLANs in Shangri-La


Shangri-La's Rasa Sayang Resort and Spa is a five-star luxury resort hotel located on the scenic Batu
Feringgi Beach in Penang, Malaysia. The resort has two main buildings, the 189-room Garden Wing
and the 115-room Rasa Wing, with an additional 11 private spa villas.
Over the years, the resort had installed three separate networks: one for the resort's operations, one
for its POS (point-of-sales) system, and one for Internet access for guests (which was wired, not
wireless). The networks were separate to ensure security, so that users of one network could not gain
access to another.
As part of a multi-million-dollar renovation, the resort decided to upgrade its network to gigabit
speeds and to offer wireless Internet access to its guests. Rather than build three separate networks
again, it decided to build one network using VLANs. The resort installed 12 wireless access points
and 24 VLAN switches, plus two larger core VLAN switches. The VLAN architecture provides
seamless management of the wired and wireless components as one integrated network and ensures
robust performance and security.
Source: Adapted from “Wireless Access amidst Lush Greenery of Penang Shangri-La's Resort,” HP ProCurve Customer Case
Study, Hewlett-Packard.
Computers are assigned into the VLAN (and the matching IP subnet) based on the physical port on the
switch into which they are connected. Don't confuse the physical port on the switch (which is the jack the
cable plugs into) with the TCP port number from Chapter 5; they are different—it's another example of
networking using the same word (“port”) to mean two different things. The network manager uses
software to assign the computers to specific VLANs using their physical port numbers, so it is simple to
move a computer from one VLAN to another.


move a computer from one VLAN to another.
When a computer transmits an Ethernet frame, it uses the traditional Ethernet and IP addresses we
discussed in previous chapters (e.g., Chapters 4 and 5) to move the frame through the network because it
doesn't know that it is attached to a VLAN switch. Recall that as a message moves through the network,
the IP address is used to specify the final destination and the Ethernet address is used to move the
message from one computer to the next along the route to the final destination. Some devices, such as
layer 2 switches, are transparent; the Ethernet frame passes through them unchanged. Other devices,
such as routers, remove the Ethernet frame and create a new Ethernet frame to send the message to the
next computer. VLANs are transparent—although they do change the frame at times.
Let's use Figure 8-7 to explain how VLAN switches work. We'll assume this network uses the first 3 bytes
to specify the IP subnet. In this example, we have three VLAN switches with three IP subnets (179.58.10.x,
179.58.3.x, and 179.58.11.x) and three VLANs (10, 20, and 30). A router is used to enable communication
among the different IP subnets.
Suppose a computer connected to switch 2 (IP 179.58.10.102) sends a message to a computer on the same
IP subnet that is also connected to switch 2 (IP 179.58.10.103). The sending computer will recognize that
the destination computer is in the same IP subnet, create an Ethernet frame with the destination
computer's Ethernet address (using ARP if needed to find the Ethernet address), and transmit the frame
to VLANswitch 2. When a VLANswitch receives a frame that is destined for another computer in the same


subnet on the same VLAN switch, the switch acts as a traditional layer 2 switch: it forwards the frame
unchanged to the correct computer. Remember from Chapter 7 that switches build a forwarding table that
lists the Ethernet address of every computer connected to the switch. When a frame arrives at the switch,
the switch looks up the Ethernet address in the forwarding table, and if it finds the address, then it
forwards the frame to the correct computer. We discuss what happens if the Ethernet address is not in the
forwarding table in a moment.
Suppose that a computer wants to send a message to a computer in the same subnet, but that the
destination computer is actually on a different VLAN switch. For example, in Figure 8-7, suppose this
same computer (IP 179.58.10.102) sends a message to a computer on switch 3 (179.58.10.50). The sending
computer will act exactly the same because to it, the situation is the same. It doesn't know where the
destination computer is; it just knows that the destination is on its own subnet. The sending computer will
create an Ethernet frame with the destination computer's Ethernet address (using ARP if needed to find
the Ethernet address) and transmit the frame to VLAN switch 2. Switch 2 receives the frame, looks up the
destination Ethernet address in its forwarding table, and recognizes that the frame needs to go to switch 3.


Virtual LAN switches use Ethernet 802.1q tagging to move frames from one switch to another. Chapter 4
showed that the layout of an Ethernet frame contains a VLAN tag field which VLAN switches use to move
frames among switches. When a VLAN switch receives an Ethernet frame that needs to go to a computer
on another VLANswitch, it changes the Ethernet frame by inserting the VLAN ID number and a priority
code into the VLAN tag field. When a switch is configured, the network administrator defines which
VLANs span which switches and also defines VLAN trunks—circuits that connect two VLAN switches
and enable traffic to flow from one switch to another. As a switch builds its forwarding table, it receives
information from other switches and inserts the Ethernet addresses of computers attached to them into
its forwarding table along with the correct trunk to use to send frames to them.
In this case, switch 2 receives the frame and uses the forwarding table to identify that it needs to send the
frame over the trunk to switch 3. It changes the frame by inserting the VLAN ID and priority code into the
tag field and transmits the frame over the trunk to switch 3. Switch 3 receives the frame, looks the
Ethernet address up in its forwarding table, and identifies the specific computer to which the frame needs
to be sent. The switch removes the VLAN tag information and transmits the revised frame to the
destination computer. In this way, neither the sending computer nor the destination computer is aware
that the VLAN exists. The VLAN is transparent.
Suppose the same sending computer (179.58.10.102) wants to send a message to a computer on a different
subnet in the same VLAN (e.g., 179.58.7.30 on the same switch or 179.58.11.20 on switch 3). The sending


computer recognizes that the destination is on a different subnet and therefore creates an Ethernet frame
with a destination Ethernet address of its router (179.58.10.1) and sends the frame to switch 2.
At this point, everything works the same as in the previous example. Switch 2 looks up the destination
Ethernet address in its forwarding table and recognizes that the frame needs to go to switch 1 because the
router's Ethernet address is listed in the forwarding table as being reachable through switch 1. Switch 2
sets the VLAN tag information and sends the frame over the trunk to switch 1. Switch 1 looks up the
destination Ethernet address in its forwarding table and sees that the router is attached to it. Switch 2
removes the VLAN tag field and sends the frame to the router.
The router is a layer 3 device, so when it receives the message, it strips off the Ethernet frame and reads
the IP packet. It looks in its routing table and sees that the destination IP address is within a subnet it
controls (either 179.58.7.x or 179.58.11.x, depending on to which destination computer the packet was
sent). The router creates a new Ethernet frame and sets the destination Ethernet address to the
destination computer (using an ARP if needed) and sends the frame to switch 1.
Switch 1 reads the Ethernet address and looks it up in its forwarding table. It discovers the frame needs to
go to switch 2 (for 179.58.7.30) or switch 3 (for 179.58.11.20), sets the VLAN tag field, and forwards the
frame over the trunk to the correct switch. This switch in turn removes the VLAN tag information and
sends the frame to the correct computer.
Until now, we've been talking about unicast messages—messages from one computer to another—that are


the majority of network traffic. However, what about broadcast messages, such as ARPs, that are sent to
all computers in the same subnet? Each computer on a VLAN switch is assigned into a subnet with a
matching VLAN ID. When a computer issues a broadcast message, the switch identifies the VLAN ID of
the sending computer and then sends the frame to all other computers that have the same VLAN ID.
These computers may be on the same switch or on different switches. For example, suppose computer
179.58.10.102 issues an ARP to find an Ethernet address (e.g., the router's address). Switch 2 would send
the broadcast frame to all attached computers with the same VLAN ID (e.g., 179.58.10.103). Switch 2's
trunking information also tells it that VLAN 10 spans switch 1 and switch 3, so it sends the frame to them.
They, in turn, use their tables to send it to their attached computers that are in the same VLAN (which
includes the router). Note that the router has multiple IP addresses and VLAN IDs because it is connected
to several different VLANs and subnets (three, in our example here).
We have also assumed that the VLAN switch has a complete forwarding table—a table that lists all the
Ethernet addresses of all the computers in the network. Just like a layer 2 switch, the VLAN switch learns
Ethernet addresses as it sends and receives messages. Where the VLAN switch is first turned on, the
forwarding table is empty, just like the forwarding table of a layer 2 switch; however, its VLAN ID and
trunk tables are complete because these are defined by the network administrator. Suppose the switch has
just been turned on and has an empty forwarding table. It receives an Ethernet frame, looks up the


destination address in the forwarding table, and does not find where to send it. What happens?
If the VLAN switch were a layer 2 switch, it would send the frame to all ports. However, a VLAN switch
can be a bit smarter than this. If you think about how IP works, you will see that an Ethernet frame is
always sent to a computer in the same IP subnet as the sending computer. Any time a frame needs to
move to a different subnet, it goes through a router that sits on both subnets. Think about it for a minute
before you continue reading. Therefore, any time the VLAN switch can't find a destination Ethernet
address in the forwarding table, it treats the frame as a broadcast frame and sends it to all the computers
in the same subnet, which in VLAN terms means all the computers with the same VLAN ID.
This means that a VLAN architecture can improve performance by reducing traffic in the network
compared with a switched backbone architecture. Because a switched backbone uses layer 2 switches, all
the computers are in the same subnet, and all broadcast traffic goes to all computers. By using a VLAN we
can limit where broadcast traffic flows by dividing the network into separate subnets, so that broadcast
messages only go to computers in the same subnet.
8.5 THE BEST PRACTICE BACKBONE DESIGN
The past few years have witnessed radical changes in the backbone, both in terms of new technologies
(e.g., gigabit Ethernet) and in architectures (e.g., VLANs). Fifteen years ago, the most common backbone
architecture was the routed backbone, connected to a series of shared 10Base-T hubs in the LAN.
Today, the most effective architecture for the distribution layer in terms of cost and performance is a
switched backbone (either rack-mounted or using a chassis switch) because it provides the best


switched backbone (either rack-mounted or using a chassis switch) because it provides the best
performance at the least cost. For the core layer, most organizations use a routed backbone. Many large
organizations are now implementing VLANs, especially those that have departments spread over multiple
buildings, but VLANs add considerable cost and complexity to the network.
Given the trade-offs in costs, there are several best practice recommendations. First, the best practice
architecture is a switched backbone or VLAN for the distribution layer and a routed backbone for the core
layer. Second, the best practice recommendation for backbone technology is gigabit Ethernet. Considering
the LAN and backbone environments together, the ideal network design is likely to be a mix of layer 2 and
VLAN Ethernet switches. Figure 8-8 shows one likely design. The access layer (i.e., the LANs) uses
1000Base-T layer 2 Ethernet switches running on Cat 5e or Cat 6 twisted-pair cables to provide flexibility
for 100Base-T or 1000Base-T. The distribution layer uses layer 2 or VLAN switches that use 100Base-T or
more commonly 1000Base-T/F (over fiber or Cat 6) to connect to the access layer. To provide good
reliability, some organizations may provide redundant switches, so if one fails, the backbone continues to
operate. The core layer uses routers or VLAN Ethernet switches running 10 GbE or 40 GbE over fiber.
FIGURE 8-8 The best practice network design
8.6 IMPROVING BACKBONE PERFORMANCE


The method for improving the performance of BNs is similar to that for improving LAN performance.
First, find the bottleneck and then remove it (or, more accurately, move the bottleneck somewhere else).
You can improve the performance of the network by improving the performance of the devices in the
network, by upgrading the circuits between them, and by changing the demand placed on the network
(Figure 8-9).
8.6.1 Improving Device Performance
The primary functions of computers and devices in BNs are forwarding/routing messages and serving up
content. If the devices and computers are the bottleneck, routing can be improved with faster devices or a
faster routing protocol. Distance vector routing is faster than dynamic routing (see Chapter 5) but
obviously can impair circuit performance in high-traffic situations. Link state routing is usually used in
WANs because there are many possible routes through the network. BNs often have only a few routes
through the network, so link state routing may not be too helpful because it will delay processing and
increase the network traffic because of the status reports sent through the network. Distance vector
routing will often simplify processing and improve performance.
Performance Checklist
Increase Device Performance
Change to a more appropriate routing protocol (either distance vector or link
state)
Increase the devices' memory
Increase Circuit Capacity
Upgrade to a faster circuit
Add circuits
Reduce Network Demand
Change user behavior
Reduce broadcast messages
FIGURE 8-9 Facility map of the Western Trucking headquarters
Most backbone devices are store-and-forward devices. One simple way to improve performance is to
ensure that they have sufficient memory. If they don't, the devices will lose packets, requiring them to be
retransmitted.
8.6.2 Improving Circuit Capacity
If network circuits are the bottlenecks, there are several options. One is to increase circuit capacity (e.g.,


by going from 100Base-T Ethernet to gigabit Ethernet). Another option is to add additional circuits
alongside heavily used ones so that there are several circuits between some devices.
In many cases, the bottleneck on the circuit is only in one place—the circuit to the server. A switched
network that provides 100 Mbps to the client computers but a faster circuit to the server (e.g., 1000Base-
T) can improve performance at very little cost.
8.6.3 Reducing Network Demand
One way to reduce network demand is to restrict applications that use a lot of network capacity, such as
desktop videoconferencing, medical imaging, or multimedia. In practice, it is often difficult to restrict
users. Nonetheless, finding one application that places a large demand on the network and moving it can
have a significant impact.
Much network demand is caused by broadcast messages, such as those used to find data link layer
addresses (see Chapter 5). Some network operating system and application software packages written for
use on LANs also use broadcast messages to send status information to all computers on the LAN. For


example, broadcast messages inform users when printers are out of paper or when the server is running
low on disk space. When used in a LAN, such messages place little extra demand on the network because
every computer on the LAN gets every message.
This is not the case for routed backbones because messages do not normally flow to all computers, but
broadcast messages can consume a fair amount of network capacity in switched back-bones. In many
cases, broadcast messages have little value outside their individual LAN. Therefore, some switches and
routers can be set to filter broadcast messages so that they do not go to other networks. This reduces
network traffic and improves performance.
8.7 IMPLICATIONS FOR CYBER SECURITY
As security becomes more important, most routers now have software that enables the network manager
to create an access control list (ACL) that specifies what traffic the router should allow through and
what traffic the router should block. Each packet that arrives at the router is checked against the rules in
the ACL. At a minimum the ACL specifies the source IP address, the destination IP address, and the action
the router should take, either to permit or deny entry. Routers can be configured to block all traffic that is
not explicitly permitted entry by rules in the ACL.
Many routers have more sophisticated ACL software that enables the ACL to have different rules for
different interfaces, so that packets coming from outside the organization have different rules than
packets moving between different parts of the organization. Some ACL software can also specify rules for
the application layer packet type (e.g., HTTP, SMTP, FTP) so that only HTTP packets are sent to Web
servers, only SMTP are sent to email servers, and so on, to prevent attackers from trying to upload
unauthorized files.
VLANs are the most secure type of backbone because they enable ACL and other security measures to be


applied at the switch level. This means that every packet from every device is subjected to security, not
just those that pass through a routed backbone. It is in theory possible to have the same type of security
on a switched backbone, but very few, if any, manufacturers make switches with the same level of ACL
software as that available on routers or VLAN switches.
SUMMARY
Switched Backbones These use the same layer 2 switches as LANs to connect the different LANs
together. The switches are usually placed in a rack in the same room (called an MDF or an
Intermediate Distribution Facility (IDF)) to make them easy to maintain.
Routed Backbones These use routers to connect the different LANs or subnets. Routed backbones
are slower than switched backbones, but they prevent broadcast traffic from moving between the
different parts of the network.
VLAN Backbones These combine the best features of switched and routed backbones. They are
very complex and expensive, so they are mostly used by large companies.
Best Practice Backbone Design The best practice backbone architecture for most organizations is
a switched backbone (using a rack or a chassis switch) or VLAN in the distribution layer and a routed
backbone in the core layer. The recommended technology is gigabit Ethernet.
Improving Backbone Performance Backbone performance can be improved by choosing the
best network layer routing protocols. Upgrading to faster circuits and adding additional circuits on
very busy backbones can also improve performance. Finally, one could move servers closer to the end
users or reduce broadcast traffic to reduce backbone traffic.
KEY TERMS
access control list (ACL)
chassis switch


IEEE 802.1q
layer 2 switches
main distribution facility (MDF)
modules
multiswitch VLAN
patch cables
rack
routed backbones
router
single-switch VLAN
switched backbones
switches
virtual LAN (VLAN)
VLAN ID
VLAN switches
VLAN tag
VLAN trunks
QUESTIONS
1. How does a layer 2 switch differ from a router?
2. How does a layer 2 switch differ from a VLAN?
3. How does a router differ from a VLAN?
4. Under what circumstances would you use a switched backbone?
5. Under what circumstances would you use a routed backbone?
6. Under what circumstances would you use a VLAN backbone?
7. Explain how routed backbones work.
8. In Figure 8-5, would the network still work if we removed the routers in each building and just had
one core router? What would be the advantages and disadvantages of doing this?
9. Explain how switched backbones work.
10. What are the key advantages and disadvantages of routed and switched backbones?
11. Compare and contrast rack-based and chassis-based switched backbones.
12. What is a module and why are modules important?
13. Explain how single-switch VLANs work.
14. Explain how multiswitch VLANs work.
15. What is IEEE 802.1q?
16. What are the advantages and disadvantages of VLANs?
17. How can you improve the performance of a BN?
18. Why are broadcast messages important?
19. What are the preferred architectures used in each part of the backbone?


20. Some experts are predicting that Ethernet will move into the WAN. What do you think?
EXERCISES
A. Survey the BNs used in your organization. Is the campus core backbone different from the
distribution backbones used in the buildings? Why?
B. Document one BN in detail. What devices are attached, what cabling is used, and what is the
topology? What networks does the backbone connect?
C. You have been hired by a small company to install a backbone to connect four 100base-T Ethernet
LANs (each using one 24-port hub) and to provide a connection to the Internet. Develop a simple
backbone and determine the total cost (i.e., select the backbone technology and price it, select the
cabling and price it, select the devices and price them, and so on). Prices are available at
www.datacommwarehouse.com, but use any source that is convenient. For simplicity, assume that
category 5, category 5e, category 6, and fiber-optic cable have a fixed cost per circuit to buy and
install, regardless of distance, $50, $60, $120, and $300, respectively.
MINICASES
I. Pat's Engineering Works Pat's Engineering Works is a small company that specializes in complex
engineering consulting projects. The projects typically involve one or two engineers who do data-
intensive analyses for companies. Because so much data are needed, the projects are stored on the
company's high-capacity server but moved to the engineers' workstations for analysis. The company
is moving into new offices and wants you to design its network. It has a staff of eight engineers (which
is expected to grow to 12 over the next 5 years), plus another eight management and clerical
employees who also need network connections but whose needs are less intense. Design the network.


employees who also need network connections but whose needs are less intense. Design the network.
Be sure to include a diagram.
II. Hospitality Hotel Hospitality Hotel is a luxury hotel whose guests are mostly business travelers. To
improve its quality of service, it has decided to install network connections in each of its 600 guest
rooms and 12 conference meeting rooms. Last year, the hotel upgraded its own internal networks to
switched 100Base-T, but it wants to keep the public network (i.e., the guest and meeting rooms)
separate from its private network (i.e., its own computer systems). Your task is to design the public
network and decide how to connect the two networks together. Be sure to include a diagram.
III. Indiana University Reread Management Focus 8-1. What other alternatives do you think Indiana
University considered? Why do you think they did what they did?
IV. Shangri-La Reread Management Focus 8-2. What other alternatives do you think the Shangri-La
Resort considered? Why do you think they did what they did?
V. Chicago Consulting You are the network manager for a consulting firm that needs to install a
backbone to connect four 100Base-T Ethernet LANs (each using a 24-port switch). Develop a simple
backbone and determine the total cost (i.e., select the device and price it). Prices are available at
www.cdw.com, but you can use any source that is convenient.
VI. Western Trucking Western Trucking operates a large fleet of trucks that deliver shipments for
commercial shippers such as food stores, retailers, and wholesalers. Their main headquarters
building and secondary building are shown in Figure 8-10. They want to upgrade to a faster network.
Design a new network for them, including the specific backbone and LAN technologies to be used.


Design a new network for them, including the specific backbone and LAN technologies to be used.
Assume that the main office building is 170 feet by 100 feet in size and that the secondary building is
100 feet by 50 feet. The two buildings are 100 feet apart.


FIGURE 8-10 Facility map of the Western Trucking headquarters
TECH UPDATES
Pick one of these topics to investigate.
Topic A: Data Privacy
Every organization and individual cares about data privacy. Data breaches (such as credit card theft, social
security number theft, payroll information theft, health records theft) are one of the biggest cybersecurity
concerns for the next decade. Why? Well, because personal data is a valuable black market commodity. If
someone has your financial information they can obviously use it to buy things; if they have non-financial
personal information, they can use it to impersonate you to get a credit card or a loan, and leave you stuck
to pay the bill. While there is legislation, such as the GDPR (General Data Protection Regulation) passed
by the European Union, organizations are also aware of the negative consequences of a breach. What are
the current regulations (laws) regarding data privacy where you live? What are the penalties for a data
breach? How much is your personal data worth on the black market?
Topic B: Phishing Techniques and Malware


The two biggest cybersecurity threats for the next decade phishing and malware. I'm sure that you know a
person (perhaps a friend
) who says—“Phishing? I would NEVER fall for it!” How does phishing
work? What techniques do phishers use to lure users to click on a link, download a file, or provide
username/password? Once you click on a link or download a file, you may download malware. What is
malware? What are the most recent malware attacks and what industries suffered from them the most?
What is the economic cost of these attacks? Search the academic and popular press literature to identify
trends.
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along
5. How does it relate to material covered in class so far (and in the future)
6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 8A
Network Mapping
Network mapping software enables you to generate a map of the computers on all the LANs connected to
a backbone. There are many good network mapping packages. Two of my favorites are LANState and
Network Topology Mapper (www.solarwinds.com/network-topology-mapper.aspx). LANState is simpler
to use but works best for small networks. Network Topology Mapper is more complex but can map large


networks. This activity will focus on LANState.
Mapping a Small Network
The first step is to download and install LANState. A demo version of the software is available free of
charge from 10-Strike Software (www.10-strike.com/lanstate).
You begin by creating a new network map; choose File and then select the Map Creation Wizard. Then
choose Scan IP address range and click Next. You will be asked to enter an address range. Choose some
range, ideally the address range of a small network. I choose to use my home network range (192.168.1.1
through 192.168.2.254), which has two wireless routers (192.168.1.1 and 192.168.2.1). After you have
added the address range to scan, click Next. Step 2 is to select how you will detect the devices on your
network. The most common approach is to use an ICMP ping, which was discussed in Chapter 5. This
approach sends an ICMP to each possible address in the range you specified. Not all computers are
configured to respond to pings for security reasons, so this approach may not reveal all the computers and
devices in your network. Make sure that the box in front of ICMP Ping is checked.
The second approach is to send an ARP request for every computer in the address range you specified (see
Chapter 5). The advantage of this approach is that every device will respond to an ARP request. The
disadvantage is that you can only use ARPs for devices and computers in your same subnet. Make sure
that the box in front of ARP ping is checked.


To speed up your network, make sure the box in front of Search SNMP hosts is not checked. SNMP is a
network management protocol that we will discuss in Chapter 12. If you're using a small network, it
probably does not have SNMP. If you're using a large network that uses SNMP, you probably don't have
the password required (unless you're the network manager). Click Next, and after 10–20 seconds, you
should see a list of devices and computers that were discovered.
Figure 8-11 shows the small network in Alan's house. I have a router (192.168.1.1) that connects a number
of computers to the Internet. I also have a second wireless access router (192.168.2.1) and a printer
(192.168.1.186). When I did this map, four computers and my networked TV were turned on and
responded to LANState's pings (192.168.1.104, 192.168.1.129, 192.168.1.130, 192.168.131, and
192.168.1.188). You will also see that the broadcast address of 192.168.1.255 showed up, although there is
no device on this address. Computers and devices that are not turned on do not respond to the pings and
therefore are not mapped. Because I use dynamic addressing, the addresses of my computers will change
every time I turn them on.
Click Next and the network map will be shown. See Figure 8-12. You can also left-click on any device and
choose System Information and General to learn more about that device. Figure 8-13 also shows the
information about one computer (192.168.1.188). It shows the MAC address (i.e., the Ethernet address),


the card manufacturer, and the DNS name (i.e., application layer address) for this computer.
FIGURE 8-11 Computers and devices at Alan's house


FIGURE 8-12 Network map for Alan's house


FIGURE 8-13 System information for 192.168.1.188
Deliverables
1. Use the 10-Strike Software to draw a map of your home network or some other network. Describe two
to five components on your map just like the example in the textbook shows.
2. Use the System Information and provide additional information (e.g., MAC address and card
manufacturer) about at least two devices on your network.
HANDS-ON ACTIVITY 8B
Apollo Residence Network Design
Apollo is a luxury residence hall that will serve honor students at your university. The residence will be
eight floors, with a total of 162 two-bedroom, one-bathroom apartments on floors 3–8. Read Hands-On
Activity 7D, which provides the description of the building and a figure showing floors 3–8.
The first floor has an open lobby with a seating area and separate office area (see Figure 8-14), whereas
the second floor has meeting rooms (see Figure 8-15). Floors 1 and 2 are smaller than the upper floors
(100 feet by 70 feet) because a parking garage is built around the outside of these floors. Visio files for the
residence are available on this book's website. The offices and server room on the first floor is for the
university's residence hall administration, which manages all the university's residences. One design goal
is to keep this network as separate as possible from the network in the rest of the building to provide
greater security.


FIGURE 8-14 Apollo Residence first floor
FIGURE 8-15 Apollo Residence second floor
Deliverables
1. Your team was hired to design the network for this residence hall. Design the LANs for each floor, the


distribution layer backbone that will connect the different floors in the building, and the part of the
network that will connect into the campus core backbone. Draw where the network equipment would
be placed (use the floor plans provided).


FIGURE 8-16 Equipment price list
2. Specify the products in your design and provide their cost and the total cost of the network. There are
two options for specifying product. Option 1 is to use the generic LAN equipment list in Figure 8-16.
Option 2 is to use CDW (www.cdw.com) to find LAN equipment. If you use CDW, you must use only
Cisco devices (to ensure quality).


CHAPTER 9
WIDE AREA NETWORKS
The wide area network (WAN) is a key part of the enterprise edge. Most organizations do not build their
own WAN communication circuits, preferring instead to lease them from common carriers or to use the
Internet. This chapter focuses on the WAN architectures and telecommunications services offered by
common carriers for use in enterprise WANs, not the underlying technology that the carriers use to
provide them. We discuss the three principal types of WAN services that are available: dedicated-circuit
services, packet-switched services, and virtual private network (VPN) services. We conclude by discussing
how to improve WAN performance and how to select services to build WANs.
OBJECTIVES
Understand dedicated-circuit services and architectures
Understand packet-switched services and architectures
Understand Internet-based VPN services and architectures
Understand the best practice recommendations for WAN design
Be familiar with how to improve WAN performance
OUTLINE
9.1 Introduction
9.2 Dedicated-Circuit Networks
9.2.1 Basic Architecture
9.2.2 T-Carrier Services
9.2.3 SONET Services
9.3 Packet-Switched Networks
9.3.1 Basic Architecture
9.3.2 Frame Relay Services
9.3.3 MPLS Services
9.3.4 Ethernet Services
9.4 Virtual Private Networks
9.4.1 Basic Architecture
9.4.2 VPN Types
9.4.3 How VPNs Work
9.5 The Best Practice WAN Design
9.5.1 Software Defined WAN
9.5.2 Choosing WAN Circuits
9.6 Improving WAN Performance
9.6.1 Improving Device Performance
9.6.2 Improving Circuit Capacity
9.6.3 Reducing Network Demand


9.7 Implications for Cyber Security
Summary
9.1 INTRODUCTION
Wide area networks (WANs) typically run long distances, connecting different offices in different
cities or countries. Some WANs run much shorter distances, connecting different buildings in the same
city. Most organizations do not own the land across which WANs are built, so instead they rent or lease
circuits from common carriers—private companies such as AT&T, Bell Canada, Verizon, and BellSouth
that provide communication services to the public. For example, Indiana University has eight campuses
(e.g., Indianapolis, Bloomington, South Bend, Fort Wayne, etc.). We use WAN circuits to connect the
different campuses so students on any campus can access resources on any campus. Our Bloomington
campus has two separate locations in the city of Bloomington, that are not physically connected, so we use
a WAN circuit from a common carrier to connect them.
As a customer, you do not lease physical cables per se; you lease circuits that provide certain transmission
characteristics. The carrier decides whether it will use twisted-pair cable, coaxial cable, fiber optics, or
other medium for its circuits. You have to sign a contract with a common carrier who will install and
operate the circuit and any change requires going back to the common carrier.
Common carriers are profit oriented, and their primary products are services for voice and data
transmissions, both over traditional wired circuits and cellular services. A common carrier that provides
local telephone services (e.g., BellSouth) is commonly called a local exchange carrier (LEC), whereas
one that provides long-distance services (e.g., AT&T) is commonly called an interexchange carrier
(IXC). As the LECs move into the long-distance market and IXCs move into the local telephone market,
this distinction may disappear.


this distinction may disappear.
In this chapter, we examine the WAN architectures and technologies from the viewpoint of a network
manager rather than that of a common carrier. We focus less on internal operations and how the specific
technologies work and more on how these services are offered to network managers and how they can be
used to build networks because network managers are less concerned with how the services work and
more concerned with how they can use them effectively.
Likewise, we focus on WAN services in North America because the majority of our readers are in North
America. Although there are many similarities in the way data communications networks and services
have evolved in different countries, there also are many differences. Most countries have a federal
government agency that regulates data and voice communications. In the United States, the agency is the
Federal Communications Commission (FCC); in Canada, it is the Canadian Radio-Television
and Telecommunications Commission (CRTC). Each state or province also has its own public
utilities commission (PUC) to regulate communications within its borders.
The market for WAN services has rapidly changed over the past few years for two reasons. The first is that
the underlying technologies have changed. WAN technology development had stagnated, and the
technologies were mature and stable. Then several start-ups disrupted the market by developing WAN
circuits based on Ethernet over fiber, and offering them at significantly lower prices with more flexible
data rates. Once it became clear that the technology worked, the old common carriers were forced to offer
the same new services at similarly low prices.
The second reason is that more companies are using cloud-based services (both SAAS applications (e.g.,
Salesforce, Dropbox) as well as PAAS and IAAS (e.g., Amazon Web Services)) (see Chapter 2) rather than
deploying applications on servers on their own internal networks. Cloud-based services live on the


deploying applications on servers on their own internal networks. Cloud-based services live on the
Internet, so companies need a reliable, fast, and secure way for employees to access critical business
applications over the Internet from their offices. This means that the old approach of using common
carrier circuits to connect company offices must be extended to include circuits that provide reliable
service over the Internet.
In this chapter, we discuss three types of WAN services that are used to connect company offices to each
other or to cloud providers. The first two use common carrier networks: dedicated-circuit services
(e.g., T1) and packet-switched services (e.g., Ethernet). The third uses the public Internet to provide a


virtual private network (VPN). You may be familiar with using VPN software to provide privacy as you
surf the Internet. This is a just one of the benefits that VPN provide.
9.2 DEDICATED-CIRCUIT NETWORKS
With a dedicated-circuit network, the user leases circuits from the common carrier for his or her exclusive
use 24 hours per day, 7 days per week. It is like having your own private network, but it is managed by the
common carrier. Dedicated-circuit networks are sometimes called private line services. Dedicated-circuit
networks became popular in the early 1990s, so the fundamental technology is decades old. Dedicated
services have evolved and improved over the years, but their basic design is old. Some experts believe that
they will slowly disappear over the next 10 years, as packet-switched services become more popular.
9.2.1 Basic Architecture
With a dedicated-circuit network, you lease circuits from common carriers. All connections are point to
point, from one building in one city to another building in the same or a different city. The carrier installs
the circuit connections at the two end points of the circuit and makes the connection between them. The
circuits run through the common carrier’s cloud, but the network behaves as if you have your own
physical circuits running from one point to another (Figure 9-1).
The user leases the desired circuit from the common carrier (specifying the physical end points of the
circuit) and installs the equipment needed to connect computers and devices (e.g., routers or switches) to
the circuit. This equipment may include multiplexers or a channel service unit (CSU) and/or a data
service unit (DSU); a CSU/DSU is the WAN equivalent of a network interface card (NIC) in a LAN. The


device takes the outgoing packet (usually an Ethernet packet at the data link layer and an IP packet at the
network layer) and translates it to use the data link layer and network protocols used in the WAN.
Dedicated circuits are billed at a flat fee per month, and the user has unlimited use of the circuit. Once you
sign a contract, making changes can be expensive because it means rewiring the buildings and signing a
new contract with the carrier. Therefore, dedicated circuits require careful planning, both in terms of
locations and the amount of capacity you purchase.
There are three basic architectures used in dedicated-circuit networks: ring, star, and mesh. In practice,
most networks use a combination of architectures.


FIGURE 9-1 Dedicated-circuit services. CSU = channel service unit; DSU = data service unit; MUX =
multiplexer


FIGURE 9-2 Ring-based design
Ring Architecture
A ring architecture connects all computers in a closed loop with each computer linked to the next
(Figure 9-2). The circuits are full-duplex or half-duplex circuits, meaning that messages flow in both
directions around the ring. Computers in the ring may send data in one direction or the other, depending
on which direction is the shortest to the destination.
One disadvantage of the ring topology is that messages can take a long time to travel from the sender to
the receiver. Messages usually travel through several computers and circuits before they reach their
destination, so traffic delays can build up very quickly if one circuit or computer becomes overloaded. A
long delay in any one circuit or computer can have significant impacts on the entire network.
In general, the failure of any one circuit or computer in a ring network means that the network can
continue to function. Messages are simply routed away from the failed circuit or computer in the opposite
direction around the ring. However, if the network is operating close to its capacity, this will dramatically
increase transmission times because the traffic on the remaining part of the network may come close to
doubling (because all traffic originally routed in the direction of the failed link will now be routed in the
opposite direction through the longest way around the ring).
Star Architecture
A star architecture connects all computers to one central computer that routes messages to the
appropriate computer (Figure 9-3). The star topology is easy to manage because the central computer
receives and routes all messages in the network. It can also be faster than the ring network because any
message needs to travel through at most two circuits to reach its destination, whereas messages may have


to travel through far more circuits in the ring network. However, the star topology is the most susceptible
to traffic problems because the central computer must process all messages on the network. The central
computer must have sufficient capacity to handle traffic peaks, or it may become overloaded and network
performance will suffer.
FIGURE 9-3 Star-based design
In general, the failure of any one circuit or computer affects only the one computer on that circuit.
However, if the central computer fails, the entire network fails because all traffic must flow through it. It is
critical that the central computer be extremely reliable.
Mesh Architecture
In a full-mesh architecture, every computer is connected to every other computer (Figure 9-4a). Full-
mesh networks are seldom used because of the extremely high cost. Partial-mesh architecture
(usually called just mesh architecture), in which many, but not all, computers are connected, is far
more common (Figure 9-4b). Most WANs use partial-mesh topologies.
The effects of the loss of computers or circuits in a mesh network depend entirely on the circuits available
in the network. If there are many possible routes through the network, the loss of one or even several
circuits or computers may have few effects beyond the specific computers involved. However, if there are
only a few circuits in the network, the loss of even one circuit or computer may seriously impair the
network.
In general, mesh networks combine the performance benefits of both ring networks and star networks.
Mesh networks usually provide relatively short routes through the network (compared with ring
networks) and provide many possible routes through the network to prevent any one circuit or computer


from becoming overloaded when there is a lot of traffic (compared with star networks, in which all traffic
goes through one computer).
The drawback is that mesh networks use decentralized routing so that each computer in the network
performs its own routing. This requires more processing by each computer in the network than in star or
ring networks. Also, the transmission of network status information (e.g., how busy each computer is)
“wastes” network capacity.


FIGURE 9-4 Mesh design
There are two types of dedicated-circuit services in common use today: T-carrier services and
synchronous optical network (SONET) services. Both T-carrier and SONET have their own data link
protocols, which are beyond the scope of this chapter.
9.2.2 T-Carrier Services
T-carrier circuits are the most commonly used form of dedicated-circuit services in North America
today. As with all dedicated-circuit services, you lease a dedicated circuit from one building in one city to
another building in the same or different city. Costs are a fixed amount per month, regardless of how
much or how little traffic flows through the circuit. There are several types of T-carrier circuits as shown
in Figure 9-5, but only T1 and T3 are in common use today.
FIGURE 9-5 T-carrier services
A T1 circuit (also called a DS1 circuit) provides a data rate of 1.544 Mbps. T1 circuits can be used to
transmit data but often are used to transmit both data and voice. In this case, inverse TDM provides
twenty-four 64-Kbps circuits. Digitized voice using pulse code modulation (PCM) requires a 64-Kbps
circuit (see Chapter 3), so a T1 circuit enables 24 simultaneous voice channels. Most common carriers
make extensive use of PCM internally and transmit most of their voice telephone calls in digital format
using PCM, so you will see many digital services offering combinations of the standard PCM 64-Kbps
circuit.
A T3 circuit allows transmission at a rate of 44.736 Mbps, although most articles refer to this rate as 45
megabits per second. This is equal to the capacity of 28 T1 circuits. T3 circuits are becoming popular as


the transmission medium for corporate MANs and WANs because of their higher data rates. Although T2
circuits and T4 circuits are defined standards, they are not commercially available, and, therefore, we
don’t discuss them here.
Fractional T1, sometimes called FT1, offers portions of a 1.544-Mbps T1 circuit for a fraction of its full
cost. Many (but not all) common carriers offer sets of 64 Kbps DS-0 channels as FT1 circuits. The most
common FT1 services provide 128 Kbps, 256 Kbps, 384 Kbps, 512 Kbps, and 768 Kbps.
9.2.3 SONET Services
The synchronous optical network (SONET) is the American standard (ANSI) for high-speed
dedicated-circuit services. The ITU-T recently standardized an almost identical service that easily
interconnects with SONET under the name synchronous digital hierarchy (SDH).
SONET transmission speeds begin at the OC-1 level (optical carrier level 1) of 51.84 Mbps. Each
succeeding rate in the SONET fiber hierarchy is defined as a multiple of OC-1, with SONET data rates
defined as high as 160 Gbps. Figure 9-6 presents the commonly used SONET and SDH services. Each level


above OC-1 is created by an inverse multiplexer. Notice that the slowest SONET transmission rate (OC-1)
of 51.84 Mbps is slightly faster than the T3 rate of 44.376 Mbps.
FIGURE 9-6 SONET and SDH services. OC = optical carrier (level); SDH = synchronous digital hierarchy;
SONET = synchronous optical network
9.3 PACKET-SWITCHED NETWORKS
Packet-switched networks operate more like Ethernet and IP networks used in the LANs and BNs
than like dedicated-circuit networks. With dedicated-circuit networks, a circuit is established between the
two communicating routers that provides a guaranteed data transmission capability that is available for
use by only those two devices. In contrast, packet-switched services enable multiple connections to exist
simultaneously between computers over the same physical circuit, just like LANs and BNs.
9.3.1 Basic Architecture
With packet-switched services, the user buys a connection into the common carrier cloud (Figure 9-7).
The user pays a fixed fee for the connection into the network (depending on the type and capacity of the
service) and is charged for the number of packets transmitted. Many common carriers now offer fixed
price plans, so they do not charge per packet, which has dramatically affected the market for packet-
switched services. Many companies were dubious about packet-switched services because it was hard to
know how much they would actually cost. After all, which would you prefer for your mobile phone—a fixed
price per month or price that varied depending upon how much data you used? When the first few
common carriers moved to fixed price plans, the rest soon followed, and more companies are now
choosing packet-switched services.
The user’s connection into the network is a packet assembly/disassembly device (PAD), which can


The user’s connection into the network is a packet assembly/disassembly device (PAD), which can
be owned and operated by the customer or by the common carrier. The PAD converts the sender’s data
into the network layer and data link layer packets used by the packet network and sends them through the
packet-switched network. At the other end, another PAD reassembles the packets back into the network
layer and data link layer protocols expected by the destination (usually Ethernet and IP) and delivers
them to the appropriate computer router.


FIGURE 9-7 Packet-switched services. PAD = packet assembly/disassembly device
MANAGEMENT FOCUS 9-1
Cleveland Transit
The Greater Cleveland Regional Transit Authority (GCRTA) has about 2,400 employees and
provides bus, trolley, and rail services to about 1.3 million people in the Cleveland area. It has many
office locations throughout the region, and more than half of its employees are on the move as they
work.
A recent blackout highlighted how vulnerable GCRTA was to network outages. Communications
were knocked out, including systems supporting the transit police.
GCRTA redesigned its WAN to use a SONET ring. SONET provides high-speed data services, and the
ring topology ensures maximum reliability. Even if one part of the ring is knocked out, whether by
power failures or someone accidentally cutting a line, the network will continue to operate.
Source: Adapted from “Staying on Track,” Case Study, AT&T.
One of the key advantages of packet-switched services is that different locations can have different
connection speeds into the common carrier cloud. The PAD compensates for differences in transmission
speed between sender and receiver; for example, the circuit at the sender might be 50 Mbps, whereas the
receiver only has a 1.5 Mbps circuit. In contrast, a dedicated circuit must have the same speed at both the
sender and receiver.
Packet-switched networks enable packets from separate messages with different destinations to be


interleaved for transmission, unlike dedicated circuits, which have one sender and one receiver.
The connections between the different locations in the packet network are called permanent virtual
circuits (PVCs), which means that they are defined for frequent and consistent use by the network. They
do not change unless the network manager changes the network. Some common carriers also permit the
use of switched virtual circuits (SVCs), which change dynamically based on traffic, although this is
not common. Changing PVCs is done using software, but common carriers usually charge each time a PVC
is established or removed.
Packet-switched services are often provided by different common carriers than the one from which
organizations get their usual telephone and data services. Therefore, organizations often lease a dedicated
circuit (e.g., T1) from their offices to the packet-switched network point of presence (POP). The POP is
the location at which the packet-switched network (or any common carrier network, for that matter)
connects into the local telephone exchange.
There are three types of packet-switched services: frame relay, MPLS, and Ethernet.
9.3.2 Frame Relay Services
Frame relay is one of the oldest used packet services in the United States. It is still available, but at
this point, most companies are no longer installing it. It is a legacy technology. We include it because you
are still likely to see it for several years.
Frame relay uses T carrier and SONET as its circuits, so its speeds are identical to them (e.g., 1.5 Mbps,
45 Mbps, 155 Mbps, and 622 Mbps). It is an unreliable packet service because it does not perform error
control. Frame relay checks for errors but simply discards packets with errors. It is up to the software at
the source and destination to control for lost messages.


the source and destination to control for lost messages.
Some common carriers permit users to specify two different types of data rates that are negotiated per
connection and for each PVC as it is established. The committed information rate (CIR) is the data
rate the PVC guarantees to transmit. If the network accepts the connection, it guarantees to provide that
level of service. Most connections also specify a maximum allowable rate (MAR), which is the
maximum rate that the network will attempt to provide, over and above the CIR. The circuit will attempt
to transmit all packets up to the MAR, but all packets that exceed the CIR are marked as discard eligible
(DE). If the network becomes overloaded, DE packets are discarded. So although users can transmit more
data than the CIR, they do so at a risk of lost packets and the need to retransmit them.
A Day in the Life: Networking and Telecommunications Vice
President
A vice president is a person in an executive-level position whose focus is to set the strategic direction
for the organization. A vice president has very little to do with the day-to-day operations; much like
an admiral in a navy fleet, he or she defines the direction, but the individual captains running each
ship actually make sure that everything that needs to happen gets done.
The vice president works with the chief information officer (CIO) and other executive leadership of
the organization to identify the key organizational goals that have implications for the network. The
vice president works with his or her staff to revise the strategic networking plan to ensure that the
network is capable of supporting the organization’s goals. The key elements of the strategic plan are
the networking architectures, key technologies, and vendors. Once the strategy has been set, the vice
president’s job is to instruct the senior managers to execute the strategy and then let them do their
jobs.


jobs.
In most cases, the changes to the networking strategic plan are relatively minor, but sometimes there
are dramatic changes that require a major shift in strategic direction. For example, in recent years,
we’ve seen a major change in the fundamental capabilities of network tools and applications. Our
architecture strategy during the 1990s was driven by the fact that network management tools were
poor and maintenance costs per server were high; the fundamental architecture strategy was to
minimize the number of servers. Today, network management tools are much better, maintenance


costs per server are significantly lower, and network traffic has changed both in volume and in the
number and complexity of services supported (e.g., Web, email, H.323, and IPv6); the strategy today
is to provide a greater number of servers, each of which is dedicated to supporting one specific type
of traffic.
Source: With thanks to Brian Voss.
9.3.3 MPLS Services
Multiprotocol label switching (MPLS) is a technology that is hard to classify because it is so old that
it doesn’t fit the 5-layer network model (yet it is still widely used). We classify it as a layer 2 service (i.e., a
data link layer protocol like Ethernet) because it is commonly used with IP for routing at layer 3. Some
common carriers starting called their MPLS services IP services, but today most have reverted to the
original MPLS name.
With MPLS, the PAD at the sending site takes the message (which usually is an Ethernet frame containing
an IP packet), strips off the Ethernet frame, and uses the IP address in the IP packet to route the packet
through the carrier’s packet-switched network to its final destination. MPLS uses either T carrier or
SONET as its wiring, so its speeds are identical to them (e.g., 1.5 Mbps, 45 Mbps, 155 Mbps, and 622
Mbps).
9.3.4 Ethernet Services
Although we have seen rapid increases in capacities and sharp decreases in costs in LAN and BN
technologies, changes in WAN services offered by common carriers saw only modest changes for many
years. That changed about 10 years ago with the introduction of several Internet start-ups (e.g., Yipes)
offering Ethernet services.
Most organizations today use Ethernet and IP in the LAN and BN environments, yet the WAN packet


Most organizations today use Ethernet and IP in the LAN and BN environments, yet the WAN packet
network services discussed earlier (T carrier, SONET, and frame relay) use different layer 2 protocols. Any
LAN or BN traffic, therefore, must be translated or encapsulated into a new protocol and destination
addresses generated for the new protocol. This takes time, slowing network throughput. It also adds
complexity, meaning that companies must add staff knowledgeable in the different WAN protocols,
software, and hardware these technologies require. This is one reason why many common carriers are
starting to call these technologies “legacy technologies,” signaling their demise.
MANAGEMENT FOCUS 9-2
A Georgia Ethernet WAN
Marietta City Schools (MCS) is a school district northwest of Atlanta, Georgia, that has 8,000
students and 1,200 employees at 13 schools plus an administrative office. Its WAN was a traditional
SONET network using OC-1 circuits in a star design connecting each school to the MCS
administrative office.
The network was expensive and did not offer sufficient room for growth as MCS contemplated
moving to more digital education. MCS implemented an Ethernet WAN and then gradually phased
out the old SONET WAN.
MCS contracted with Zayo, a large common carrier that provides services to businesses and
governments but not the consumer market (which is why you’ve probably never heard of them).
Each school and the administrative office now has its own 1 Gbps Ethernet over fiber connection into
the Zayo network and can easily send data to any of MCS’s 14 sites. Because it is a packet-switched
network, each location can have a different speed, and MCS is already considering upgrading the
busier sites to 10 Gbps.
Source: Adapted from Education/E-Rate: Multi-Campus Network Upgrade; Ethernet Augmentation for Georgia School District,


Zayo Group, LLC.


Frame relay and MPLS services use the traditional telephone company WAN networks (i.e., T carrier and
SONET) provided by common carriers such as AT&T and BellSouth. In contrast, Ethernet services bypass
this network; companies offering Ethernet services have laid their own gigabit Ethernet fiber-optic
networks in large cities. When an organization signs up for service, the packet network company installs
new fiber-optic cables from their citywide backbone into the organization’s office complex and connects it
to an Ethernet switch. The organization simply plugs its network into its Ethernet switch and begins using
the service. All traffic entering the packet network must be Ethernet, using IP.
The Ethernet circuit is usually a standard 1 Gbps cable, although the company can order and pay for a
larger cable to be installed (e.g., a 10-Gbps cable). The data rate is set by software at the common carrier’s
end of the circuit. Currently, most common carriers offer Ethernet services with data rates of 1 Mbps–10
Gbps, in 1-Mbps increments. Changing the desired data rate is simple, because it is done in software. This
is in sharp contrast to MPLS (or T-carrier services) which require a new cable to be installed. Thus,
Ethernet services are much more flexible than the old WAN technologies, and because they are usually
much lower cost than traditional packet-switched networks, they have significantly changed the nature of
WANs over the past few years. Because this is an emerging technology, we should see many changes in the
next few years. Many experts predict Ethernet is the future of WANs, and we will see MPLS services
disappear.
9.4 VIRTUAL PRIVATE NETWORKS
A virtual private network (VPN) provides the equivalent of a private packet-switched network over


A virtual private network (VPN) provides the equivalent of a private packet-switched network over
the public Internet. It involves establishing a series of PVCs that run over the Internet so that the network
acts like a set of dedicated circuits even though the data flows over the Internet. VPN services are much,
much cheaper than the dedicated circuit or packet-switched services discussed above because they use the
Internet, not a common carrier network to carry the data. The common carrier is only responsible to
ensure a good quality service between you and the nearest Internet POP, and after your packets reach the
Internet POP, anything can happen and no one is responsible. Thus, VPN services are very cheap, but only
as reliable as the Internet. Sometimes it is fast, and sometimes it is not. Nonetheless, because of the low
cost of VPN services, many companies are including them in their WAN.
9.4.1 Basic Architecture
With a VPN, you first lease an Internet connection at whatever access rate and access technology you
choose for each location you want to connect. For example, you might lease a T1 circuit from a common
carrier that runs from your office to your Internet service provider (ISP). Or you might use a DSL or
cable modem, which are discussed in the next chapter. You pay the common carrier for the circuit and the
ISP for Internet access. Then you connect a VPN gateway (a specially designed router) to each Internet
access circuit to provide access from your networks to the VPN. See Figure 9-8.
The VPN gateways enable you to create PVCs through the Internet that are called tunnels (Figure 9-9).
The VPN gateway at the sender takes the outgoing packet and encapsulates it with a protocol that is used
to move it through the tunnel to the VPN gateway on the other side. The VPN gateway at the receiver


strips off the VPN packet and delivers the packet to the destination network. The VPN is transparent to
the users; it appears as though a traditional packet-switched network PVC is in use. The VPN is also
transparent to the ISP and the Internet as a whole; there is simply a stream of Internet packets moving
across the Internet. VPN software is commonly used on home computers or laptops to provide the same
secure tunnels to people working from offsite.
VPNs operate either at layer 2 or layer 3. A layer 2 VPN uses the layer 2 packet (e.g., Ethernet) to select
the VPN tunnel and encapsulates the entire packet, starting with the layer 2 packet. Layer 2 tunneling
protocol (L2TP) is an example of a layer 2 VPN. A layer 3 VPN uses the layer 3 packet (e.g., IP) to select
the VPN tunnel and encapsulates the entire packet, starting with the layer 3 packet; it discards the
incoming layer 2 packet and generates an entirely new layer 2 packet at the destination. IPSec is an
example of a layer 3 VPN.


FIGURE 9-8 Virtual private network (VPN) services
FIGURE 9-9 A virtual private network (VPN)
The primary advantages of VPNs are low cost and flexibility. Because they use the Internet to carry
messages, the major cost is Internet access, which is inexpensive compared with the cost of dedicated-
circuit services and packet-switched services from a common carrier. Likewise, anywhere you can


establish Internet service, you can quickly put in a VPN.
There are two important disadvantages. First, traffic on the Internet is unpredictable. Sometimes packets
travel quickly, but at other times, they take a long while to reach their destination. Although some VPN
vendors advertise quality of service (QoS) capabilities, these apply only in the VPN devices themselves; on
the Internet, a packet is a packet. Second, because the data travel on the Internet, security is always a
concern. Most VPNs encrypt the packet at the source VPN device before it enters the Internet and decrypt
the packet at the destination VPN device. (See Chapter 11 for more on encryption.)
9.4.2 VPN Types
Three types of VPNs are in common use: intranet VPN, extranet VPN, and access VPN. An intranet VPN
provides virtual circuits between organization offices over the Internet. Figure 9-9 illustrates an intranet
VPN. Each location has a VPN gateway that connects the location to another location through the
Internet.
An extranet VPN is the same as an intranet VPN, except that the VPN connects several different
organizations, often customers and suppliers, over the Internet.
An access VPN enables employees to access an organization’s networks from a remote location.
Employees have access to the network and all the resources on it in the same way as employees physically
located on the network. The user uses VPN software on his or her computer to connect to the VPN device
at the office. The VPN gateway accepts the user’s log-in, establishes the tunnel, and the software begins
forwarding packets over the Internet. Compared with a typical ISP-based remote connection, the access
VPN is a more secure connection than simply sending packets over the Internet. Figure 9-9 shows an
access VPN.
9.4.3 How VPNs Work


access VPN.
9.4.3 How VPNs Work
When packets move across the Internet, they are much like postcards in the paper mail. Anyone can read
what they contain. VPNs provide security by encapsulating (i.e., surrounding) packets in a separate,
secure packet that is encrypted. No one can read the encapsulated data without knowing the password
that is used to decrypt the packet. Layer 2 and layer 3 VPNs work very similarly, except that layer 2 VPNs
encapsulate the user’s data starting with the layer 2 packet (the Ethernet frame), while layer 3 VPNs
encapsulate the user’s data starting with the layer 3 packet (the IP packet).
Figure 9-10 shows how a layer 3 access VPN using IPSec works. Suppose that an employee is working at
home with a LAN that uses a router to connect to the Internet via an ISP using DSL (we explain how DSL
works in the next chapter). When the employee wants to use the VPN, he or she starts the VPN software
on his or her computer and uses it to log into the VPN gateway at the office. The VPN software creates a
new “interface” on the employee’s computer that acts exactly like a separate connection into the Internet.
Interfaces are usually hardware connections, but the VPN is a software interface, although the employee’s
computer doesn’t know this—it’s just another interface. Computers can have multiple interfaces; a laptop
computer often has two interfaces, one for wire Ethernet and one for wireless Wi-Fi.
The VPN gateway at the office is also a router and a DHCP server. The VPN gateway assigns an IP address
to the VPN interface on the employee’s computer that is an IP address in a subnet managed by the VPN
gateway. For example, if the VPN gateway has an IP address of 156.56.198.1 and managed the


156.56.198.x subnet, it would assign an IP address in this subnet domain (e.g., 156.56.198.55).


FIGURE 9-10 Using VPN software. Shaded area depicts encrypted packets
The employee’s computer now thinks it has two connections to the Internet: the traditional interface that
has the computer’s usual IP address and the VPN interface that has an IP address assigned by the VPN
gateway. The VPN software on the employee’s computer makes the VPN interface the default interface for
all network traffic to and from the Internet, which ensures that all messages leaving the employee’s
computer flow through the VPN interface to the VPN gateway at the office.
Suppose the employee sends an HTTP request to a Web server at the office (or somewhere else on the
Internet). The Web browser software will create an HTTP packet that is passed to the TCP software (which
adds a TCP segment), and this, in turn, is passed to the IP software managing the VPN interface. The IP
software creates the IP packet using the source IP address assigned by the VPN gateway. Normally, the IP
software would then pass the IP packet to the Ethernet software that manages the Ethernet interface into
the employee’s LAN, but because the IP packet is being sent out the VPN interface, the IP packet is passed
to the VPN software managing the VPN interface. Figure 9-10 shows the message as it leaves the network
software and is passed to the VPN for transmission: an HTTP packet, surrounded by a TCP segment,
surrounded by an IP packet.
The VPN software receives the IP packet, encrypts it, and encapsulates it (and its contents: the TCP
segment and the HTTP packet) with an Encapsulating Security Payload (ESP) packet using IPSec
encryption. The contents of the ESP packet (the IP packet, the TCP segment, and the HTTP packet) are
encrypted so that no one except the VPN gateway at the office can read them. You can think of the IPSec


packet as an application layer packet whose destination is the office VPN gateway. How do we send an
application layer packet over the Internet? Well, we pass it to the TCP software, which is exactly what the
VPN software does.
The VPN software passes the ESP packet (and its encrypted contents) to the employee’s computer normal
Internet interface for transmission. This interface has been sitting around waiting for transmissions, but
because the VPN interface is defined as the primary interface to use, it has received no messages to


transfer except those from the VPN software.
This interface treats the ESP packet as an application layer packet that needs to be sent to the VPN
gateway at the office. It attaches a transport layer packet (a UDP datagram in this case, not a TCP
segment). It then passes the ESP packet to the IP software, which creates an IP packet with an IP
destination address of the VPN gateway at the office and a source IP of the employee’s computer’s normal
Internet interface. It passes this IP packet to the Ethernet software, which adds an Ethernet frame and
transmits it to the employee’s router.
The employee’s router receives the Ethernet frame, strips off the frame, and reads the IP packet. It sees
that the packet needs to be sent to the VPN gateway at the office, which means sending the packet to the
employee’s ISP over the DSL circuit. Because DSL uses PPP as its layer 2 protocol, it adds a PPP frame
and sends the packet over the DSL circuit to the ISP.
The router at the ISP strips off the PPP frame and reads the IP packet, which it uses to route the packet
through the Internet. As the packet moves over the Internet, the layer 2 frame changes at each hop,
depending on the circuit in use. For example, if the ISP uses a T3 circuit, then the ISP creates an
appropriate layer 2 frame to move the packet over the T3 circuit (which is usually a PPP frame).
The packet travels from the Internet to the ISP that connects the office to the Internet and arrives at the
office’s router. This router will strip off the incoming layer 2 frame (suppose the office uses a T-3
connection with PPP as shown in the figure), read the IP packet, and create an Ethernet frame that will
send the packet to the office VPN gateway. The VPN gateway will strip off the Ethernet frame, read the IP


packet, strip it off, read the UDP datagram, strip it off, and hand the ESP packet to its VPN software. The
VPN gateway’s software will decrypt the ESP packet and deencapsulate the IP packet (and the TCP
segment and HTTP packet it contains) from the ESP packet. The VPN gateway now has the IP packet (and
the TCP segment and HTTP packet) that was originally created by the software on the employee’s
computer. The VPN gateway reads this IP packet and creates an Ethernet frame to send it on the next hop
to its destination and transmits it into the office network, where it ultimately reaches the Web server. On
this last leg of the journey after it leaves the VPN gateway, the packet is not encrypted and can be read like
a normal packet on the Internet.
The return path from the Web server back to the employee’s computer is very similar. The Web server will
process the HTTP request packet and create an HTTP response packet that it sends back to the employee’s
computer. The source address on the IP packet that the Web server received was the IP address associated
with the VPN interface on the employee’s computer, so the Web server uses this address as the destination
IP address. This packet is therefore routed back to the VPN gateway, because the subnet for this IP
address is defined as being in the subnet that the VPN gateway manages. Once again, the return packet is
not encrypted on this part of the journey.
When the packet arrives at the VPN gateway, it looks up the VPN IP address in its table and sees the usual
IP address of the computer associated with that VPN address. The VPN gateway creates an ESP packet
and encrypts the IP packet from the Web server (and the TCP segment and HTTP packet it contains). It
then treats the ESP packet as an application layer packet that needs to be sent to the VPN software on the


employee’s computer; it passes it to its TCP software for a UDP datagram, then to its IP software for an IP
packet, and then to its Ethernet software for an Ethernet frame and transmission back through the VPN
tunnel.
When the packet eventually reaches the employee’s computer, it comes in the normal Internet interface
and eventually reaches the TCP software that strips off the UDP datagram. The TCP software sees that the
ESP packet inside the UDP datagram is destined for the VPN software (remember that TCP port numbers
are used to identify to which application layer software a packet should go). The VPN software removes
the ESP packet and passes the IP packet it contains to the IP software, which, in turn, strips off the IP
packet, and passes the TCP segment it contains to the TCP software, which strips off the TCP segments
and passes the HTTP packet it contains to the Web browser.
9.5 THE BEST PRACTICE WAN DESIGN
Developing best practice recommendations for WAN design is more difficult than for LANs and backbone
networks because the network designer is buying services from different companies rather than buying


products. The relatively stable environment of the past is now rapidly changing with the introduction of
Ethernet and Internet VPN services, and changing organizational needs as more organizations use cloud-
based services. We will continue to see major changes in the industry and in the available services and
their costs.
We also need to point out that the technologies in this chapter are primarily used to connect different
corporate locations. Technologies primarily used for Internet access (e.g., DSL and cable modem) are
discussed in the next chapter.
9.5.1 Software Defined WAN
The increased complexity in WANs means that many organizations are implementing a Software
Defined WAN (SDWAN). A SDWAN uses software to control and manage the routers used in the WAN.
This enables the network manager to balance the use of the different network services, so that the network
makes decisions about cost and reliability in real time as network conditions change. That is, the SDWAN
software makes trade-offs between the greater reliability of common carrier services that come at a higher
cost (e.g., packet switched services) versus the less reliable Internet-based VPN services that are cheaper.
An SDWAN provides four benefits. First, it provides centralized management–one software system to see
the network status and manage all the devices and circuits in the WAN. Second, it reduces costs by
balancing network traffic over circuits that have different costs and capacities (this also means that
companies can buy cheaper circuits that will only be used as the network gets busy). Third, it provides
more visibility over network traffic so network managers can see end-to-end traffic flows to better predict
future growth and know what new circuits are needed before traffic slowdowns become a problem.
Finally, SDWANs provide good security because most routers that are compatible with SDWAN software
also have built-in VPN capabilities, so they routinely encrypt traffic from router to router in the SDWAN.


The architecture of an SDWAN has three parts, which are also called planes. The top level is the
Management Plane, which some vendors call an Orchestration Plane. This is the software that is
used to control the network. This software provides a dashboard that enables the network managers to see
the status of the network and change the network settings. For example, you can define the rules by which
the network will make decisions. Some network management software (which we will discuss in Chapter
12) includes SDWAN capabilities.
The second plane is the Control Plane. This is the software that controls the network and makes the
decisions. It is the brains of the SDWAN. The control plane decides how to revise the WAN using the rules
set by the network manager using the management plane, and regularly sends revised routing tables and
control information to the routers.
The third plane is the Data Plane. This plane includes the routers that implement the network. The
routers must be compatible with the SDWAN control plane. Remember from Chapter 5 that most routers
speak a variety of different routing protocols that are used to manage the routing tables, so some older
routers will also work in an SDWAN. However, for the SDWAN to work properly, the routers need to be
“managed” routers (which we will also discuss in Chapter 12).
9.5.2 Choosing WAN Circuits
We use the same two factors for choosing WAN services as we have previously for LANs and backbones
(effective data rates and cost), plus add one additional factor: reliability.
Figure 9-11 summarizes the major services available today for the WAN, grouped by the type of service. A
few patterns should emerge from the table. For WANs with low-to-typical data transmission needs, VPN


services are a good alternative, provided the lack of reliability is not a major issue. Otherwise, Ethernet
and MPLS are good choices because they offer good flexibility. See Figure 9-12.
For networks with high data transmission needs (10–50 Mbps) there are several distinct choices. If cost is
more important than reliability, then a VPN is a possible choice. If you need flexibility in the location of
your network connections and you are not completely sure of the volume of traffic you will have between
locations, Ethernet, or MPLS are good choices. If you have a mature network with predictable demands,
then T3 is probably a good choice.


FIGURE 9-11 WAN services
Network Needs
Recommendation
Low to Typical Traffic
(10 Mbps or Less)
VPN if reliability is less important
Ethernet or MPLS otherwise
High Traffic
(10–50 Mbps)
Ethernet or MPLS
T3 if traffic is stable and predictable
Very High Traffic
(more than 50 Mbps)
Ethernet or MPLS
SONET if traffic is stable and predictable
FIGURE 9-12 Best practice WAN recommendations
For very-high-traffic networks (50 Mbps–100 Gbps), Ethernet is a dominant choice, with MPLS as an
alternative. Some organizations may prefer the more mature SONET services, depending on whether the
greater flexibility of packet services provides value or a dedicated circuit makes more sense.
Unless their data needs are stable, network managers often start with more flexible packet-switched
services and move to the usually cheaper dedicated-circuit services once their needs have become clear
and an investment in dedicated services is safer. Some packet-switched services even permit organizations
to establish circuits with a zero-CIR (and rely entirely on the availability of the MAR) so network
managers can track their needs and lease only what they need.
Network managers often add a packet network service as an overlay network on top of a network built
with dedicated circuits to handle peak data needs; data usually travel over the dedicated-circuit network,
but when it becomes overloaded with traffic, the extra traffic is routed to the packet network.
MANAGEMENT FOCUS 9-3
United Federal Credit Union Implements an SDWAN
The United Federal Credit Union (UFCU) has two dozen branches across the U.S. Midwest that
supports its 120,000 customers. Each branch is connected to the UFCU data center using an MPLS
packet network. Most branches have a 3-Mbps connection (i.e., the common carrier has two T1


circuits running at 1.5 Mbps each into the PAD at each branch).
This WAN design had two problems. First, most branches were nearing capacity on the MPLS
network, which meant that UFCU needed to change its MPLS contract to increase capacity to 4.5
Mbps (i.e., the carrier would install a third T1 circuit into each branch). Second, the MPLS network
was a single point of failure, meaning that if the MPLS network went down, all ATMs stopped
working, the phones stopped working, and staff were forced to conduct business on paper.


Instead of increasing the capacity of its MPLS network, UFCU implemented a new SDWAN design
that added a VPN circuit to each branch (using a standard highspeed public Internet circuit). Soon
after implementing the SDWAN, the MPLS connection at one of the branches failed, and the
network immediately rerouted over the VPN, so there was no impact on branch operations. Likewise,
when network demand surged past the capacity of the MPLS network at several branches, the
SDWAN rerouted traffic onto the VPN, and staff did not experience any delays. The SDWAN enabled
UFCU to improve the capacity and reliability of its WAN by adding a low cost, high-speed, but less
reliable Internet circuit to each branch that was only used when needed
Source: Adapted from “United Federal Credit Union Delivers Superior Member Service with a Talari SD-WAN,” Case Study,
Oracle.
9.6 IMPROVING WAN PERFORMANCE
Improving the performance of WANs is handled in the same way as improving LAN performance. You
begin by checking the devices in the network, by upgrading the circuits between the locations, and by
changing the demand placed on the network (Figure 9-13).
9.6.1 Improving Device Performance
In some cases, the key bottleneck in the network is not the circuits; it is the devices that provide access to
the circuits (e.g., routers). One way to improve network performance is to upgrade the devices and
computers that connect backbones to the WAN. Most devices are rated for their speed in converting input
packets to output packets (called latency). Not all devices are created equal; some vendors produce
devices with lower latencies than others.
Another strategy is examining the routing protocol, either static or dynamic. Dynamic routing will
increase performance in networks that have many possible routes from one computer to another and in


increase performance in networks that have many possible routes from one computer to another and in
which message traffic is “bursty”—that is, in which traffic occurs in spurts, with many messages at one
time, and few at others. But dynamic routing imposes an overhead cost by increasing network traffic. In
some cases, the traffic and status information sent between computers accounts for more than 50% of all
WAN message traffic. This is clearly a problem because it drastically reduces the amount of network
capacity available for users’ messages. Dynamic routing should use no more than 10–20% of the
network’s total capacity.
9.6.2 Improving Circuit Capacity
The first step is to analyze the message traffic in the network to find which circuits are approaching
capacity. These circuits then can be upgraded to provide more capacity. Less-used circuits can be
downgraded to save costs. A more sophisticated analysis involves examining why circuits are heavily
used. For example, in Figure 9-2, the circuit from San Francisco to Vancouver may be heavily used, but
much traffic on this circuit may not originate in San Francisco or be destined for Vancouver. It may, for
example, be going from Los Angeles to Toronto, suggesting that adding a circuit here would improve
performance to a greater extent than upgrading the San Francisco-to-Vancouver circuit.
The capacity may be adequate for most traffic but not for meeting peak demand. One solution may be to
add a packet-switched service that is used only when demand exceeds the capacity of the dedicated-circuit
network. The use of a service as a backup for heavy traffic provides the best of both worlds. The lower-cost
dedicated circuit is used constantly, and the backup service is used only when necessary to avoid poor
response times.
Performance Checklist
Increase Computer and Device Performance
Upgrade devices
Change to a more appropriate routing protocol (either static or dynamic)
Increase Circuit Capacity


Analyze message traffic and upgrade to faster circuits where needed
Check error rates
Reduce Network Demand
Change user behavior
Analyze network needs of all new systems
Move data closer to users
FIGURE 9-13 Improving performance of metropolitan and local area networks
Sometimes a shortage of capacity may be caused by a faulty circuit. As circuits deteriorate, the number of
errors increases. As the error rate increases, throughput falls because more messages have to be
retransmitted. Before installing new circuits, monitor the existing ones to ensure that they are operating
properly or ask the common carrier to do it.
9.6.3 Reducing Network Demand
There are many ways to reduce network demand. One step is to require a network impact statement for all
new application software developed or purchased by the organization. This focuses attention on the
network impacts at an early stage in application development. Another simple approach is to use data
compression techniques for all data in the network.
Another more difficult approach is to shift network usage from peak or high-cost times to lower-demand
or lower-cost times. For example, the transmission of detailed sales and inventory reports from a retail
store to headquarters could be done after the store closes. This takes advantage of off-peak rate charges
and avoids interfering with transmissions requiring higher priority such as customer credit card
authorizations.
The network also can be redesigned to move data closer to the applications and people who use them. This
also will reduce the amount of traffic in the network. Distributed database applications enable databases
to be spread across several different computers. For example, instead of storing customer records in one
central location, you could store them according to region.
9.7 IMPLICATIONS FOR CYBER SECURITY
A WAN is usually one of the most secure parts of the network, unless, of course, you’re using a VPN over


the Internet. WAN services are provided by common carriers who serve thousands of customers, so it is
difficult to identify one company’s WAN traffic in a sea of traffic from thousands of companies.
However, the possibility remains that an attacker could break into the common carrier’s network. The cost
of encryption is low, so most large organizations routinely use VPNs to encrypt their data on their WAN,
regardless of whether they use the Internet or services provided by common carriers.
SUMMARY
Dedicated-Circuit Networks A dedicated circuit is leased from the common carrier for exclusive
use 24 hours per day, 7 days per week. You must carefully plan the circuits you need because changes
can be expensive. The three common architectures are ring, star, and mesh. T-carrier circuits have a
set of digital services ranging from FT1 (64 Kbps) to T1 (1.5 Mbps) to T3 (45 Mbps). A SONET service
uses fiber optics to provide services ranging from OC-1 (51 Mbps) to OC-192 (10 Gbps).
Packet-Switched Networks Packet switching is a technique in which messages are split into small
segments. The user buys a connection into the common carrier cloud and pays a fixed fee for the
connection into the network and for the number of packets transmitted. Frame relay is a legacy
service that provides data rates of 64 Kbps–45 Mbps. MPLS services provide speeds from 64 Kbps to
as much as 40 Gbps. Ethernet services use Ethernet and IP to transmit packets at speeds between 1
Mbps and 10 Gbps, with the data rates set by software (with no need to install a new cable) so they
are more flexible.


VPNs A VPN provides a packet service network over the Internet. The sender and receiver have VPN
devices that enable them to send data over the Internet in encrypted form through a VPN tunnel.
Although VPNs are inexpensive, traffic delays on the Internet can be unpredictable.
The Best Practice WAN Design For small WANs with low-to-typical data transmission needs,
VPN or MPLS services are reasonable alternatives. For high-traffic networks (10–50 Mbps), Ethernet
or MPLS services are a good choice, but some organizations may prefer the more mature—and
therefore proven—T3 services. For very-high-traffic networks (50 Mbps– 100 Gbps), Ethernet or
MPLS services are a dominant choice, but again some organizations may prefer the more mature
SONET services. Unless their data needs are stable, network managers often start with more flexible
packet-switched services or Internet VPN services and move to the usually cheaper dedicated-circuit
services once their needs have become clear and an investment in dedicated services is safer.
Improving WAN Performance One can improve network performance by improving the speed of
the devices themselves and by using a better routing protocol. Analysis of network usage can show
what circuits need to be increased or decreased in capacity, what new circuits need to be leased, and
when additional switched circuits may be needed to meet peak demand. Reducing network demand
may also improve performance. Including a network usage analysis for all new application software,
using data compression, shifting usage to off-peak times, establishing priorities for some
applications, or redesigning the network to move data closer to those who use it are all ways to reduce
network demand.
KEY TERMS
access VPN
Canadian Radio-Television and Telecommunications Commission (CRTC)
channel service unit/data service unit (CSU/DSU)
committed information rate (CIR)
common carrier
control plane
data plane


committed information rate (CIR)
common carrier
control plane
data plane
dedicated-circuit services
discard eligible (DE)
Ethernet services
Encapsulating Security Payload (ESP)
extranet VPN
Federal Communications Commission (FCC)
fractional T1 (FT1)
frame relay
full-mesh architecture
interexchange carrier (IXC)
Internet service provider (ISP)
intranet VPN
IPSec
L2TP
latency
layer 2 VPN


layer 3 VPN
local exchange carrier (LEC)
management plane
maximum allowable rate (MAR)
mesh architecture
multiprotocol label switching (MPLS)
orchestration plane
packet assembly/disassembly device (PAD)
packet services
packet-switched services
partial-mesh architecture
permanent virtual circuits (PVC)
point of presence (POP)
public utilities commission (PUC)
ring architecture
Software Defined WAN (SDWAN)
star architecture
switched virtual circuits (SVCs)
synchronous digital hierarchy (SDH)
synchronous optical network (SONET)
T-carrier circuit
T1 and T2 circuits
T3 and T4 circuits
virtual private network (VPN)
VPN gateway
VPN software
wide area networks (WANs)
QUESTIONS
1. What are common carriers, local exchange carriers, and interexchange carriers?
2. Who regulates common carriers and how is it done?
3. How do Ethernet services work in the WNA?
4. Compare and contrast dedicated-circuit services and packet-switched services.
5. Is a WAN that uses dedicated circuits easier or harder to design than one that uses packet-switched
circuits? Explain.
6. Compare and contrast ring architecture, star architecture, and mesh architecture.
7. What are the most commonly used T-carrier services? What data rates do they provide?
8. Distinguish among T1, T2, T3, and T4 circuits.
9. Describe SONET. How does it differ from SDH?