EDITORIAL CALENDAR 2000  Browse By...  Technology/Topic  Vendor  Back Issues  Content  LAB TEST CENTER  TECH TUTORIALS  GLOBAL NETWORKS  N.P.N.  PRODUCT LEADERS  OPINIONS/COLUMN  Viewpoint  INDUSTRY PIPE  Visitor's Center  FAQs  Contact the Editors  Free Newsletter  Subscriptions  Marketing Services  Industry Front & Center  Reader Service  Custom Publishing  Real World Seminars  Vendor Strategies  CommWeb Sites  Computer Telephony  Call Center  Teleconnect  ISPs  Tele.com  Byte.com  CMPmetrics  Data Communications  File Mine  InformationWeek  InternetWeek  Network Computing  Planet IT  TechShopper  TechWeb News  Tele.com  WebTools  Winmag.com

February 1997 By Kathleen Cholewka Remote Access Servers The RAS Race: Picking a Winner The need for remote access to the LAN has made the RAS a crucial component of networks Every networking device has its day. A few years ago it was the hub's turn; then came the router, and most recently the Ethernet switch. But as net managers know, now it's the RAS that rules the roost. Remote access servers are taking the WAN--and the industry--by storm. "This is the hottest market with the fastest growth rate," says Beda Fong, senior network analyst at the market research firm Dell'Oro Group (Portola Valley, Calif.), who points out that worldwide RAS revenues went from $277 million in the first half of 1995 to $760 mill ion in the first half of 1996. Analysts predict revenues of $1.6 billion by the second quarter of 1997. What's behind the rise of the RAS? Simple: more remote users who need access to central-site resources. Connections have to be fast and reliable. What was once the job of a modem pool and bridge is now considerably more involved--and that's where the RAS comes in. But with a market this hot, prospective buyers risk getting burned--so it pays to sort through the RAS pack carefully. WAN capacity is the most important consideration, but LAN capacity counts too. Net managers also should check out modem speeds and the upgrade path to faster modem technology, and they should find out whether the modem itself is analog or digital. It also helps to look into the internal architecture, since that's what determines throughput. Security, data compression, fault tolerance, and management capabilities are other important features to consider. And, as always, there's the matter of money. RASs range widely in price, from $525 to $3,000 per user for a low-end configuration of one T1 (1.544-Mbit/s) or PRI (primary-rate interface) connection, one Ethernet port, and one modem card. RAS Roundup RASs sit at the central site, field incoming traffic from the WAN, and route it to the LAN, giving remote users access to the same network apps and privileges they'd get if they were physically hooked up. Most also allow LAN users to dial out. But RASs have changed quite a bit since Data Comm last looked at them just seven months ago (see "Remote Access Servers: No Mess, No Stress," July 1996). They're larger and more secure, and all of them can now route and bridge traffic. Surprisingly (given these improvements), per-port prices are coming down--from more than $600 in the third quarter of 1995 to around $500 in the same period of 1996, according to Dell'Oro. And there's no letup in sight. "The average per port price will decreas e by 30 percent a year over the next three years," says Marlo Kosanovich, research analyst at the Meta Group (Reston, Va.). There's also plenty of competition. More than 50 vendors offer some sort of RAS--and not just as hardware. Vendors like Funk Software Inc. (Cambridge, Mass.) and Remedy Corp. (Mountain View, Calif.) sell software-based RASs that run on NT servers. Eicon Technology Corp. (Montreal) and Ariel Corp. (Cranbury, N.J.) even offer NICs (network interface cards) that net managers can use with another vendor's PC or server to build their own RASs. BUILD YOUR OWN CUSTOM TABLE The Remote Access Server Rundown But the hottest action is in chassis-based devices, which are sold by 18 vendors ( see Table 1 ). All of these products feature built-in modems, and almost all come with both T1 and ISDN PRI hookups. Support for T1 or PRI is important because carriers bundle individual incoming analog dial-up or BRI (basic-rate interface) lines and deliver them to the RAS in a channelized T1 or PRI digital circuit. Wide-Area Concerns When it comes to scoping out a RAS, WAN capacity is probably the best place to start. As companies have to accommodate ever-greater numbers of remote users, they need boxes that can grow to handle the challenge. All of the RAS vendors discussed here offer one or more of the following WAN connections: T1, E1 (2.048 Mbit/s), ISDN PRI, or ISDN BRI. Channelized T1 lines deliver 24 64-kbit/s digital channels on one line; E1s, 32. A PRI line puts 23 64-kbit/s channels onto one digital line, and a BRI link delivers two 64-kbit/s digital B channels over a single connection. The king of capacity is the AX1600 from Cascade Communicat ions Corp. (Westford, Mass.). It can handle 128 PRIs per chassis (although the only outfits likely to need such capacity are ISPs or carriers). At the other end of the spectrum are the products with just one T1 or PRI link, which obviously are geared toward smaller offices. An example is the Micablazer from Telebit Corp. (Chelmsford, Mass.). For at least two users, size does matter. George Bateman, project manager for global remote access services for American Express (Amex, Phoenix), has installed 25 LANrover Access Switches from Shiva Corp. (Bedford, Mass.) throughout the Amex international network. "Just one of the new LANrover Access Switches can replace four or five of Shiva's old product," he says. "We still have spare capacity, which means I've positioned the company for growth without needing to buy a lot of hardware." Rick Yost, manager of network software for the U.S. Postal Service, also has to think big. He's installed a Portmaster 3 from Livingston Enterprises Inc. (Pleasanton, Ca lif.) in a data center in Minneapolis. More than 5,000 postal employees dial up the site to access applications from servers on the U.S. Postal Routed Network. The Portmaster replaces a modem pool, and Yost likes the fact that the change freed up room in his data center. "The Portmaster is one-tenth the size of our old modem pool setup," says Yost. He plans to install two more RASs--one in California and one in North Carolina--by next month. Feeling Congested? RASs are designed for WAN connectivity, but how they connect to the LAN can have a big impact on performance. The more LAN ports a RAS has, the less likely that network congestion will occur. So it's surprising to find that 10 vendors--including Cisco Systems Inc. (San Jose, Calif.) and Hayes Microcomputer Products Inc. (Norcross, Ga.)--furnish just one Ethernet port on their RASs. (Three of those vendors, including Shiva, offer either a single Ethernet port or a single token ring port.) In either case, this can make for a bott leneck if the amount of traffic arriving from the WAN exceeds the capacity of the LAN link. And that's a pretty likely occurrence on today's corporate networks. For instance, V.34 modems transmit data at a maximum speed of 28.8 kbit/s. Compression can boost that to 115 kbit/s. If more than 87 users dialed in at that rate, the LAN interface would be overwhelmed with 10,120 kbit/s of data. And in the real world, the actual threshold is much lower. Because of collisions, it's highly unlikely that an Ethernet LAN will ever run faster than around 4 Mbit/s. Using the 28.8-kbit/s model, that means just 35 simultaneous callers would be enough to saturate the LAN. Eight vendors allay this problem by offering two or more Ethernet ports on their chassis. The 5000MSX from Bay Networks Inc. (Santa Clara, Calif.) and the CSX7000 from Cascade can each handle 16 Ethernet ports. Bottlenecks aren't likely to be a problem on Bay's box, which also features 10 fast Ethernet ports. Multiple LAN ports don't just prevent congestion; they also let net managers connect the RAS to different LAN segments. This strengthens security, since incoming traffic can be partitioned as it enters the network. Inner Duty But what's on the outside of the RAS counts for little when there's not enough capacity on the inside. Internal architecture plays a big part in dictating how quickly the RAS can take traffic from the WAN and pass it to the LAN. It also determines whether the box can grow to accommodate more users. Almost all of the RASs discussed here incorporate one or more bus architectures. These architectures include 1-Gbit/s PCI (Peripheral Component Interface), 128-Mbit/s ISA (Industry Standard Architecture), or 16.4-Mbit/s MVIP (Multi-Vendor Integrated Protocol) PC buses; 2- to 90-Mbit/s TDM (time-division multiplexing) buses; and Ethernet, fast Ethernet, or token ring LAN packet buses. In each case, the buses run along the back of the RAS chassis. They're used to connect the WAN and LAN interfa ce cards and modem cards that slot into the chassis itself. Most of the products in the table feature more than one bus. To determine overall capacity, just add the speeds of the different buses together; the higher the total the better. Thus the Accessbuilder 5000 from 3Com Corp. (Santa Clara, Calif.), with 8 10-Mbit/s Ethernet segments, 10 16-Mbit/s token ring segments, and a 20-Mbit/s TDM bus, has a total of 260 Mbit/s. At the other end of the spectrum, the 925 Accessway System from Motorola Inc. (Schaumburg, Ill.) has just 2 2-Mbit/s TDM buses, for a total capacity of 4 Mbit/s. The PAR 1 RAS from Patton Electronics Co. (Gaithersburg, Md.) has a somewhat different design. Its components are soldered onto a single circuit board rather than supplied as individual modules plugged into a separate bus. Traffic is transferred at speeds of up to 960 Mbit/s over the board, the vendor claims. But this makes the PAR-1 a fixed-configuration unit--in other words, net managers can't swap components in a nd out to meet different capacity needs. Modem Mayhem Before choosing a RAS, net managers also should check out the modems that come with it. Seven RASs, including the CSX6000 and CSX7000 from Cabletron Systems Inc. (Rochester, N.H.) and Motorola's 925 Accessway, feature internal modems implementing the 28.8-kbit/s V.34 modem standard. A dozen RASs, including Bay's 5000MSX, Cascade's AX800 and AX1600, and Patton's PAR 1, come with 33.6-kbit/s V.34+ modems. But evaluating current modem speeds is only part of the process. Networkers should also find out how the vendor plans to upgrade the product when new specs are introduced. And there is a new speed on the way: A 56-kbit/s modem standard, known as 56 K, should be introduced this year (although it will permit only the receipt of data at that speed; transmission will be 28.8 kbit/s). Of the vendors listed in the table, nine say their products are upgradable via flash memory on the modem cards. These include Cisco, Telebit, and U.S. Robotics Inc. (Skokie, Ill.). The other devices all will require hardware upgrades--a less convenient and more expensive option. Meanwhile, U.S. Robotics already has announced its own version of the 56 K spec, which it calls X2, and plans to ship products implementing it this quarter. The vendor has licensed the technology to chip vendors Texas Instruments Inc. (Dallas) and Cirrus Logic Inc. (Fremont, Calif.). Chip vendors Rockwell Semiconductor Systems Inc. (Newport Beach, Calif.) and the Microelectronics Group of Lucent Technologies Inc. (Murray Hill, N.J.) are touting a different 56 K implementation, called K56Flex. Modems implementing X2 will not be able to work with those implementing K56Flex. There's more to the modem selection than speeds and upgradability. Net managers also need to find out whether vendors' modems are analog or digital. PRI and channelized T1 lines deliver data to the RAS as a digital signal. The five vendors that sell only analog modems--Ascend Co mmunications Inc. (Alameda, Calif.), Cisco, Commvision Corp. (Mountain View, Calif.), Gandalf Technologies Inc. (Nepean, Ontario), and Microcom Inc. (Norwood, Mass.)--have to convert that signal back to analog so that their analog modems can convert the signal back, yet again, to digital to be sent onto a LAN. That adds delay, according to vendors selling digital modems--although the assertion is shrugged off by some analog vendors. "So what?" says Mehrdad Amir, Commvision product engineer. "Customers won't notice the difference." Still, net managers may feel more comfortable buying RASs with digital modems, which take digital WAN signals and framing types and convert them directly to digital LAN signals without any analog transition. Their vendors say they also generate less heat and less line noise. Part of the Process When buying a RAS, networkers also should find out how many processors it incorporates. Better yet, find out where on the device they're located. Some vendor s, like Shiva, have designed their RASs with processors on every interface and modem card. This ensures scalable performance as cards are added--a fact confirmed in Data Comm lab tests (see "Close-Up On Remote Access Servers," October 1996) and by users. "There's no question about it," says Amex's Bateman. "If you want major league remote access, you need the power of a coprocessing architecture. The more processors there are, the more calls you can support." MESSAGE SERVER Join the discussion about RAS. RASs also are used for routing, so net managers should look into the protocols each product supports. Routing functions are important because they allow net managers much tighter contr ol over where network traffic can flow. Cascade's RASs, for instance, route only IP. That could be a big problem for corporate users, given that IPX still makes up the majority of traffic flowing over most of their networks. All of the other RASs in the table route both IP and IPX. Some also handle Appletalk. It's also a good idea to learn whether the RAS can handle advanced connection protocols, like MLPPP (multilink point-to-point protocol), which permits aggregation of multiple connections into a larger pipe, Bootp (bootstrap protocol), or DHCP (dynamic host configuration protocol). Squeeze Play Net managers help themselves (and their companies) when they help remote users access file server data quickly; if connection times are kept to a minimum, then so are the bills. That's why data compression is another factor to consider when buying a RAS. All of the products perform V.42bis compression by default, since it's a feature built in to modem chips. All also implement Stac, th e de facto industry standard for compression of BRI and PRI ISDN traffic. As with any compression technology, the degree to which traffic can be squeezed depends on the type of data. Most vendors claim that Stac and V.42bis each regularly deliver 4:1 compression; Telebit claims that's optimistic and says that 2:1 is more realistic. Gandalf and Rascom Inc. (Salem, N.H.) furnish proprietary compression add-ons, which are handled by separate components in the RAS hardware. Both claim compression ratios of 8:1. Of course, some data--like graphics downloaded from the Internet and Zip files--is already compressed. That might make compression less of a factor for prospective buyers. And there are some analysts who say that putting the squeeze on files that already have been compressed could actually make them larger, since it involves adding header information. Going the Other Way Dialing into a central site is important, but what about dialing out? RASs made by Cascade and U.S. Rob otics can't be used to allow LAN users to access the WAN, although Cascade says it will add dial-out to its product by year's end. As for management, all of the products discussed here are SNMP-compliant. Still, net managers should make sure the management interface is thorough (that is, it permits net managers to monitor and diagnose the device and configure the ports) as well as easy to use. RASs from Cascade, Multi-tech, Patton, Telebit, and 3Com can be managed via a Web browser--which means net managers can monitor any port on the RAS via the Internet. Since RASs sit at the edge of the LAN, security is another factor that comes into play. All of the RASs in the table feature user password and ID authentication; all also run PAP (password authentication protocol) and CHAP (challenge handshake authentication protocol) from the IETF (Internet Engineering Task Force), which define password and encryption formats for dial-in users. Even though all the RASs feature built-in authenticatio n, it might be necessary in outsized networks to purchase and install a separate database server. That's because most RASs can store information on only a limited amount of users--usually the same number as their dial-in capacities. For example, Patton's PAR 1, which can accommodate 60 concurrent dial-up users, can handle up to 60 user IDs and passwords in its authentication server. Every product but the Commvision Commswitch RLN works with external authentication servers supporting Radius (Remote Authentication Dial-In User Service), which was developed by Livingston. Radius lets net managers configure and administer security parameters for multiple RASs from a single site. A server equipped with Radius, such as Easyradius from Cryptocard Inc. (Buffalo Grove, Ill.), usually costs about $3,500. Advanced Radius capabilities attracted the Postal Service's Yost to Livingston's RAS. "A lot of vendors said they could support Radius, but when it came to the complexity of filtering we needed, Livings ton had a leg up," he says. He adds that the Livingston product could accomplish more of the filtering and processing on IP addresses for specific users. Several of the vendors in the table also support Tacacs+, Cisco's alternative to Radius. Some products--like Microcom's Access Integrator--also use token authentication schemes like Secure ID from Security Dynamics Inc. (Cambridge, Mass.). These products go a step beyond authentication by issuing a unique password to the user. Ascend and Livingston are taking security one step further by integrating firewalls. While Livingston's firewall comes bundled with the operating system, Ascend's must be purchased separately for $20,000 (see "A Remote Access Server That Can Keep Secrets," January 1997). It's worth noting that not all security experts believe the RAS to be the best location for a firewall; a hacker who breaks through the firewall gets control of the RAS--and easy access to the central site. Also, most security experts consider packet-filtering firewalls, like the one in Livingston's RAS, to be insufficient protection; instead, they encourage use of packet-filtering firewalls in conjunction with proxy-based or stateful inspection firewalls, like the one used by Ascend. Seven vendors also offer dial-back security. With this technique, access to the LAN isn't granted until dial-in users' identities can be confirmed by calling them back. Under Control CONTACT AUTHOR kcholewka@data.com RASs also differ in the manner in which they allow remote users to access LAN applications. Two methods are available: remote node and remote control. All of the vendors offer remote node--which lets users dial in and maintain a LAN connection as if they were doing it locally. Th e problem with this approach is that sending and receiving data over WAN lines is time-consuming. Shiva says it has a way to alleviate the latency. Its Powerburst remote node acceleration technology saves frequently accessed files in a 16-Mbyte cache in the PC. Instead of sending the entire file across the WAN, only the changes to the data are transmitted. Stampede Technologies Inc. (Dayton, Ohio) offers a similar product--a combination software-and-hardware add-on called Turbo Gold, which costs $100 per seat. Remote control, on the other hand, is offered by 11 vendors. It lets remote users take control of and run applications on a PC or dedicated PC at corporate headquarters. Only the keyboard commands and screen information are transmitted--so bandwidth is conserved. Still, some vendors see remote control as a security risk, since the unmanned PC at HQ could be accessed by an interloper. Any RAS worth its reputation should also boast some kind of fault-tolerance features. Shiva's LAN rover Access Switch features an intelligent shut-down facility--if a modem goes down, the RAS takes it out of action. The LANRover, Livingston's Portmaster 3, and Microcom's Access Integrator all feature "busy-out," which allows the modem card to automatically switch over to another if one of the cards is busy. RASs like 3Com's Accessbuilder 5000 and U.S. Robotics' Total Control Enterprise Network Hub feature hot-swappable cards, so net managers can remove or replace a malfunctioning modem or communications card without having to turn off the power. As for redundant power supplies, only seven RASs have them. Finally, net managers will want to pay careful attention to price, especially since RAS prices vary so widely. At the low end of the cost curve is Ascend's Max TNT, which comes in at $520 per modem. U.S. Robotics' Total Control Enterprise Network Hub tops the charts at $3,120 per modem. All prices shown in the table assume a low-end configuration--one T1 or PRI, one Ethernet port, and a single modem card. The cost of some of the larger boxes drops dramatically when they're stuffed to capacity with modem cards. For instance, Cascade's AX1600 costs $1,260 per port in low-end configuration, and $676 per port when filled to capacity with 12 modem cards and 24 T1s. Of course, there's more to working out the cost of owning a RAS than pricing the hardware. According to John Girard, research director at Gartner Group Inc. (Stamford, Conn.), 70 percent of RAS cost of ownership goes to supporting the remote user, not to the hardware. "Typical central-site RASs go for $500 to $1,500 per port at a central site," he says, "but it's the maintenance and support of the user that kills the budget." For corporations that need to supply upwards of 5,000 hours of remote connectivity a month, Girard says outsourcing (either to a carrier or value-added reseller) may be a better way to go. "You can get deals on equipment, supplies, and connection times, and save a lot of money." Kathleen Cholewka is WAN equipment editor for Data Communications. She is based in New York and can be reached by e-mail at kcholewka@data.com. [ Home ] [ Registration | Subscriptions ] [ Contact Us | E-Mail ] Home Contact Editors Lab Tests Registration Tech Tutorials Buyer's Guide Global Networks Opinion / Columns FAQs Subscriptions