8

Forgive me as I have very little domain knowledge in this area, I'm helping out at my parent's office and was asked to look into speeding up the internet. They've been using this IT guy that I think is ripping them off... They have a T1 line which costs a ton and only provides 3 Up, 3 Down. The IT guy is convinced that it is necessary for the VPN which is used by employees to access documents on the office server when they're out of the office. They also use it to access some applications which run on the server.

I understand that this is for reliability but if you don't have a T1 line going to your house, how are you going to see that reliability? Am I missing something about VPNs? Is the T1 necessary at all? I'd think you need T1's from point to point? Why can't we just put a VPN on a normal cable connection?

I'm just about to finish my CS degree, but know very little about networking, so be gentle please.

4
  • 2
    To be honest, most "IT" businesses survive by providing minimal services for exorbitant and hugely-inflated prices. They can do this because -- for better or worse -- technology is just different ways of pulling a rabbit out of a hat for most people. This guy has your parents in a sweet, fat contract and will say and do anything to keep it. Wouldn't you?
    – L0j1k
    Jan 8, 2015 at 23:19
  • 2
    T1's can provide exceptional uptime and reliability because the Telco generally fixes T1 problems quickly and gives them repair priority over standard voice or DSL service. But they are expensive (as you've noticed). For less than the cost of a single T1 line, you can likely get internet connectivity from multiple providers (i.e. cable and DSL), and use a dual-WAN router to automatically switch between the two to give better availability... likely even better than having a single (or pair) of T1's.
    – Johnny
    Jan 9, 2015 at 2:10
  • The other question is what exactly do you do across the VPN? If it is accessing a terminal server at work using RDP or the like where each session certainly does not generate more than 100kb/s peak outgoing traffic, then there certainly is no reason to have an expensive connection with symmetric throughput (same incoming as outgoing). After you have identified those needs, choose a product depending on the SLA (reliability) required. The other question here is what does the IT guy (independent IT guy?) benefit from you having subscribed to a T1 service? Are you paying him or the telco?
    – Marki
    Jan 11, 2015 at 15:53
  • I cannot think of a single reason why a VPN would require a T1 unless you don't trust your VPN on the wild west of the Internet. Like if you use Juniper.
    – SDsolar
    Apr 17, 2017 at 7:00

7 Answers 7

15

First of all, T1 gives you around 1.5Mbit/s in both directions, not 3Mbit/s. If you're seeing 3Mbit/s, it may be bundled from two separate lines.

Now, for VPN, if that's IP-based VPN as 99% of VPNs currently are, of course it doesn't matter if your physical interface is T1, E1, ATM OC-3 or 10GE WAN PHY - it's just used to provide higher-layer connectivity - which for VPNs (IPsec, DTLS or whatever) is usually IP connectivity. As soon as you obtain IP connectivity, you should be able to establish VPN sessions.

From the description you provide, that T1 line (or bundled T1 line) is used as a hub for employee remote connectivity. This may mean, that the VPN device has T1 ports built-in and that's why the "IT guy" claims T1 is needed to provide the connectivity, or there are some other constraints.

Given the costs of dedicated circuits, I'd rather ask local available ISPs about Ethernet line - be it 10Mbit/s, 100Mbit/s or sub-rate 1GE/full-rate 1GE. You'll get more for less (propably), and still get IP connectivity which is needed for VPN sessions.

1
  • T1 is 1.544 mbps - 24 channels of 64 kbps called DS0s - You can even subdivide them. I took 6 of them to provide videoconferencing and bundled the rest for data like database access and email and such. That way the videoconferences never got interrupted by other traffic. It is expensive. It takes a whole separate telecom budget item just to have them.
    – SDsolar
    Apr 17, 2017 at 6:58
10

There is no technical reason for requiring a leased line or similar for the VPN if another (cheaper) option is adequately fast and sufficiency low latency.

It may be that the leased line comes with significant service level agreements (with refunds/other built in to the contract for if the service fails to achieve these levels of availability/speed/latency/other) which a bog standard cable connection may not. If the VPN is essential to the business (and it is likely to be if there are remote workers) then this level of assurance is often worth paying for.

1
  • 1
    +1: For the OP, consider that the IT guy has to field all questions and issues regarding the VPN. They are always stretched thin. It could be that, while DSL/cable is fast enough, the IT guy is dependent on those Service Level Agreements to keep the number of man-hours allocated to VPN support within his budget.
    – Cort Ammon
    Jan 9, 2015 at 17:44
7

Why can't we just put a VPN on a normal cable connection?

You can. I VPN to the office from my phone reasonably frequently.

What technology you use for the transport layer is ultimately irrelevant: as long as you are on an IP network and your routers support VPN pass-through, you can use whatever you like. Dial-up, DSL, cable, ethernet, smoke signals...

There may be SLA constraints as others have said, or it may be that the only alternative in your area is a connection slower than T1 (which is already very slow for a business!) in which case it may struggle to keep up with the demand expected to be placed upon the VPN by its users.

3
  • 1
    I would LOVE to see a smoke signal network, with encryption Jan 8, 2015 at 17:45
  • @CanadianLuke Don't forget RFC 1149 about IP over Avian Carriers. I wonder if we can do IPv6 that way, or if it's limited to IPv4?
    – user
    Jan 9, 2015 at 9:22
  • @MichaelKjörling it has been updated for IPv6: rfc6214
    – JFL
    Nov 30, 2017 at 13:28
4

The questions are:

  1. How many people are using the VPN?
  2. What are they doing with it?

If it is many people, and they need to use wasteful (e.g. CIFS) protocols to access very large documents, they are going to need a lot more bandwidth than if there are few of them. I think that you are misunderstanding a claim about the VPN which is really a claim about the total required bandwidth; whether the claim is correct I can't tell you.

2

As others have pointed out, T1s typically provide ~1.5 megabits u/d. You must have bonded T1s: two physical copper circuits which are teamed to provide a single connection.

The current set up is providing reliable VPN access, but there's no technical reason that other lower-priced offerings wouldn't do the same or better for a small office.

I moved an office from two T1s to a point-to-point microwave WAN circuit a few years ago and improved up and down speeds by at least 1000%. Half the price and somewhere between just as and much more reliable in terms of uptime.

1

VPN connections don't require any particular connection type. However, it may be facilitated by a point-to-point T1 in this particular case.

0
1

I believe that your IT person was referring to the minimum speed that gives acceptable quality of service in order for VPN services to function properly. Your T1 which runs at a line speed of 1.5 Mbps Up/Down is being doubled through compression on the link between your Telco and your site to give you 3 Mbps of real throughput but that is a very small amount of data capacity to use for a business.

All of the VPN connections need to share this small capacity (and maybe all office communications to the Internet as well?) and it can be used of very quickly. Transferring large files would easily saturate this data pipe and and mentioned any RDP connection to a Windows Server would use .5 to 1 Mbps when moving through the GUI - much less when there is a static pages. A VNC connection on the other hand can use 2 to 3 Mbps - a much more likely connection if your IT support staff needs to connection to a server's GUI.

VPN is very finicky when it comes to the quality of the connection but this has more to do with latency than bandwidth. If the connection is not stable then the VPN will drop and you will need to reconnect. In the end though, any connection to your ISP that gives good throughput and low latency will work but they might not be available in your area. Not everyone has metro Ethernet in their city and usually rely on DSL or Cable modem service as alternatives to T1 or T3. Those two services can very widely in their speed with many DSL lines limited to 1.5 Mbps upload.

Most Cable modem service now provides 2 Mpbs upload speeds so for single users that will create a very solid VPN connection as long as your cable company has a good network, and most at least can give that level of QOS. With multiple simultaneous connections where people require VPN and their network to work reliably to get work done, DSL and normal cable modems won't cut it. We use 100 Mpbs Up/Down service to provide Internet access at branch offices with between 5 to 15 employees and use VPN endpoints on those networks that are able to use all of that capacity if it is needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.