We currently use many IPSec VPNs to connect to separate companies, but the VPNs are managed by a third party. We are interested in running these VPNs ourselves, using any method as long as it is IPSec. These clients share information with each other exclusively through us. Our organization acts as the hub that connects two spokes.
Are there any methods or best practices you may know of related to efficiently managing a large number of IPSec VPNs like this?
So the question is kind of vague but there are some guiding principles worth considering:
Separate connectivity into tiers - so, for example, a few external aggregation boxes might feed into a larger number of boxes focused strictly on encryption and decryption that, in turn, connect to infrastructure that separates customer connections into multiple logical tenants that are then cross-connected through a layer that can provide appropriate policy based controls and security. Greater flexibility in this regard will let you make more optimal choices about horizontal versus vertical scale - so more cheap boxes vs fewer high-density/exotic ones, etc.
Good management invariably means a very deep understanding and integration of operational processes into orchestration. You don't bolt automation on. Like security you really have to bake it in from the start. As you put together your infrastructure you want to choose product sets that integrate with your toolsets and you want to provide a product that integrates with your customer's toolsets. Success in anything like an SP network is going to be pretty directly tied to the extent you can keep humans out of day-to-day provisioning, troubleshooting, etc.. and to maximize the effectiveness of those humans when their attention is required.
Visibility and measurement are worthy investment targets. Be able to gather data from each and every tier and device and have an efficient and sane way to store and analyze this information. These areas are often neglected earlier in the process and it causes a lot of pain. This can be the means by which business and infrastructure can be well done and can be a significant competitive advantage and source of revenue.
Anyhow - if you can more specifically describe the problem you're trying to solve we can make better recommendations about the sorts of technologies and approaches that might be a win.
