Network Architecture 101

A second kind of WAN deployment that's becoming more common is the use of VPNs over the Internet to build a corporate network. VPNs are advantageous because they use the Internet as their backbone and thus have little trouble reaching even the most far-flung offices. Also, because VPNs use the Internet, their expense is based only on local access costs at each location. The downside to building a VPN-based WAN is that you can't guarantee that the Internet connection (and thus the VPN) will always be available, or available at the speed you need. And, if you have many locations to manage, you'll need to deploy and manage VPN devices at each location. Additionally, because VPNs use the public Internet, a malicious user could potentially break into your network from the Internet and gain access to your internal corporate resources. Thus, choosing whether to deploy a private WAN or a VPN-based solution will depend on the complexity, cost requirements, and risk criteria inherent in your environment.

Wireless Access
Finally, let's look at wireless (i.e., 802.11 or Wi-Fi, the 802.11b wireless standard) networks in the enterprise. Wireless networks are common in homes and small businesses, but deploying wireless capabilities in larger organizations has its share of challenges—not the least of which is security.

Of the three Wi-Fi standards in use today, 802.11b is the most popular and was first on the scene, providing 11Mbps bandwidth. 802.11a and 802.11g are two competing standards for high-speed Wi-Fi networks. Both standards provide 54Mbps of throughput but use different techniques to achieve that speed. Of the two, 802.11a seems to be more popular right now.

Deploying wireless networks in the home and enterprise requires you to implement wireless Access Points (APs) around your physical locations to support wireless users. Wireless APs designed for the enterprise differ from home versions in their built-in management features; nevertheless, they function in basically the same ways. A wireless AP designed for 802.11b or 802.11a will work only with adapter cards of the corresponding type, although some wireless APs now support all three wireless standards. For more information about wireless APs, see Buyer's Guide, "802.11g Access Points," May 2004, InstantDoc ID 42272.

The biggest challenge and concern you have in deploying Wi-Fi in your organization is security. 802.11b comes with an encryption protocol, Wired Equivalent Privacy (WEP); however, WEP has proven extremely vulnerable to intruders. You shouldn't consider deploying WEP in a commercial organization unless you don't care about the privacy of your data.

Several new schemes are available to protect wireless networks, and at least one—the 802.11i standard—is on its way to becoming an IEEE standard. The 802.11i standard, which is being dubbed Wi-Fi Protected Access (WPA), is currently supported on Windows XP. Because WPA isn't officially a standard, make sure that the wireless AP you buy supports the Microsoft implementation of WPA.

A more standards-based alternative is to deploy a traditional VPN on top of your Wi-Fi network. Because VPNs are now common, they might provide you with a quicker path to secure Wi-Fi than trying to follow the emerging WPA standard will. You'll just need to ensure that your wireless users can connect to your internal network only through a VPN connection. You can accomplish this restriction by deploying a VPN server on your internal network between your wireless APs and the rest of the network, just as you would for mobile clients that connect from the external Internet.

Decisions, Decisions
When implementing an enterprise network, you need to consider many aspects of network architecture and design. Choosing a firewall and a switching standard, deciding whether to deploy Gigabit Ethernet or 100Mbps connectivity, and deciding whether to deploy Wi-Fi are all elements of the design process. Securing a solid understanding of networking basics is the best place to start. After you know how network devices route and filter traffic, you can move up the OSI model stack to provide more value-added services to your users.