1R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

April 14, 2000

WSO PLBP - VPN

Competitive Market, Channel and Strategy

2R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

VPN MARKET

TAM: $85M (1998) - $1.5B (2003) with 77% CAGR

SAM: $20.3M (1998) - $172M (2003) with 53% CAGR

VPN PLBP Key Messages

Key Messages:•VPN is a primary enabler of converged data networking, facilitating the consolidation of private infrastructure into shared public infrastructure: one virtual network•VPN is the only viable means for broad based remote access and

e-business applications•VPN is currently a stand-alone capability that will be absorbed into access routers, switches, MSADs and Internet appliances

3R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

VPN Product Segments

• Dedicated VPN hardware: devices that support VPNs via hardware; the products are divided into the following subcategories:

• Low-end: support 100 or fewer simultaneous tunnels• Midrange: support 101 to 1,000 simultaneous tunnels• High-end: support more than 1,000 simultaneous tunnels

• Dedicated VPN routers: hardware support for encryption and support for routing protocols

• VPN-enabled routers: routers with software support for tunneling and encryption

• VPN-Enabled Software Firewalls: software firewalls with support for tunneling and encryption

4R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

VPN Market Matrix Comparison

Six vendors identified for competitive analysis vs. Intel• Nortel• Cisco/Altiga/Compatible• Lucent/Xedia• Efficient Networks/Netscreen• Microsoft• Checkpoint

5R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Matrix ComparisonVPN Vendor ComparisonVendor Maximum

Throughput/Tunnels

Supported Routing Protocols

Security - Intrusion Detection/Firewall

LDAP Site-to-site Failover

Support QoS

CA Support

IPsec RADIUS

Enhanced Logging & Reporting

DHCP Support

Client OS Support

Client Deployment Solution

Client Firewall

Management User Interface

Multi-tenant capability\

Nortel Networks

NA/5000 RIPv1, RIPv2 Yes / From Checkpoint

Yes Yes Yes Entrust, VeriSign

Yes Yes Yes Win95, 98, NT, Mac OS

No No HTML, GUI, Yes

Cisco (Routers) 90+ Mbps/2000 RIPv1, RIPv2, OSPF, EIGRP

No / Yes NO Yes Yes Entrust, Verisign, Netscape

N/A Yes Yes No No No CLI, telnet Yes

Altiga (Cisco) 100Mbps/5000 RIPv1, RIPv2, OSPF

No / Yes Yes Yes No No Yes Yes Yes Win95, 98, NT, 2000, 3rd party MAC

No No GUI, telnet, CLI, HTTP

Yes

Compatible (Cisco)

780 Mbps /40000 RIPv2, OSPF No / No NO Yes No Entrust Yes Yes No Win95, 98, NT, 2000, MAC, LINUX, SUN

No No GUI, Telnet, CLI, SNMP

Yes

Lucent 75Mbps */2000 RIPv2, OSPF, IEGRP

Yes / Yes NO Yes No Entrust, VeriSign

Yes Yes Yes Win95, 98, NT,

No Yes (OEM) HTTP, SNMP No

Xedia (Lucent) 155Mbps / 4000

IP, RIP, RIP2, OSPF, BGP-4, IGMP2, DVMRP3

No / YesCRL retrieval

VRRP

Yes, TOS, Differential services, CBQ

Entrust, VeriSign

Yes No Yes 95/98/NT4 No Yes (OEM) CLI, Web, SNMP Yes

Intel 10Mbps/1000 Static No / Yes NO No No Entrust, Shiva

No No client only Win95, 98 NT

Yes No GUI, Telnet, CLI No

Intel (Spitfire) 95Mbps/5000-10000

Static No / Yes NO No No Entrust, Shiva

No No client only Win95, 98, NT, 2000

Yes No GUI, Telnet, CLI No

Microsoft 45-70Mbps / 1000-5000

RIP, OSPF No / Packet Filter

Yes Yes Yes w ith Active Directory

Yes Yes Yes Yes Win 95, 98, NT, WIN 2000

Built in No IAS, SNMP, Event View er, Netw ork Monitor

Yes

NetScreen (Efficient Networks)

1 Gbps25000 RIPv1, RIPv2 (f low point)

Yes / Yes NO Yes No VeriSign Yes SYSLOG, WebTrends, SNMP MIB-II, SNMPv2

Yes Win95, 98, NT

No Yes CLI, Web, GUI, Telnet, SNMP

Yes

Checkpoint 10Mbps, 45Mbps / 4500

RIPv1 v2, OSPF, VRRP, IGRP, BGP-4

Yes / Yes NO Yes No VeriSign, Entrust

Yes SNMP, GUI, NT Event Log

Yes Win95, 98, NT, UNIX

No Yes SNMP, Web N/A

3Com END LIFE END OF LIFE END OF LIFE

6R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Nortel• Market Share

• 14% World Wide Total Dedicated VPN• 30% World Wide Dedicated Low End• 15% World Wide Dedicated High-End

• Target Markets and Channels• SME• Large Enterprises - Fidelity Mutual Funds, Miami Herald• ISP - GTE Internetworking, Bell Nexia, NBTel, Sprint Global

Internet VPN Service

• SME and Large Enterprise markets served both by resellers/system integrators and Large Enterprise and ISP via resellers and Nortel Direct sales.

7R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Nortel• Why Nortel Wins

• Mature stable product• Full featured product line• Strong enterprise and ISP relationships• Strategic Market Alliances

• Strategic Marketing Alliances• Nortel incorporation of Checkpoint FireWall-1 allows Nortel Networks to further

strengthen its leading Extranet/Virtual Private Network (VPN) solution• RSA Security• Nortel integrated the Entrust IPSec Negotiator* Toolkit into the software

platform of its Contivity* Extranet Switch product line, making the product Entrust-Ready*.

• RND Network's IP load balancer, the Web Server Director (WSD),combined with Bay Networks ContivityTM Extranet Switch product family.

• Bay Networks has licensed Netscape® Directory Server software and will bundle it with each version from Bay Networks Contivity® Extranet Switch product family.

8R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Cisco (Altiga, Compatible)• Market Share

• 88% World Wide VPN enabled Routers

• Target Markets and ChannelsCompatible• SME CPE via Resellers/Integrators and Catalog • Enterprise Customers via Resellers/Integrators• Showcase accounts include Adobe Systems, Apple Computer, Corio, Entex

Information, JPL, Lawrence Livermore, Pacific Group, Yankee Group, Pacific Stock Exchange

• ISP Carriers

Altiga• Small to Medium Enterprises• Large Enterprises• ISP’s - UUNET Vendor Alliance Program, HarvardNet, MediaOne, Digital Signal

Communications.• Resellers/Channels/System Integrators• Technica Corporation, a leading government solutions (GSA) integrator, to provide

customized VPN solutions to enterprise and government agency clients.

9R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Cisco (Altiga, Compatible)• Why Cisco Wins

• Time to market - Quick release product cycles• Strong enterprise and reseller channels• Two Acquisitions in dedicated hardware market• Mind Set

• Strategic Marketing Alliances• Compatible

• Compatible and PSINet Join Forces to with Channel Offering via Ingram Micro to make Service/Hardware bundle available through Resellers Nationwide

• Compatible Partners with NETRIX to Offer VoiceOverVPN June 1999• Altiga

• Baltimore Technologies, GTE CyberTrust, Entrust Technologies, RSA Security, iPass, Funk Software and Microsoft Certified Solution Provider.

10R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Lucent (Xedia)• Market Share

• 17% World Wide Dedicated Mid-Range• 24% World Wide Dedicated VPN Router

• Target Markets and Channels• SME• Large Enterprises • ISP

SME and Large Enterprise markets served both by

resellers/system integrators and Large Enterprise ISP

11R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Lucent (Xedia)• Why Lucent Wins

• High performance IP routing and QoS• Multi-tenant Internet Access

• Strong market awareness through publications and trade magazines

• Proven award wining product I.e Best of Show N+I• Carrier class products

• Strategic Marketing Alliances• UUNET, Concentric Network, Internet Telephony,

AT&T Canada

12R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Efficient Networks (NetScreen)• Market Share

• 7% World Wide Dedicated Low End• 9% World Wide Dedicated Mid-Range

• Target Customer • Remote access customers • Small to medium-sized businesses • ISP/ASP

• Primary Channels• Hewlett-Packard resells NetScreen-100 under HP Covision

program• Hitachi- Seibu Software resells NetScreen products in Japan• Patriot Technologies leading reseller of security solutions adds

NetScreen products to it’s GSA schedule.• WebZone Inc

13R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Efficient Networks (NetScreen)• ISP/ASP Providers

• Tibco.net 24x7 hosting service providing content aggregation to Yahoo. AltaVista, AOL, NetCenter, mySap.com and CBS Sportsline uses NS-100 in it’s data center

• Virtual Media Technologies a provider of managed Internet Security for Business to Business e-commerce sold via CLEC’s and ISP’s

• Excite@Home offering NetScreen-5 to small-medium enterprise customers for secure broadband connectivity

• GTE Professional Services resells NetScreen-10, NetScreen-100 and NetScreen-1000

• Bluetrain.com and ASP focusing on small-medium size enterprises deploys NS-5, NS-10 and NS-100 at customer sites for secured VPN connections to their data

• Why NetScreen Wins• Recent acquisition of NetScreen/Flowpoint• Superior alliances with ISP/ASP providers• Strategic Partnerships with Equinox

14R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Checkpoint/Nokia• Market Share

• 25% World Wide Total Dedicated VPN

• 56% World Wide Dedicated High-End

• 66% World Wide Software VPN Firewall

• Target Customer • Check Point is experiencing success both with their existing

installed base of customers and through sales by Nokia to new customers

• 110K customer installations - high end• 50% of firewall installed on Solaris

• Primary Channels• Distribution, OEM, 25+ Telcos/ISPs

• 75 Direct VARs/1,000 channel partners

• ~10% of sales through SunSoft unit

15R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Checkpoint/Nokia• Why Checkpoint Wins

• Firewall-1 Security Suite: VPN, authentication, NAT, content security, auditing; third party integrated software

• VPN-1: HW and SW-based VPNs

• Provider-1: Management solution for security policies

• Floodgate-1: Enterprise traffic control/bandwidth management

• ConnectControl: Load balancing solution

• MetaIP: IP management

• Cyber Attack Defense System: NetQuota, ServerQuota, Internet Alerts, Intrusion Response Protocol, VPN-1 Enterprise Center, Malicious Activity Detection, RealSecure

• Strategic Marketing Alliances

16R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Checkpoint/Nokia• Strategic Marketing Alliances:

• Nokia appliance development• VeriSign: Certificate deployment (Entrust/Baltimore planned)• IBM: AIX development• Microsoft (unified policy based management)• ODS: OEM of Check Point software• TI/Software: new Check Point company focused on security for broadband

home market• Intel (SVN architecture to Itanium)• ISS: RealSecure development• Sun (Solstace Firewall-1) discontinued in October `99

• OPSEC:

• Open platform for security integration of best of breed solutions; 200 partners

17R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

EOL

3Com

• PathBuilder S400• PathBuilder S500• Superstack II NetBuilder SI Routers• OfficeConnect NETBuilder

18R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Intel• Market Share

• 4% World Wide Total Dedicated VPN• 7% World Wide Dedicated Low End• 5% World Wide Dedicated Mid-Range

• Target Customer • Remote access customers • Small to medium-sized businesses • Internet Service Providers who need VPN hardware and software to

sell as on-site equipment to small to mid-sized businesses.

• Primary Channels• iASP’s (including formerly Shiva Premium Plus VAR’s) who have been

selling our current VPN solutions and other internetworking products. ISPs are also a target channel through the iISP program. NCP VAR’s (including formally Shiva premium VAR’s)

19R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Intel• Why Intel Wins

• Mature stable product• Enhanced VPN client capabilities• Sell into existing LRAS installed base• Shiva name brand recognition in remote access space

• Why Intel Loses• Time to Market• Critical product features missing• Lack of strategic marketing alliances/partnerships• Heavy attrition in Sales channels• Need to reeducate channel, VARs, PVARs

20R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

MS Win 2000 vs. Intel• Windows2000 Server and Advanced Server

Strengths

• Interoperability and Standards Support Support for IPSec, L2TP, PPTP industry standard protocols Supports Industry Standard hardware, can support multiple encryption

accelerators, supports multiple networking devices, Ethernet, Token Ring, FDDI, ATM, T-1. T-3

Includes “free MS Certificate Authority Server” and supports multiple CA’s Centralized database for authentication, NT Domain, Active Directory and

Radius (Radius Server bundled free under Internet Authentication Services)

21R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

MS Win 2000 vs. Intel• Weak Points Windows2000 VPN Server

General purpose operating system, slow performance without acceleration hardware or multi-CPU processors

PCI bus bandwidth limitation for I/O device and network device IPSec setup on server (and client) is awkward and requires significant in

depth knowledge of IPSec VPN Policy Management limited and highly dependent on Active Directory

framework QoS Features require Active Directory framework in place Very weak and limited Logging and Troubleshooting Tools Policy Management limited without Active Directory and predominately

limited to Windows2000 clients

• Weak Points of VPN client support No IPSec client for Windows95/98 or NT 4.0 No L2TP client for Windows 95/98 or NT 4.0 Windows 95/98 and NT clients only supported under PPTP

22R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

MS Win 2000 vs. Intel• Intel VPN Gateway Strengths Compared to

WIN2000 VPN Server as Gateway VPN Manager easier to use with more intuitive tabbed screens, requiring

less IPSec and VPN knowledge to configure Gateway. Syslog server provides single point of view on Gateway, CA or client

configuration issues vs. Win2000 Servers (four basic troubleshooting programs).

Better price/performance ratio between VPN Gateway (Spitfire) versus Windows 2000 Server customized for VPN Gateway duties i.e. configured with IPSec accelerator cards, 3DES cards and multiple CPU processors.

VCDT program allows distribution of pre-configured VPN Client profiles.

Intel VPN Client Strengths SST and IPSec clients for Windows 95/98 and NT 4.0 Native support for L2TP/IPSec Windows2000 client

23R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

MS Win 2000 vs. Intel• Intel VPN Gateway Weaknesses compared to

WIN2000 VPN Server

CA support limited to Shiva CA and Entrust 4.0 both extra cost options Radius Server is extra cost option i.e. not bundled with Intel GW, client or

management programs. Intel GW can’t proxy to NT domain without Radius Proxying No Policy Manager for managing other Gateways or clients etc. No Active Directory support or proxying at present No support for PPTP Shiva CA doesn’t interoperate with other Certificate Servers on market i.e.

proprietary solution No ease of use advantage of Shiva CA versus Microsoft CA, both are easy

to setup.

24R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Summary of vendors vs. IntelIntel Lacking Following Key Product Features

-routing protocols

-intrusion detection/enhanced firewall

-QoS, Bandwidth Management

-3rd party Digital Certificate support and LDAP

-enhanced logging/reporting

-unified management including HTTP

-site-to-site failover/DHCP support

-personal firewall client

-3rd party clients I.e Linux, Unix, Mac

-RADIUS for IPSec

-carrier class architecture and throughput

I.e modular design, 500Mbps +

-Voice Over IP support

-Multi-tenant internet access

25R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

Network Product Vendor Comparison for 2002

3%

5%

0%

9%

21%

57%

21%

52%

8%

7%

3%

5%

25%

29%

1%

7%

8%

9%

0% 20% 40% 60%

Intel

Lucent

Microsoft

Nortel Networks

3Com

Cisco

Net

wo

rk P

rod

uct

Man

ufa

ctu

rers

Percent of Respondents

Small

Medium

Large

EOL

Infonetics Research - Corporate Access in the US 2000: The Big Picture

Will not be #1 or #2 with current strategy

26R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

VPN PLBP StrategyMarket Options

• Build/Acquire complete product line according to key deficits for obtaining #1 or #2 market segment share

• VPN Branded product line will eventually be merged with converged product platform but will provide foundation for MSAD product

• Both product lines co-exist until VOIP is added to VPN platform•VPN gateways become MSAD

• OEM Intel APIs, toolkits for building block security components once converged market is in place

• Sell VPN platform to existing OEM partners I.e DELL, Compaq, etc..

• Promote PC vendors to start building Internet appliances that will will need security building blocks I.e IPSec toolkits, APIs, crypto etc.

• Strategic partnerships I.e Linux to build APIs around IA platform - partner and resell to OEM vendors along with Intel silicon

27R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions

• Unique position to leverage on existing computing expertise• Leverage e-Business data center campaign• Directly complement and provide foundation for converged MSAD platform I.e

VPN, routing, firewall• The complete solution is compelling to our RCO channel partners who are

looking to consolidate vendors

• Economies of scale across CPG through shared architecture will allow us to drive costs down ahead of the price curve

• Reuse of routing, security and management software will maximize efficiency and time to market for new capabilities

• Shared silicon, hardware and packaging will allow us to drive high volumes at low costs

• NetStructure product positioning will allow Intel to offer unique and feature rich, branded differentiation

VPN PLBP StrategyWhy We Will Win

28R

®

WA

N S

yste

ms

Ope

ratio

nsW

AN

Sys

tem

s O

pera

tions • Strategic goals

• Build/Acquire features that have been identified necessary to

be #1 or #2 in VPN TAM• Realignment of engineering resources for VPN projects• Build Strategic relationships with leading industry vendors • Identify OEM opportunities and strategic alliances

• Products• Expand product portfolio to cover 2-5 user space, and personal firewall • Segment product portfolio to include delivery of access router for $ 1 000

price point MSRP • Migrate to common CPG hardware platform in early 2001

• Channel• Provide the channel with a complete product offering that enables value

added solutions selling immediately• Explore direct selling via e-Commerce

VPN PLBP StrategySummary