Virtual private network issues using satellite based networks

A number of commercial wideband satellite systems have been proposed to offer Internet access services and some satellite systems have already begun offering such services (see http://www.time.com/time/digital/reports/broadband/wireless.html, 2000). A unique characteristic of these satellite systems, as compared to terrestrial Internet access systems, is their use of performance enhancing proxies (PEPs) to improve the performance of Internet protocols over the satellite link (see Border, J. et al, RFC 3135, 2001). PEPs break the end-to-end semantics of Internet connections and do not readily support the use of end-to-end IP layer security (IPsec) algorithms that are used for virtual private networks (VPN). This paper describes the challenges and potential techniques for deploying a VPN over a commercial satellite-based network. Results from experimentation performed at the MITRE facility are also presented to demonstrate the performance tradeoffs of candidate VPN design alternatives.