Case studies: TUI

Pan-european Secure VPN

"On more than one occasion Cisilion have gone beyond the call of duty and acted as a true partner should (but rarely do). The solutions Cisilion have recommended/implemented have been a complete success across the board in terms of financial savings, technical excellence and ongoing management. We look forward to working with Cisilion for a long time to come."

Fintan Galvin, Group Technical Services Manager, TUI UK.

 

The customer

TUI UK encompasses 200 tourism brands around the world and now includes over 3,600 travel agencies, 103 aircraft, 37 incoming agencies and 290 hotels with over 157,000 beds in 30 countries.

Around 12,000 business travel professionals in over 70 countries also look after the Group’s business customers.

TUI UK provides its customers with holidays from a single source – from booking in a travel agency to flights and accommodation in the Group’s own hotels and customer-care provided by the Group’s own tour guides.

This vertical integration strategy covers the whole value chain in the source markets (sales markets) and the destinations (holiday areas) and provides its customers with high standards of quality from start to finish.

The challenge

Following a review at TUI UK the requirements were identified as being:

• The provision of a highly available, resilient and secure remote access facility for home and distant users in the UK (mainly in the Kingston area).
  
• The provision of point-to-point VPN connections to the French, Italian and Austrian offices.

The previous solution was a single point of failure and relied on local database authentication on the terminating VPN device.

Also some of the remote offices were using traditional leased lines and even ISDN, this provided an opportunity for large cost savings by using DSL based technology combined with VPN security.

The deployment of a highly available remote access service would present TUI UK with the opportunity to convert many of its office based workers to home workers; the objective was to save on office space and costs.

As part of this project another requirement was to secure the LAN network from the internet using dual redundant firewalls. Not only would this provide a level of hardware based redundancy but also network availability should one of the firewalls fail.

From a management perspective, the VPN deployment and perimeter security (PIX firewalls) would be handled by the TUI UK IT team therefore, a network management solution was also required, this would enable the existing IT staff to understand and maintain the new network.

The solution

The final design was based around two 2MB Internet feeds, each having a VPN3030 terminated on the end for remote access and LAN-to-LAN VPNs. This would enable load sharing amongst the two VPN servers for more efficient use of bandwidth.

Dual PIX firewalls were also deployed for highly available access to internet services. SHDSL (Symmetrical High-Bit Digital Subscriber Link) technology was installed to provide dual Internet links into the HQ. SHDSL utilizes a normal telephone line to connect to the service provider exchange and so can be provided at a fraction of the cost of traditional leased lines. The SHDSL links were used as the primary and secondary links for all VPN connections; this meant that all incoming and outgoing VPN traffic used a collective bandwidth of 4MB.

Using the two SHDSL links enabled the VPN solution to be highly available, the configuration of the two VPN3030’s was centered around each one providing backup services to the remote offices and users in the event of the primary link failing.

The benefits

The final design was based around two 2MB Internet feeds, each having a VPN3030 terminated on the end for remote access and LAN-to-LAN VPNs. This would enable load sharing amongst the two VPN servers for more efficient use of bandwidth. Dual PIX firewalls were also deployed for highly available access to internet services.

SHDSL (Symmetrical High-Bit Digital Subscriber Link) technology was installed to provide dual Internet links into the HQ. SHDSL utilizes a normal telephone line to connect to the service provider exchange and so can be provided at a fraction of the cost of traditional leased lines. The SHDSL links were used as the primary and secondary links for all VPN connections; this meant that all incoming and outgoing VPN traffic used a collective bandwidth of 4MB.

Using the two SHDSL links enabled the VPN solution to be highly available, the configuration of the two VPN3030’s was centered around each one providing backup services to the remote offices and users in the event of the primary link failing.