MOBILISE
Mobile Br oadband Pr oposal :
Enterprise Solutions
ENTERPRISE MOBILITY SOLUTIONS
MOBILE BRO ADB AND PRO POS AL
Table of Contents
EXECUTIVE SUMMARY ........................................................................................................ 3
SOLUTION OVERVIEW ......................................................................................................... 4
Advantages and Disadvantages of a Private APN .......................................................... 4
Advantages and Disadvantages of Consumer Data Bundles ........................................... 4
IS Enterprise Solutions .................................................................................................. 5
Data Aggregation .......................................................................................................... 5
IS Mobility Manager ...................................................................................................... 6
The Integrated Data Bundle ........................................................................................... 7
Policy Enforcement ....................................................................................................... 8
Secure Connect ............................................................................................................ 8
Hardware Options ....................................................................................................... 10
Logistics Options ............................................................. Error! Bookmark not defined.
CONCLUSION ..................................................................................................................... 11
Page 2 of 11
MOBILE BRO ADB AND PRO POS AL
ENTERPRISE MOBILITY SOLUTIONS
EXECUTIVE SUMMARY
As the leading provider of Mobile Broadband to the corporate market, Internet Solutions (IS)
is in a unique position to provide tailored solutions to meet corporate mobility requirements.
The IS Mobile Broadband Solution for Corporate Clients includes:

Leverage of an IS-managed infrastructure including Shared APNs (Access Point
Names), Firewalls, Unlimited Network-to-Network capacity to MTN and Vodacom and
use of existing MPLS connectivity to IS

The ability to allow open Internet Acces s or restrict GSM data connectivity to VPN
software use only. This can be integrated with an onsite VPN concentrator or used in
conjunction with the IS Secure Connect Solution

Ability to integrate and aggregate services across both Vodacom and MTN networks

Integration of 3G/HSDPA and Hotspot Access – Open Internet or VPN Only

Sharing of a data bundle between a users 3G card, cell phone and Hotspot account

Granular, online management of end-users including detailed billing and reporting

The ability to use existing hardware or purchase network agnostic hardware from IS

Online SIM administration including immediate blocking/unblocking of end -users

Logistics options and Service Level Agreements tailored to the corporate client
This proposal includes a brief comparison between a standard APN, Consumer Bundles and
the IS Solutions on offer. The suggested conclusion is that the Enterprise Mobility Solutions
from IS better cater for the business requirements of corporate clients.
Page 3 of 11
MOBILE BRO ADB AND PRO POS AL
ENTERPRISE MOBILITY SOLUTIONS
SOLUTION OVERVIEW
The proposed solution is based on an IS Shared APN environment. An APN, or Access Point
Name, is described below and has historically provided corporate companies secure, mobile
access back into their local networks. The Shared APN develops on this concept offering a
fully managed environment for optimum security, manageability and scalability at the best
possible price.
Advantages and Disadvantages of a Private APN
Private APNs are generally requested in order to provide secure , mobile connectivity back
into a corporate network. In addition to the security advantages (over the public Internet
APN), Private APNs can also be ‘corporate billed’ i.e. all data usage on the corporate APN is
aggregated and one bill is presented to the client. This is generally preferred to ‘sub scriber
billing’ whereby an invoice is issued for each SIM card.
The most notable disadvantage of this solution relates to manageability:
From an infrastructure perspective, the Private APN requires a separate setup with fixed
network components including the APN itself, a client-specific VPN (virtual private network
created using MPLS), network-to-network interface (NNI) to either MTN or Vodacom as well
as, in many cases, a firewall and/or router. This fixed environment limits scalability and, as
data usage grows, becomes prohibitive from a price perspective.
From an end-user perspective, the Private APN also offers very limited management with no
insight into usage on an individual basis.
From a security perspective, a large number of enterprise clients consider APNs insufficient.
Firstly, usage of a Private APN without additional VPN Software leaves data unencrypted
between the user’s laptop and the point of encryption on the Mobile Data Network. This can
often result in data exposure over two or three ‘ hops’ across the network (laptop to base
station, base station to base station controller, BSC to GGSN etc).
In addition, the ability to connect directly into a corporate local area network (LAN) with
nothing other than a stolen or mistakenly provisioned SIM card is often seen as an
unnecessary risk.
Advantages and Disadvantages of Consumer Data Bundles
Internet Data Bundles, as purchased by consumers from Cellular Service Providers allow for
a bit more control at the user level, but lack any form of security or policy enforcement.
Bundles also restrict optimisation by removing any opportunity to aggregate data u sage.
User management and administration costs are also exacerbated though bulk purchases of
consumer products.
Page 4 of 11
ENTERPRISE MOBILITY SOLUTIONS
MOBILE BRO ADB AND PRO POS AL
IS Enterprise Solutions
In response to these challenges, IS has created a number of variations and value -added
services to address the corporate market.
Described below are the benefits of the IS Solution including superior aggregation, end -user
management, logistics options, hardware and security as well as the seamless integration of
unique services such as Hotspot Access and IS Secure Connect (outsourced VPN Solution),
Data Aggregation
From a company perspective, IS allow user allocations to be aggregated together to create a
company “pool” of data. This aggregation works in a similar way to company billing on a
Private APN whereby usage is invoiced on a single bill and users can share the total
allocation.
For example:
Ten 500MB data bundles purchased from a Cellular SP will always result in some users
over-using and others under-using their bandwidth allocation. Those who use 250M B are
still charged for the full 500MB thereby doubling their effective cost per MB. Heavy users
who might use, for example, 750MB are charged out -of-bundle rates for the additional usage
on top of the bundle cost.
In contrast, IS clients do not incur any additional data charges unless they exceed the total
company limit, in this case, 10 x 500MB = 5000 MB. Users therefore “share” the data pool
allowing for more efficient use of the total data allocation. IS also have a much lower out-ofbundle rate than other providers at 80c/MB.
Considering the above and due to sharp price increases in October 2007, IS was forced to
implement a business rule to control bandwidth abuse. Currently any single user that
exceeds 200% of their allocation is charged out -of-bundle bandwidth - i.e. usage is
aggregated, but this aggregation does not apply to excessive usage over 200% by any user.
Therefore, in the above example, if one user did 2 GB (2000 MB) of data on a 500MB
bundle, regardless of the size of the company data pool, that user would attract an out-ofbundle cost of : (2000 – (500x2)) x 80c = R 800
Despite this limitation, IS is the only company providing aggregation and lower out -of-bundle
rates.
Page 5 of 11
MOBILE BRO ADB AND PRO POS AL
ENTERPRISE MOBILITY SOLUTIONS
IS Mobility Manager
IS clients are setup on the IS online management t ool known as “Mobility Manager” where
they are separated on a logical level. This separation determines the data aggregation and
constitutes what is effectively a Virtual APN.
Through this versatile tool, clients can create sub -groups, assign usernames to SIMs, view
graphs and statistics, schedule email reports and perform user administration tasks.
Tommy Henn
TONY KOUTAKIS
TONY WALT
TRACEY HOSKINGVANECK
Tracy Naidoo
UDISHA BANGTIO
Vani Rajah
Vashnee Nadasen
VBP STANDBY
VICKI LANGTON
Victor Pitamber
VINESH NAIDOO
WASEEM EBRAHIM
ZOE LAZARUS
INTERNET
SOLUTIONS
1
1
1
1
1
1
1
1
1
1
1
1
1
1
200
200
200
200
200
200
200
200
200
200
200
200
200
200
110
85
69
0
6
31
0
265
469
636
40
60
33
71
0
0
0
0
0
0
0
65
269
436
0
0
0
0
0.00
0.00
0.00
0.00
0.00
0.00
0.00
52.00
215.20
348.80
0.00
0.00
0.00
0.00
235
46,600
47,520
23,224
18,579.20
Aggregate Totals
Allocated:
Usage:
Over:
Cost:
46600 MB
47520 MB
920 MB
R 736.00
In addition, integration with the systems of the Mobile Network Operators allows IS clients to
administer SIM cards online. Some of the functions currently available or available soon
include (but are not limited to) blocking / unblocking of users, activating International
Roaming and retrieving a PUK number.
Page 6 of 11
ENTERPRISE MOBILITY SOLUTIONS
MOBILE BRO ADB AND PRO POS AL
The Integrated Data Bundle
The end-user of an IS Mobile Broadband Data Bundle has a range of unique connectivity
options available. Due to IS’s position as an independent aggregator and integrator of
mobile data services, a single user can utilise the Vodacom or MTN GPRS/3G/HSDPA
networks as well as IS or partnered WiFi Hotspot Networks at any time to ensure optimal
coverage and connectivity speeds at the most cost-effective rate.
Any 3G/HSDPA or W iFi Hotspot data utilised is deducted off a single ‘data bundle’ or quota
allocated to an individual user. Hotspot usage on either the IS or partnered networks
(making up over 95% of total available Hotspots in SA), is deducted at half the normal rate,
thereby making Hotspot usage half the price of normal 3G/HSDPA utilisation.
In addition, an enterprise customer can mix MTN and Vodacom SI Ms seamlessly – the only
difference to the client being the colour of the SIM card.
Examples of benefits to enterprise users:

Field staff may choose to carry one SIM card of each network operator to ensure
optimal coverage or an “emergency backup” for when one network is experiencing an
outage.

A user with an MTN cell phone contract (from any Service Provider) and a Vodacom
SIM from IS can provision both SIM cards against a single 500 MB data bundle
eliminating the R 2 / MB cost of accessing email or the internet via their cell phone.

Many users who predominantly make use of 3G/HSDPA at public locations such as
airports, hotels, B&Bs and coffee shops can dramatically reduce their spend by
utilising available W iFi Hotspots.
Page 7 of 11
ENTERPRISE MOBILITY SOLUTIONS
MOBILE BRO ADB AND PRO POS AL
Policy Enforcement
IS offers two primary variations of mobile connectivity – restricted or unrestricted.
Unrestricted users have open access to the Internet via either 3G/HSDPA or W iFi Hotspots.
Restricted users are limited to making use of company-authorised VPN access to the
corporate network. Internet Access in this case, is only available if allowed, via the company
network and in accordance with normal policy.
This is done by putting the following restrictions in place:

All SIM cards are provisioned on the IS APN called ‘vpn.is.co.za’ only –
customer has no ability to connect directly to the internet via MTN /
Vodacom

Hotspot users are provisioned only for restricted access via W iFi

The Firewall policy is setup to allow users to connect only to specified IP
address on a specified port
This allows for control similar to that of a Private APN. Allowed IPs can grant access either
to a client managed VPN concentrator on the company LAN or to the client’s VPN via the IS
Secure Connect solution.
The shared infrastructure allows clients to save on fixed costs as well as removing potential
bottlenecks in the infrastructure. Existing clients can also use their MPLS connections to IS
for remote user traffic.
Secure Connect
The new ‘Secure Connect’ offering from IS Security utilises
a centrally hosted Juniper VPN concentrator to authenticate
remote and mobile users passing them securely into client
VPNs. This solution does require MPLS connectivity to IS,
but eliminates the need for onsite VPN infrastructure and
laptop software installations. Secure tunnelling is achieved
via an SSL website and a user-held token which provides a randomised password. The
token is shaped like a credit card making it easy to store and carry.
Page 8 of 11
ENTERPRISE MOBILITY SOLTUTIONS
Virtual APN Solution with Secure Connect
rg Inte
Existin tions
c
co n n e
Bryanston
GSM
Network
(Vodacom or
MTN)
IS MPLS
‘SHARED”
VRF
2. The user builds an SSL VPN
connection from his/her browser to the
IS Secure Connect concentrator, which
lands the user into the existing
clientVRF
Rosebank
APN: vpn.is.co.za
IS Owned/
Controlled
Filter firewall
1. The GSM user, utilises either a
Smartphone, or Laptop with USB/PCMCIA
card.
The SIM card needs to be provisioned
onto the IS APN (vpn.is.co.za).
Once the SIM is authorised onto the APN,
the user is routed through to the IS MPLS
network, and out through a firewall, which
permits him to establish VPN tunnels
only, to Internet facing VPN Concentrators
(i.e. The user has very limited Internet
access, with no browsing or mail).
WWW
IS Access
IS MPLS
IS Secure
Connect SSL
VPN Solution
3. The SSL VPN solution uses a One-TimePassword mechanism, and should also be
integrated into the COJ Active Directory.
This is the only authentication mechanism
required, and therefore facilitates SSO.
Company : Internet Solutions
Compiled by : Ian Shak
Date : 04 April 2008
Version : 1.0
Edit Date : 04 April 2008
Page 9 of 11
Router
ISP Router
Switch
This drawing is the sole property of IS (Pty) Ltd.
and may not be copied or reproduced in any
manner without IS's written consent.
Parties failing to adhere to the above would leave
themselves and their organisations open to
prosecution.
MOBILE BRO ADB AND POPO S AL
ENTERPRISE MOBILITY
VIRTUAL
SOLUTIONS
APN
Hardware Options
IS Clients can use existing hardware or any Option or Huawei hardware on offer from IS as
a registered Option Distributor in South Africa.
Page 10 of 11
MOBILE BRO ADB AND POPO S AL
ENTERPRISE MOBILITY
VIRTUAL
SOLUTIONS
APN
CONCLUSION
IS believes that these solutions, catering for the enterprise client, will meet all critical
business criteria including security, policy enforcement and user management at a
competitive price.
IS offers a variety of unique options and value-added services including a vastly superior
management interface and a level of service and support not otherwise available to
corporate clients in South Africa.
Page 11 of 11