Centralized VPN

Centralized VPNs securely connect remote MFN-2 users and sites to MFN-2 customer sites over the unsecure public Internet using AES encryption.&nbsp; It is a turn key service. The Centralized VPN service provides secure access to data resources within the MFN-2 intranet for remote partner LANs and remote users.&nbsp; Typical IPsec tunnels, which terminate on the centralized VPN gateway at the IAG, are used. &nbsp;The service utilizes strong authentication and encryption for IP data streams.&nbsp; The Centralized VPN service supports LAN-to-LAN VPN, Client-to-LAN VPN, and Clientless-to-LAN VPN.<ul class="list-disc list-outside mb-6 ml-6"><li class="mb-2"><a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/centralized_vpn/lan-to-lan_vpn" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">LAN-to-LAN VPN</a></li><li class="mb-2"><a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/centralized_vpn/client-to-lan_vpn" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">Client-to-LAN VPN</a></li><li class="mb-2"><a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/centralized_vpn/clientless_vpn_layer-7_ssl_vpn" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">Clientless VPN</a></li></ul>

Distributed VPN

The distributed VPN service shall use the customer&rsquo;s CPE router or the VPN appliance with encryption services enabled to facilitate LAN-to-LAN VPN connectivity to remote sites outside the MFN-2 firewall cluster. The distributed VPN service is used to provide encryption for on-net traffic within the MFN-2 network.&nbsp;The distributed VPN securely connects remote non-MFN-2 sites to MFN-2 customer sites over the unsecure public Internet using the following types of encryption:<ul class="list-disc list-outside mb-6 ml-6"><li class="mb-2">AES 256/192/128-bit encryption</li><li class="mb-2">3DES 168-bit encryption if site can&rsquo;t support AES</li><li class="mb-2">SHA 256-bit hashing algorithm</li></ul>The VPN terminates on a public IP address provided by the State at either the MFN-2 customer CPE or beyond it on a rented VPN appliance placed at the customer site.MFN-2 typically uses standard IPsec tunnels to allow for vendor-agnostic implementation, however Generic Routing Encapsulation (GRE) over IPsec and FlexVPN tunneling are also available.&nbsp; L3 Harris Helpdesk information phone# +1 (844) 548-MFN2 (6362) or email: <a href="mailto:support@mfn2.myflorida.com" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">support@mfn2.myflorida.com</a>&nbsp;&nbsp; 
<div class="align-center ibexa-embed-type-image">
 
 
 <figure class="ezimage-field"><img src="https://cc-dms-storage.s3.amazonaws.com/main/images/_aliases/600x600/media/cits_media/divtel_images/distributed_vpn_2_diagram/903851-1-eng-US/distributed_vpn_2_diagram.jpg" alt="Distributed VPN-2 Diagram" height="524" width="600" /></figure>

</div>

Dynamic VPN Tunnels (GETVPN)

Dynamic VPN Tunnels provide a distributed LAN-to-LAN VPN solution allowing state agencies to encrypt sensitive data over the MPLS WAN.&nbsp; Dynamic VPN Tunnels use group encryption where there is a dedicated Key Server used to manage keys between all devices associated with the VPN.&nbsp; Dynamic VPN Tunnels are intranet encryption services that dynamically sets up VPN encrypted tunnels. This allows the customer to have no need to provision and manage individual tunnels.&nbsp; Dynamic VPN tunnels can automatically establish the connection and scale up to support a large number of tunnel end-points.&nbsp; Dynamic VPN Tunnels incorporate enterprise key servers to be used across multiple agencies and configure in a manner which makes it appear that each customer has a dedicated key server.&nbsp; L3 Harris Helpdesk information phone# +1 (844) 548-MFN2 (6362) or email:&nbsp; <a href="mailto:support@mfn2.myflorida.com" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">support@mfn2.myflorida.com</a>The key servers in the diagram below provide the following functions:<ul class="list-disc list-outside mb-6 ml-6"><li class="mb-2">Validation of Group Members</li><li class="mb-2">Manage Security Policy</li><li class="mb-2">Create Group Keys</li><li class="mb-2">Distribute Policy Keys</li><li class="mb-2">Replicate data between other key servers</li></ul> 
<div class="align-center ibexa-embed-type-image">
 
 
 <figure class="ezimage-field"><a
 href="/var/dms/storage/images/media/cits_media/divtel_images/dynamic_vpn_tunnels_getvpn_diagram/903865-1-eng-US/dynamic_vpn_tunnels_getvpn_diagram.jpg"
 target="_blank" ><img src="https://cc-dms-storage.s3.amazonaws.com/main/images/_aliases/600x600/media/cits_media/divtel_images/dynamic_vpn_tunnels_getvpn_diagram/903865-1-eng-US/dynamic_vpn_tunnels_getvpn_diagram.jpg" alt="Dynamic VPN Tunnels (GETVPN) Diagram" height="401" width="600" /></a></figure>

</div>

VPN-2 Ordering

<h2 class="font-bold text-3xl mt-6 mb-4 leading-10 font-display">Information required on order for Client-to-LAN VPN services:</h2>Step 1:
 
 Customer Billing Address&nbsp; Company Name (if applicable)&nbsp; Street Address&nbsp; City, State/Zip Code&nbsp; Email Address
 
Step 2:
 
 List all applicable IP addresses (or ranges) the remote client user may access through the VPN (a consultant's permitted access to the agency network). &nbsp;IP Address/Subnet Mask.
 
Step 3:
 
 UserID assigned to the VPN Client account (Agency Controlled)&nbsp;&nbsp; User's Full Name (first and last)&nbsp;&nbsp; User's Telephone Number(s), include cell number if possible&nbsp; User's E-mail Address
 
Step 4:
 
 Agency&rsquo;s technical contact information. (The technical contact is expected to be capable of troubleshooting issues as required.)
 
<h2 class="font-bold text-3xl mt-6 mb-4 leading-10 font-display">Information required on the order for a LAN-to-LAN VPN</h2>Step 1:
 
 Customer Billing Address&nbsp; Company Name (if applicable)&nbsp; Street Address&nbsp; City&nbsp; State/Zip Code&nbsp; Email Address
 
Step 2:
 
 IP address for the VPN appliance's WAN interface connecting to ISP router. IP Address/Subnet Mask.
 
Step 3:
 
 List the default route IP address (gateway of last resort) for VPN appliance.
 
Step 4:
 
 IP address of VPN appliance's Ethernet interface connecting to customer LAN network IP Address/Subnet Mask
 
Step 5:
 
 List all applicable IP addresses (or ranges) the remote network is permitted to access. The VPN appliance will drop all other traffic not included. &nbsp;IP Address/Subnet Mask.
 
<h2 class="font-bold text-3xl mt-6 mb-4 leading-10 font-display">Locating Distributed VPN in CSAB</h2>New Service
 
 Log on to CSAB website, select &ldquo;Ordering&rdquo;, select &ldquo;Data&rdquo;, and select &ldquo;MyFloridaNet-2&rdquo;. Select &ldquo;Configure&rdquo; and choose an account and click &ldquo;Next&rdquo;.&nbsp; Select &ldquo;MFN-2 WAN Service&rdquo;.&nbsp; Then click &ldquo;VPN Appliance&rdquo; arrow. Next click the box for &ldquo;Rental&rdquo; and &ldquo;Standard Configuration Management&rdquo; is automatically checked.&nbsp;
 
Existing Service
 
 Log on to CSAB website, click on &ldquo;Inventory&rdquo; and then select &ldquo;Data&rdquo; and click on &ldquo;MyFloridaNet-2&rdquo;.&nbsp; Select correct item number and then &ldquo;Actions&rdquo;.&nbsp; Click on &ldquo;Change Service Options&rdquo;.&nbsp; Then click &ldquo;VPN Appliance&rdquo; arrow. Next click the box for &ldquo;Rental&rdquo; and &ldquo;Standard Configuration Management&rdquo; is automatically checked.&nbsp;
 
<h2 class="font-bold text-3xl mt-6 mb-4 leading-10 font-display">Locating Dynamic VPN Tunnels (GETVPN) in CSAB</h2>New Service
 
 Log on to CSAB website, select &ldquo;Ordering&rdquo;, select &ldquo;Data&rdquo;, and select &ldquo;MyFloridaNet-2&rdquo;. Select &ldquo;Configure&rdquo; and choose an account and click &ldquo;Next&rdquo;.&nbsp; Select &ldquo;MFN-2 WAN Service&rdquo;.&nbsp; Then expand &ldquo;Router (Selection Required)&rdquo; by clicking the arrow. Expand &ldquo;Router Options&rdquo; and select the appropriate router. Next expand &ldquo;Configuration Management Type&rdquo; by clicking the plus sign. Select &ldquo;Standard Configuration Management&rdquo; or &ldquo;Special Configuration Management (Multiservice CPE)&rdquo; by clicking the appropriated radial button.&nbsp; Next expand &ldquo;Router Configuration Management Features&rdquo; by clicking the arrow and then check the box for &ldquo;Dynamic VPN Tunnels&rdquo;.
 
Existing Service
 
 Log on to CSAB website, click on &ldquo;Inventory&rdquo; and then select &ldquo;Data&rdquo; and click on &ldquo;MyFloridaNet-2&rdquo;.&nbsp; Select correct item number and then select &ldquo;Actions&rdquo;. Click on &ldquo;Change Service Options&rdquo;.&nbsp; Then expand &ldquo;Router (Selection Required)&rdquo; by clicking the arrow. Expand &ldquo;Router Options&rdquo; and select the appropriate router. Next expand &ldquo;Configuration Management Type&rdquo; by clicking the plus sign. Select &ldquo;Standard Configuration Management&rdquo; or &ldquo;Special Configuration Management (Multiservice CPE)&rdquo; by clicking the appropriate radial button.&nbsp; Next expand &ldquo;Router Configuration Management Features&rdquo; by clicking the arrow and then check the box for &ldquo;Dynamic VPN Tunnels&rdquo;.
 
*When a customer with Service Provider owned equipment disconnects their service, the equipment needs to be returned back to the vendor. Billing will continue until the equipment is returned. The Service Provider will coordinate the equipment pickup.External contractors requiring access to VPN services need to have their sponsoring state agency to submit the service orders to DMS SUNCOM for the VPN account(s).&nbsp;

VPN-2 Service Level Agreements

VPN Services are provided via the MFN-2 contract agreement with Harris Corporation and the applicable SLAs are included in the attached document below.<a href="/content/download/140160/file/VPN-2%20SLAs.xlsx" data-content='{"fileName":"VPN-2 SLAs.xlsx","fileUrl":"\/content\/download\/140160\/903888?version=1","downloadUrl":"https:\/\/dms-media.ccplatform.net\/content\/download\/140160\/file\/VPN-2%20SLAs.xlsx","fileSize":"23.80 KB","mimeType":"application\/vnd.openxmlformats-officedocument.spreadsheetml.sheet","linkTitle":"VPN-2 SLAs","linkText":"VPN-2 SLAs","linkTarget":null,"linkClass":"","reader":{"name":"Microsoft Excel Document","iconUrl":"https:\/\/dms-media.ccplatform.net\/build\/images\/mime_type_icons\/16x16\/excel.png"}}' class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">VPN-2 SLAs</a>

VPN-2 CPE Appliance Options

A wide selection of appliance rentals are available via MFN-2 VPN-2. A standard appliance is presented for each platform offered.&nbsp; Additional custom approved appliances are available based on the customer&rsquo;s request once the particular appliance product is tested and approved by the MFN-2 quality assurance and design engineers.&nbsp;Appliance rental is based on a month-to-month recurring cost and includes hardware maintenance, installation and IOS updates.* The appliance rental has no term commitments. Customers utilizing the rental appliance option have the ability to change the appliance in response to performance issues or access speed changes with no penalty. In addition, the rental appliance will be kept at agreed upon IOS levels and upgraded as needed as part of the MFN-2 service.In the case where customers provide their own appliance (not through MFN-2 VPN-2), the appliance must be part of the approved and tested list of the MFN-2 VPN-2 appliances.&nbsp; While VPN-2 appliance is provided at an economical rate, customers are not required to subscribe to the appliance through the MFN-2 VPN-2.*Note: Customers will be responsible for software upgrades and patches if the appliance is managed by the customer.

<a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/vpn-2_ordering" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">VPN-2 Ordering</a><a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/vpn-2_service_level_agreements" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">VPN-2 Service Level Agreements</a><a href="https://www.dms.myflorida.com/business_operations/telecommunications/suncom2/data_services/remote_access_virtual_private_network_2_vpn-2/vpn-2_cpe_appliance_options" class="underline text-blue-500 transition-colors ease-in-out duration-500 hover:text-blue-400">VPN-2 CPE Appliance Options</a>