General information about the GOST VPN service

GOST VPN is a service for establishing a secure connection between your infrastructure in Selectel and infrastructure located at an external site. Information transmitted through the secure connection is encrypted via GOST according to the requirements of the FSB and FSTEC of Russia.

To establish secure inter-network interaction, ViPNet Coordinator hardware is used. Selectel provides and configures hardware only on its side. We do not install or configure hardware and software on external sites; for more details, see the Areas of responsibility section.

To connect the GOST VPN service, the external site must have ViPNet Coordinator hardware installed and configured that meets the requirements.

If you need to set up a secure connection to your infrastructure in Selectel, you can use the GOST VPN Remote Access service. As part of this service, we set up a secure connection between the ViPNet Coordinator in Selectel and our partner's ViPNet Client.

Tasks solved

GOST VPN helps to:

organize a secure GOST-compliant connection for data transmission between your infrastructure in Selectel and infrastructure at an external site: telecom operators, government agencies, banks, hospitals, commercial biometric systems, and others;
comply with the requirements of Russian legislation regarding data security.

GOST VPN Remote Access helps to:

organize a secure remote GOST-compliant connection for your employees to work and for administering your infrastructure in Selectel;
comply with the requirements of Russian legislation regarding data security.

Operating principle

In Selectel, the cryptographic information protection facility (CIPF) ViPNet Coordinator and your infrastructure are connected via a private network at the L3 layer through a global router. If you need to set up network connectivity between the ViPNet Coordinator and a server in Selectel directly at L2, you can place a dedicated server in a certified data center segment.

The connection scheme and service selection depend on the tasks you need to solve:

GOST VPN — a secure site-to-site connection is set up between your infrastructure in Selectel and the infrastructure at the external site;
GOST VPN Remote Access — a secure client-to-site connection is set up from a remote workstation to your infrastructure in Selectel.

GOST VPN

An agreement on establishing inter-network interaction is concluded between Selectel and the network owner at the external site.

Under this agreement, your infrastructure in Selectel and the infrastructure at the external site are combined into a private network. ViPNet Coordinator CIPTs are installed as gateways on each side to route and process traffic for the secure channel.

GOST VPN Remote Access

A direct contract is concluded between you and our partner for the provision of ViPNet Client software based on the number of remote workstations. Under this agreement, a secure communication channel is created between the ViPNet Coordinator in Selectel and the ViPNet Client provided by our partner, through which information is transmitted in encrypted form. To access your infrastructure in Selectel, you need to connect from a remote workstation using ViPNet Client. For ViPNet Client software compatibility with various OSs, devices, and platforms, see the official documentation for ViPNet Client by InfoTeCS.

Hardware

If different ViPNet security equipment (SKZI) models are installed in the Selectel data center and at the external site, the channel bandwidth and protection class will match the specifications of the less powerful model.

Hardware in Selectel data centers

As part of the service, hardware models from the ViPNet Coordinator HW 4 line from InfoTeCS are provided in Selectel data centers. The equipment holds the following certificates:

FSB of Russia — protection class KS3;
FSTEC of Russia — firewall type A.

	HW100C(N)	HW100C(Q)	HW1000	HW1000 D	HW2000	HW5000
Platform	N1	Q1	Q7	Q9	Q5	Q2
L3 VPN bandwidth, Mbit/s	175	400	915	2500 `*`	6600	10,000 `*`
L2 VPN bandwidth, Mbit/s	175	400	915	2500 `*`	6000	10,000 `*`
Firewall, Mbit/s	930	1400	930	2800 `*`	9200	13,000 `*`
Interfaces	4 x RJ-45 1 x SFP	4 x 1G RJ-45 2 x 1G SFP	6 x RJ-45	8 x RJ-45 4 x SFP	4 x RJ-45 4 x SFP 4 x SFP+	4 x RJ-45 8 x SFP+

* When bonding two or more physical network interfaces

Requirements for hardware at an external site

To set up a secure channel at an external site, any ViPNet Coordinator model, hardware (HW) or virtual (VA), must be used. Selectel does not lease hardware and software for deployment at an external site. To select, purchase hardware, and create a ViPNet network, you can engage one of the official partners of the ViPNet manufacturer.

Areas of responsibility

The distribution of responsibility depends on the service — GOST VPN or GOST VPN Remote Access.

GOST VPN
GOST VPN Remote Access

Selectel	provides ViPNet Coordinator HW and places it in a Selectel data center; configures connection of ViPNet Coordinator HW in a Selectel data center to the internet and local network; maintains the operability of equipment, local network, and internet connection, and replaces equipment in case of failure; installs software updates on ViPNet Coordinator HW in a Selectel data center; modifies traffic rules on ViPNet Coordinator HW upon request from a Selectel user
Selectel user	rents infrastructure in a Selectel data center; configures a global router for their infrastructure in Selectel; organizes signing of an agreement between Selectel and the network owner at the external site; organizes interaction between Selectel and the network owner at the external site after the agreement is signed; provides information for configuring network connectivity and rules on ViPNet Coordinator HW
Network owner at the external site	signs consent to exchange cross-network information; places SKZI equipment on their side; organizes and administers the ViPNet network on their side; transmits the cross-network master key and cross-network information; imports the cross-network information received from Selectel

Selectel	provides ViPNet Coordinator HW and places it in a Selectel data center; organizes cross-network interaction between our partner’s ViPNet networks and Selectel; ensures exchange of cross-network information when connecting ViPNet Client; installs software updates on ViPNet Coordinator HW in a Selectel data center; modifies traffic rules on ViPNet Coordinator HW upon request from a Selectel user
Selectel user	rents the necessary infrastructure in a Selectel data center; concludes a contract with our partner for the installation and administration of ViPNet Client SKZI; rents ViPNet Client from our partner; configures a global router for their infrastructure in Selectel
Our partner	fulfills the terms of the signed contract with the Selectel user for the installation and administration of ViPNet Client software; purchases and configures ViPNet Client software; transmits information to Selectel for organizing remote connection

Cost

GOST VPN

The cost of the GOST VPN service is affected by:

ViPNet Coordinator HW model;
number of cross-network connections;
need for a high-availability cluster made of two ViPNet Coordinator devices.

You can check the cost of the service on selectel.ru or in the control panel: in the top menu, click Products and select GOST VPN. If the model you need is not in the list, to calculate the cost of the service, create a ticket.

To pay for the service, depending on the balance type in the account, the single balance or main balance is used. The service is billed monthly; when ordering the service, the payment for the first month is deducted from the balance, and subsequent payments are deducted automatically at the beginning of each following period.

GOST VPN Remote Access

The payment for the GOST VPN Remote Access service consists of the cost of:

GOST VPN service. The service is billed monthly; when ordering the service, the payment for the first month is deducted from the balance, and subsequent payments are deducted automatically at the beginning of each following period;
rental of our partner’s ViPNet Client — annually;
installation of ViPNet Client by our partner — one-time.

To calculate the cost, create a ticket.