Peracon's site is where the broker, seller and buyer can "shake hands" and exchange information securely, Wisidagama says. Sellers and brokers can track the process in real time, and buyers can find detailed information on commercial buildings with virtual tours, executive summaries and other content on properties in California, Florida, New Jersey, New York, Oregon, Texas, Virginia, Washington, D.C., and soon other states as well. Meanwhile, big-name financial institutions, such as CB Richard Ellis, Insignia and Lehman Brothers, are using Peracon's online platform under a hosting arrangement that includes private branding of the service for their own commercial real-estate transactions.

Wisidagama and his team have built extra redundancy and security into the Peracon network and servers to ensure that the site stays up and running. Peracon runs one segment at its Manhattan headquarters and the other at a UUNet hosting site about 30 miles away. Each site has dual Cisco 3640 routers, dual Cisco PIX 520 firewalls, Cisco LocalDirector load-balancers and dual Cisco Catalyst 6006 switches for failover (plus intrusion detection and voice traffic). "For the Peracon site to go down, the switch, the router and the firewall have to fail at once in both locations," Wisidagama says.

The main Cisco routers at each site are connected by a private T1 line for redundancy, speed and security, and the edge routers run BGP4 (Border Gateway Protocol 4) for sharing IP-traffic-route data between locations. A second 3640 sits behind the first at each site, running EIGRP (Enhanced Interior Gateway Routing Protocol) for quick route updates and HSRP (Hot Standby Routing Protocol) for backup.

Peracon's clients access the transaction application through a secure VPN (virtual private network) session, using Peracon's VPN client software. The VPN sessions run standard IPsec (IP security) encryption for securing the pipe and SSL (Secure Sockets Layer) for the HTTP session. "In the future, we'd like [our clients] to use a dedicated VPN concentrator between their site and ours, or even a separate point-to-point line that's more private than the Internet," Wisidagama says.

Early on, Peracon had trouble deploying NAT (Network Address Translation), IPsec and BGP sessions within the sites and making them work together. "We were implementing them at the same time the site was in production, but redundant architecture saved us from actual site downtime," Wisidagama says. GRE (Generic Routing Encapsulation) tunneling, meanwhile, solved the problem with the protocols.

Another challenge for Peracon was implementing Active Directory. "Making Microsoft and Cisco shake hands and work together was not a happy period," says Jordan Barber, director of system operations for Peracon.

Peracon runs Cisco's Secure Scanner and Secure Policy Manager to control the PIX firewalls and to make regular sweeps across the enterprise. Also in the works is RADIUS (Remote Authentication Dial-In User Service) authentication with Cisco's ACS Server for remote users logging onto the extranet.