This paper presents a layered VPN planning framework for organizations based on actual implementation experience. Specifically, we describe security issues corresponding to five distinct layers of analysis: (1) VPN technology; (2) firewalls; (3) legacy networks; (4) survivability; and (5) legacy applications. There is a broad spectrum of VPN options available with each having its own strengths, weaknesses, and vulnerabilities. It is anticipated that no single VPN solution will supplant others but instead a diversity of choices will continue to emerge thus increasing the value of an advanced planning framework.