Chapter11SelectingTechnologiesandDevicesforEnterpriseNetworks.docx
Chapter 11 Selecting Technologies and Devices for Enterprise Networks This chapter presents technologies for the remote-access and wide-area network (WAN) components of an enterprise network design. The chapter discusses physical and data link layer protocols and enterprise network devices, such as remote-access servers, routers, firewalls, and virtual private network (VPN) concentrators. The chapter begins with a discussion of the following remote-access technologies: Point-to-Point Protocol (PPP) Cable modems Digital subscriber line (DSL) After discussing remote-access technologies, the chapter presents options for selecting WAN and remote-access capacities with the North American Digital Hierarchy, the European E system, or the Synchronous Digital Hierarchy (SDH). The chapter continues with a discussion of the following WAN technologies: Leased lines Synchronous Optical Network (SONET) Frame Relay Asynchronous Transfer Mode (ATM) Metro Ethernet The chapter then covers two topics that will help you complete your WAN design: Selecting routers for an enterprise WAN design Selecting a WAN service provider The chapter concludes with an example of a WAN network design that was developed for a medium-sized company, Klamath Paper Products, Inc. The example indicates what technologies and devices were chosen for this customer based on the customer’s goals. The technologies and devices you select for your particular network design customer will depend on bandwidth and quality of service (QoS) requirements, the network topology, business requirements and constraints, and technical goals (such as scalability, affordability, performance, and availability). An analysis of traffic flow and load, as discussed in Chapter 4, “Characterizing Network Traffic,” can help you accurately select capacities and devices. For some organizations, scalability is a key design goal. The selected WAN solution must have enough headroom for growth. As discussed in this chapter, some WAN technologies are more scalable than others. Another key design goal for many organizations is to minimize the cost of WAN and remote-access circuits. Optimization techniques that reduce costs play an important role in most WAN and remote-access designs. Methods for merging separate voice, video, and data networks into a combined, cost-effective WAN also play an important role. These methods must handle the diverse QoS requirements of different applications. Remote-Access Technologies As organizations have become more mobile and geographically dispersed, remote-access technologies have become an important ingredient of many enterprise network designs. Enterprises use remote-access technologies to provide network access to telecommuters, employees in remote offices, and mobile workers who travel. An analysis of the location of user communities and their applications should form the basis of your remote-access design. It is important to recognize the location and number of full- and part-time telecommuters, how extensively mobile users access the network, and the location and scope of remote offices. Remote offices include branch offices, sales offices, manufacturing sites, warehouses, retail stores, regional banks in the financial industry, and regional doctors’ offices in the health-care industry. Remote offices are also sometimes located at a business partner’s site (for example, a vendor or supplier). Typically, remote workers use such applications as email, web browsing, sales order-entry, and calendar applications to schedule meetings. Other, more bandwidth-intensive applications include downloading software or software updates, exchanging files with corporate servers, providing product demonstrations, managing the network from home, videoconferencing, and attending online classes. In the past, telecommuters and mobile users typically accessed the network using an analog modem line. Analog modems take a long time to connect and have high latency and low speeds. (The highest speed available for analog modems is 56 kbps.) These days remote users need higher speeds, lower latency, and faster connection-establishment times. Analog modems have been replaced with small office/home office (SOHO) routers that support a cable or DSL modem. The sections that follow discuss these options and provide information on PPP, a protocol typically used with remote-access and other WAN technologies. PPP The Internet Engineering Task Force (IETF) developed PPP as a standard data link layer protocol for transporting various network layer protocols across serial, point-to-point links. PPP can be used to connect a single remote user to a central office, or to connect a remote office with many users to a central office. PPP is used with Integrated Services Digital Network (ISDN), analog lines, digital leased lines, and other WAN technologies. PPP provides the following services: Network layer protocol multiplexing Link configuration Link-quality testing Link-option negotiation Authentication Header compression Error detection PPP has four functional layers: The physical layer is based on various international standards for serial communication, including EIA/TIA-232-C (formerly RS-232-C), EIA/TIA-422 (formerly RS-422), V.24, and V.35. The encapsulation of network layer datagrams is based on the standard High-Level Data Link Control (HDLC) protocol. The Link Control Protocol (LCP) is used for establishing, configuring, authenticating, testing, and terminating a data-link connection. A family of Network Control Protocols (NCP) is used for establishing and configuring various network layer protocols, such as IP, IPX, AppleTalk, and DECnet. Multilink PPP and Multichassis Multilink PPP Multilink PPP (MPPP) adds support for channel aggregation to PPP. Channel aggregation can be used for load sharing and providing extra bandwidth. With channel aggregation, a device can automatically bring up additional channels as bandwidth requirements increase. Channel aggregation was popular with ISDN links, but it can be used on other types of serial interfaces also (a PC connected to two analog modems can use channel aggregation, for example). MPPP ensures that packets arrive in order at the receiving device. To accomplish this, MPPP encapsulates data in PPP and assigns a sequence number to datagrams. At the receiving device, PPP uses the sequence number to re-create the original data stream. Multiple channels appear as one logical link to upper-layer protocols. Multichassis MPPP is a Cisco IOS Software enhancement to MPPP that allows channel aggregation across multiple remote-access servers at a central site. Multichassis MPPP allows WAN administrators to group multiple access servers into a single stack group. User traffic can be split and reassembled across multiple access servers in the stack group. Multichassis MPPP makes use of the Stack Group Bidding Protocol (SGBP), which defines a bidding process to allow access servers to elect a server to handle aggregation for an application. The server has the job of creating and managing a bundle of links for an application that requests channel aggregation. SGBP bidding can be weighted so that CPU-intensive processes, such as bundle creation, fragmentation and reassembly of packets, compression, and encryption, are offloaded to routers designated as offload servers. You can deploy a high-end router as an offload server. An Ethernet switch can connect members of the stack group and the offload server, as shown in Figure 11-1. Figure 11-1 Multichassis Multilink PPP Stack Group and Offload Server Password Authentication Protocol and Challenge Handshake Authentication Protocol PPP supports two types of authentication: Password Authentication Protocol (PAP) Challenge Handshake Authentication Protocol (CHAP) CHAP is more secure than PAP and is recommended. (In fact, the RFC that discusses CHAP and PAP, RFC 1334, has been obsoleted by RFC 1994, which no longer mentions PAP.) With PAP, a user’s password is sent as clear text. An intruder can use a protocol analyzer to capture the password and later use the password to break into the network. CHAP provides protection against such attacks by verifying a remote node with a three-way handshake protocol and a variable challenge value that is unique and unpredictable. Verification happens upon link establishment and can be repeated any time during a session. Figure 11-2 shows a CHAP sequence of events. When a remote node connects to an access server or router, the server or router sends back a challenge message with a challenge value that is based on an unpredictable random number. The remote station feeds the challenge value and the remote node’s password through a hash algorithm, resulting in a one-way hashed challenge response. The remote node sends the hashed challenge response to the server, along with a username that identifies the remote node. The server looks up the username and runs the associated password and the challenge through the same hash algorithm that the remote node used. If the remote node sent the correct password, the hash values will match and the server sends an accept message; otherwise, it sends a deny message. Figure 11-2 Connection Establishment with the Challenge Handshake Authentication Protocol Cable Modem Remote Access A popular option for remote access is a cable modem, which operates over the coax cable used by cable TV (CATV) providers. Coax cable supports higher speeds than telephone lines, so cable modem solutions are much faster than analog modem solutions. Another benefit of cable modems is that no dialup is required. This is an advantage over analog modems that take a long time to dial and connect to a remote site. Note The term cable modem is somewhat misleading. A cable modem works more like a LAN interface than an analog modem. Cable-network service providers offer hybrid fiber/coax (HFC) systems that connect CATV networks to the service provider’s high-speed fiber-optic network. The HFC systems allow users to connect their PCs or small LANs to the coax cable that enters their home or small office, and use this connection for high-speed access to the Internet or to an organization’s private network using VPN software. The cable-network service provider operates a cable modem termination system (CMTS) that provides high-speed connectivity for numerous cable modems. Many cable providers use a specialized CMTS router for this purpose. The router is designed to be installed at a cable operator’s headend facility or distribution hub, and to function as the CMTS for subscriber end devices. The router forwards data upstream to connect with the Internet and/or the public switched telephone network (PSTN) if telephony applications are deployed. Challenges Associated with Cable Modem Systems A challenge with implementing a remote-access solution based on cable modems is that the CATV infrastructure was designed for broadcasting TV signals in just one direction: from the cable TV company to a person’s home. Data transmission, however, is bidirectional. Data travels from the provider to the home (or small office) and from the home to the provider. Because of the design of CATV networks, most cable-network services offer much more bandwidth for downstream traffic (from the service provider) than for upstream traffic (from the customer). An assumption is made that a lot of the data traveling from the home or small office consists of short acknowledgment packets and requires less bandwidth. This assumption is accurate for such applications as web browsing, but might not be accurate for other applications that will be deployed in your network design. A cable modem solution is not the best answer for peer-to-peer applications or client/server applications in which the client sends lots of data. A typical cable-network system offers 25 to 50 Mbps downstream bandwidth and about 2 to 3 Mbps upstream bandwidth. Multiple users share the downstream and upstream bandwidth. Downstream data is seen by all active cable modems. Each cable modem filters out traffic that is not destined for it. Upstream bandwidth is allocated using timeslots. There are three types of timeslots: Reserved: A timeslot that is available only to a particular cable modem. The headend system at the provider’s site allocates reserved timeslots to cable modems using a bandwidth allocation algorithm. Contention: A timeslot that is available to all cable modems. If two cable modems transmit in the same timeslot, the packets collide and the data is lost. The headend system signals that no data was received, and the cable modems can try again after waiting a random amount of time. Contention timeslots are used for short data transmissions (including requests for a quantity of reserved timeslots for transmitting more data). Ranging: A timeslot that is used for clock correction. The headend system tells a cable modem to transmit during a ranging timeslot. The headend system measures the time to receive the transmission, and gives the cable modem a small positive or negative correction value for its local clock. If you plan to use a cable modem solution for remote users or remote offices, be sure to query the service provider about the number of users who share a single cable and the types of applications they use. Provide the service provider with information about the bandwidth requirements of your users’ applications, based on the analysis of traffic characteristics that you did as part of the requirements-analysis phase of the network design project. Typically a service provider can give you an approximation of how much bandwidth is available per user of a cable-network system. Some systems also have the capability to guarantee a level of bandwidth for heavy-usage applications. If your users require more bandwidth than the service provider can offer, then you should investigate using a leased line or Frame Relay circuit instead of a cable modem. Another concern with shared media such as cable modem systems is how to offer QoS for voice, video, and other delay-sensitive applications. If the service provider doesn’t have any good solutions for this problem, consider using a different WAN technology if your users rely on these delay-sensitive applications. Digital Subscriber Line Remote Access Another technology for remote access is digital subscriber line (DSL). Telephone companies offer DSL for high-speed data traffic over ordinary telephone wires. With DSL, a home office or small office can connect a DSL modem (or DSL router with a built-in modem) to a phone line and use this connection to reach a central-site intranet and/or the Internet. DSL operates over existing telephone lines between a telephone switching station and a home or office. Speeds depend on the type of DSL service and many physical layer factors, including the length of the circuit between the home or branch office and the telephone company, the wire gauge of the cable, the presence of bridged taps, and the presence of crosstalk or noise on the cable. DSL supports asymmetric and symmetric communication. With asymmetric DSL (ADSL), traffic can move downstream from the provider and upstream from the end user at different speeds. An ADSL circuit has three channels: A high-speed downstream channel with speeds ranging from 1.544 to 12 Mbps A medium-speed duplex channel with speeds ranging from 16 to 640 kbps A plain old telephone service (POTS) 64-kbps channel for voice With symmetric DSL (SDSL), traffic in either direction travels at the same speed, up to 1.544 Mbps. Unlike ADSL, SDSL does not allow POTS to run on the same line as data (although VoIP is feasible with SDSL). SDSL is a viable business solution that is a good choice for a small enterprise or branch office that hosts web or other services that send data as well as receive data. Other DSL Implementations DSL is sometimes called xDSL because of the many types of DSL technologies. In addition to ADSL and SDSL, providers in your area may support the following services: ISDN DSL (IDSL): A cross between ISDN and DSL. As with ISDN, IDSL uses a single wire pair to transmit data at 128 kbps in both directions and at distances of up to 15,000 to 18,000 feet (about 4600 to 5500 m). Unlike ISDN, IDSL does not use a signaling channel (a D channel). High-bit-rate DSL (HDSL): A mature technology that provides symmetric communications up to 1.544 Mbps over two wire pairs or 2.048 Mbps over three wire pairs. HDSL is a cost-effective alternative to a T1 or E1 circuit. HDSL is less expensive than T1 or E1 partly because it can run on poorer-quality lines without requiring any line conditioning. HDSL’s range is 12,000 to 15,000 feet (about 3700 to 4600 m). Providers can extend the range with signal repeaters. HDSL does not support access to the PSTN. HDSL-2: Provides symmetric communications of up to 1.544 Mbps, but it is different from HDSL in that it uses a single wire pair. Engineers developed HDSL-2 to serve as a standard by which different vendors’ equipment could interoperate. The biggest advantage of HDSL-2 is that it is designed not to interfere with other services, in particular ADSL, which is the most popular type of DSL. A disadvantage with HDSL-2 is that it supports only a full rate, offering services only at 1.544 Mbps. G.SHDSL: Combines the best of SDSL and HDSL-2. The standard defines multiple rates, as SDSL does, but provides spectral compatibility with HDSL-2. Very-high-bit-rate DSL (VDSL): Provides data and PSTN service on a single twisted pair of wires at speeds up to 52 Mbps downstream and 16 Mbps upstream. VDSL is reserved for users in close proximity to a central office. Long-Reach Ethernet (LRE) uses VDSL technology. PPP and ADSL ADSL designs use two popular PPP implementations: PPP over ATM (PPPoA) and PPP over Ethernet (PPPoE). In a PPPoA architecture, the customer premises equipment (CPE) acts as an Ethernet-to-WAN router and a PPP session is established between the CPE and a Layer 3 access concentrator in the service provider’s network. In a PPPoE architecture, the CPE acts as an Ethernet-to-WAN bridge. The client initiates a PPP session by encapsulating PPP frames into MAC frames and then bridging the frames over ATM/DSL to a gateway router at the service provider. From this point, the PPP sessions can be established, authenticated, and addressed. The client receives its IP address from the service provider, using PPP negotiation. A PPPoA implementation involves configuring the CPE with PPP authentication information (login and password). This is the main advantage of this architecture over pure bridging implementations, as it provides per-session authentication, authorization, and accounting. Another advantage with PPPoA is that it uses ATM end to end. Therefore, the provider might find it easier to put a subscriber into a specific traffic class. Selecting Remote-Access Devices for an Enterprise Network Design The previous sections discussed remote-access technologies. This section covers selecting devices to implement those technologies. Selecting remote-access devices for an enterprise network design involves choosing devices for remote users and for a central site. Remote users include telecommuters, users in remote offices, and mobile users. The central site could be the corporate headquarters of a company, the core network of a university that has branch campuses, a medical facility that connects doctors’ offices, and so on. Selecting Devices for Remote Users The most important consideration when selecting a cable or DSL modem is that the modem must interoperate with the provider’s equipment. In some cases, the provider supplies the modem to avoid problems. In other cases, the provider supplies a list of products or standards that must be supported in a modem purchased by the end user, such as the Data Over Cable Service Interface Specification (DOCSIS) for cable modems in the United States. Criteria for selecting a router for remote sites include the following: Security and VPN features Support for NAT Reliability Cost Ease of configuration and management Support for one or more high-speed Ethernet interfaces Support for the router to act as a wireless access point (if desired) Support for features that reduce line utilization, such as snapshot routing and compression Support for channel aggregation Support for QoS features to support VoIP or other applications with specific QoS requirements Selecting Devices for the Central Site The central site connects remote users who access the corporate network with cable modems, DSL modems, and VPN software. With a VPN, users gain network access through a service provider’s local network and send their data over encrypted tunnels to a VPN firewall or concentrator at the central site. Criteria for selecting central-site devices to support remote users include the criteria listed previously for a remote-site router as well as additional criteria related to VPN functionality. Both routers and firewalls at the central site can act as the termination point for VPN tunnels. A generic router can become overwhelmed if a network supports many tunnels, however. If you expect the peak number of simultaneous users to reach 100, a dedicated firewall or VPN concentrator should be deployed. (A VPN concentrator is a standalone hardware platform that aggregates a large volume of simultaneous VPN connections.) Generally, enterprises place the VPN firewall between a router that has access to the VPN and a router that forwards traffic into the campus network. Hence, the firewall should support at least two Ethernet interfaces of the flavor used in this module of the network design (Fast Ethernet, Gigabit Ethernet, and so on). When selecting a VPN firewall, make sure it will interoperate with the VPN client software on the users’ systems. Cisco, Microsoft, and other vendors provide client software. Also pay attention to the number of simultaneous tunnels the firewall supports and the amount of traffic it can forward. The firewall should have a fast processor, high-speed RAM, and support for redundant power supplies and hardware-assisted encryption. It should also support the following software features: Tunneling protocols, including IPsec, PPTP, and L2TP Encryption algorithms, including 56-bit DES, 168-bit Triple DES, Microsoft Encryption (MPPE), 40- and 128-bit RC4, and 128-, 192-, and 256-bit AES Authentication algorithms, including Message Digest 5 (MD5), Secure Hash Algorithm (SHA-1), Hashed Message Authentication Coding (HMAC) with MD5, and HMAC with SHA-1 Network system protocols, such as DNS, DHCP, RADIUS, Kerberos, and LDAP Routing protocols Support for certificate authorities, such as Entrust, VeriSign, and Microsoft Network management using Secure Shell (SSH) or HTTP with Secure Sockets Layer (SSL) WAN Technologies This section covers WAN technologies that are typical options for connecting geographically dispersed sites in an enterprise network design. The section covers the most common and established WAN technologies, but the reader should also research new technologies as they gain industry acceptance. Wireless WAN technologies, for example, are not covered in this book, but are expected to expand the options available for WAN (and remote-access) networks in the future. Recent changes in the WAN industry continue an evolution that began in the mid-1990s when the bandwidth and QoS requirements of corporations changed significantly due to new applications and expanded interconnectivity goals. As the need for WAN bandwidth accelerated, telephone companies upgraded their internal networks to use SONET and ATM technologies, and started offering new services to their customers. Today, an enterprise network architect has many options for WAN connectivity. The objective of this section is to present some of these options to help you select the right technologies for your customer. Systems for Provisioning WAN Bandwidth Regardless of the WAN technology you select, one critical network design step you must complete is selecting the amount of capacity that the WAN must provide. You need to consider capacity requirements for today and for the next 2 to 3 years. Selecting the right amount of capacity is often called provisioning. Provisioning requires an analysis of traffic flows, as described in Chapter 4, and an analysis of scalability goals, as described in Chapter 2, “Analyzing Technical Goals and Tradeoffs.” This section provides an overview of the bandwidth capacities that are available to handle traffic flows of different sizes. WAN bandwidth for copper cabling is provisioned in North America and many other parts of the world using the North American Digital Hierarchy, which is shown in Table 11-1. A channel in the hierarchy is called a digital signal (DS). Digital signals are multiplexed together to form high-speed WAN circuits. DS-1 and DS-3 are the most commonly used capacities. Table 11-1 North America Digital Hierarchy Signal Capacity Number of DS-0s Colloquial Name DS-0 64 kbps 1 Channel DS-1 1.544 Mbps 24 T1 DS-1C 3.152 Mbps 48 T1C DS-2 6.312 Mbps 96 T2 DS-3 44.736 Mbps 672 T3 DS-4 274.176 Mbps 4032 T4 DS-5 400.352 Mbps 5760 T5 In Europe, the Committee of European Postal and Telephone (CEPT) has defined a hierarchy called the E system, which is shown in Table 11-2. Table 11-2 Committee of European Postal and Telephone (CEPT) Hierarchy Signal Capacity Number of E1s E0 64 kbps N/A E1 2.048 Mbps 1 E2 8.448 Mbps 4 E3 34.368 Mbps 16 E4 139.264 Mbps 64 E5 565.148 Mbps 256 The Synchronous Digital Hierarchy (SDH) is an international standard for data transmission over fiber-optic cables. SDH defines a standard rate of transmission of 51.84 Mbps, which is also called Synchronous Transport Signal level 1 (STS-1). Higher rates of transmission are a multiple of the basic STS-1 rate. The STS rates are the same as the SONET Optical Carrier (OC) levels, which are shown in Table 11-3. Table 11-3 Synchronous Digital Hierarchy (SDH) STS Rate OC Level Speed STS-1 OC-1 51.84 Mbps STS-3 OC-3 155.52 Mbps STS-12 OC-12 622.08 Mbps STS-24 OC-24 1.244 Gbps STS-48 OC-48 2.488 Gbps STS-96 OC-96 4.976 Gbps STS-192 OC-192 9.952 Gbps Leased Lines The first WAN technology this chapter covers is the leased-line service offered by many telephone companies and other carriers. A leased line is a dedicated circuit that a customer leases from a carrier for a predetermined amount of time, usually for months or years. The line is dedicated to traffic for that customer and is used in a point-to-point topology between two sites on the customer’s enterprise network. Speeds range from 64 kbps (DS-0) to 45 Mbps (DS-3). Enterprises use leased lines for both voice and data traffic. Data traffic is typically encapsulated in a standard protocol such as PPP or HDLC. Dedicated leased lines have the advantage that they are a mature and proven technology. Historically, they had the disadvantage that they were expensive, especially in some parts of Europe and Asia. As carriers upgrade their internal networks with more capacity, costs are dropping, however. Leased lines also have the advantage over most other services that they are dedicated to a single customer. The customer does not share the capacity with anyone. Most newer systems, such as cable modems, DSL, ATM, and Frame Relay, are based on a shared network inside the provider’s network. Leased lines tend to be overlooked as a potential WAN solution because they are not a new technology. In some situations, however, they are the best option for simple point-to-point links. Leased lines are a good choice if the topology is truly point to point (and not likely to become point to multipoint in the near future), the pricing offered by the local carrier is attractive, and applications do not require advanced QoS features that would be difficult to implement in a simple leased-line network. Synchronous Optical Network The next WAN technology this chapter covers is Synchronous Optical Network (SONET), which is a physical layer specification for high-speed synchronous transmission of packets or cells over fiber-optic cabling. SONET was proposed by Bellcore in the mid-1980s and is now an international standard. SONET uses the SDH system with STS-1 as its basic building block. Service providers and carriers are making wide use of SONET in their internal networks. SONET is also gaining popularity within private networks to connect remote sites in a WAN or metropolitan-area network (MAN). Both ATM and packet-based networks can be based on SONET. With packet transmission, SONET networks usually use PPP at the data link layer and IP at the network layer. Packet over SONET (POS) is expected to become quite popular as Internet and intranet traffic grows, and as new applications, such as digital video, demand the high speed, low latency, and low error rates that SONET can offer. One of the main goals of SONET and SDH was to define higher speeds than the ones used by the North American Digital Hierarchy and the European E system, and to alleviate problems caused by incompatibilities in those systems. The creators of SONET and SDH defined high-speed capacities, starting with the 51.84-Mbps STS-1, that were approved by both North American and European standards bodies. Another goal of SONET was to support more efficient multiplexing and demultiplexing of individual signals. With SONET (SDH), it is easy to isolate one channel from a multiplexed circuit (for example, one phone call from a trunk line that carries numerous phone calls). With plesiochronous systems, such as the North American Digital Hierarchy and the European E system, isolating one channel is more difficult. Although isolating a 64-kbps channel from a DS-1 circuit is straightforward, isolating a 64-kbps channel from a DS-3 trunk requires demultiplexing to the DS-1 level first. Note The North American Digital Hierarchy and European E system are called plesiochronous systems. Plesio means “almost” in Greek. A truly synchronous system, such as SONET, supports more efficient multiplexing and demultiplexing than a plesiochronous (“almost synchronous”) system. The SONET specification defines a four-layer protocol stack. The four layers have the following functions: Photonic layer: Specifies the physical characteristics of the optical equipment Section layer: Specifies the frame format and the conversion of frames to optical signals Line layer: Specifies synchronization and multiplexing onto SONET frames Path layer: Specifies end-to-end transport Terminating multiplexers (implemented in switches or routers) provide user access to the SONET network. Terminating multiplexers turn electrical interfaces into optical signals and multiplex multiple payloads into the STS-N signals required for optical transport. A SONET network is usually connected in a ring topology using two self-healing fiber paths. A path provides full-duplex communication and consists of a pair of fiber strands. One path acts as the full-time working transmission facility. The other path acts as a backup protection pair, remaining idle while the working path passes data. If an interruption occurs on the working path, data is automatically rerouted to the backup path within milliseconds. If both the working and protected pairs are cut, the ring wraps, and communication can still survive. Figure 11-3 shows a typical SONET network. Figure 11-3 Redundant SONET Ring Frame Relay Frame Relay is a high-performance WAN protocol that operates at the physical and data link layers of the OSI reference model. Frame Relay emerged in the early 1990s as an enhancement to more complex packet-switched technologies, such as X.25. Whereas X.25 is optimized for excellent reliability on physical circuits with a high error rate, Frame Relay was developed with the assumption that facilities are no longer as error prone as they once were. This assumption allows Frame Relay to be more efficient and easier to implement than X.25. Frame Relay offers a cost-effective method for connecting remote sites, typically at speeds from 64 kbps to 1.544 Mbps (a few providers offer DS-3 speeds for Frame Relay). Frame Relay offers more granularity in the selection of bandwidth assignments than leased lines, and also includes features for dynamic bandwidth allocation and congestion control to support bursty traffic flows. Frame Relay has become a popular replacement for both X.25 and leased-line networks because of its efficiency, flexible bandwidth support, and low latency. Frame Relay provides a connection-oriented data link layer service. A pair of devices communicate over a Frame Relay virtual circuit, which is a logical connection created between two data terminal equipment (DTE) devices across a Frame Relay packet-switched network (PSN). Routers, for example, act as DTE devices and set up a virtual circuit for the purpose of transferring data. A virtual circuit can pass through any number of intermediate data circuit-terminating equipment (DCE) devices (switches) located within the Frame Relay PSN. Frame Relay virtual circuits fall into two categories: Switched virtual circuits (SVC): Temporary connections for supporting occasional data transfer Permanent virtual circuits (PVC): Permanently configured circuits that are established in advance of any data transfer An SVC requires call setup and termination whenever there is data to send. With PVCs, the circuit is established by the provider, which means that troubleshooting is simplified. Most networks use PVCs rather than SVCs. A Frame Relay virtual circuit is identified by a 10-bit data-link connection identifier (DLCI). DLCIs are assigned by a Frame Relay service provider (for example, a telephone company). Frame Relay DLCIs have local significance. Two DTE devices connected by a virtual circuit might use a different DLCI value to refer to the same circuit. Although you can think of the DLCI as an identifier for the entire virtual circuit, practically speaking, the DLCI refers to the connection from a DTE router to the DCE Frame Relay switch at the provider’s site. The DLCI might be different for the DTE-DCE connection at each end of the virtual circuit. Frame Relay Hub-and-Spoke Topologies and Subinterfaces Frame Relay networks are often designed in a hub-and-spoke topology, such as the topology shown in Figure 11-4. A central-site router in this topology can have many logical connections to remote sites with only one physical connection to the WAN, thus simplifying installation and management. One problem with a hub-and-spoke topology is that split horizon can limit routing. With split horizon, distance-vector routing protocols do not repeat information out the interface it was received on. This means that devices on network 300 in Figure 11-4 cannot learn about devices on network 400, and vice versa, because the central-site router only advertises network 100 when it sends its routing table out the WAN interface. Figure 11-4 Frame Relay Hub-and-Spoke Topology Some routing protocols support disabling the split-horizon function. Split horizon is automatically disabled in a Frame Relay hub-and-spoke topology when the Cisco Interior Gateway Routing Protocol (IGRP) and Enhanced IGRP (EIGRP) are used. Split horizon can be disabled for the IP Routing Information Protocol (RIP). However, some older protocols, such as Novell’s RIP and Service Advertising Protocol (SAP) and AppleTalk’s Routing Table Maintenance Protocol (RTMP), require split horizon. A solution to the split-horizon problem is to use a full-mesh design with physical circuits between each site. The drawback to this approach is cost. For example, in the network portrayed in Figure 11-4, a full mesh would comprise 15 circuits instead of 6. Because each circuit costs money, this would not be an optimum solution. The other alternative is to use subinterfaces. A subinterface is a logical interface that is associated with a physical interface. In Figure 11-4, the central-site router could have five point-to-point subinterfaces defined, each communicating with one of the remote sites. With this solution, the central-site router applies the split-horizon rule based on logical subinterfaces, instead of the physical interface, and includes remote sites in the routing updates it sends out the WAN interface. One downside of using subinterfaces is that router configurations are slightly more complex. Another disadvantage is that more network numbers are required. In Figure 11-4, the entire WAN “cloud” is network 200 when subinterfaces are not used. When subinterfaces are used, each circuit within the cloud requires a network number. Frame Relay Congestion Control Mechanisms Although Frame Relay devices generally do not use all of their available bandwidth all of the time, a Frame Relay device does have the capability to transmit data at its physical access rate for extended periods of time. For this reason, the Frame Relay standard includes congestion control mechanisms to ensure fair bandwidth allocation, and feedback mechanisms to inform user devices about the availability of network bandwidth. The Frame Relay packet header includes a discard eligibility (DE) bit used to identify less-important traffic that can be dropped when congestion occurs. In addition, Frame Relay includes two congestion-notification schemes: Forward explicit congestion notification (FECN): Informs the receiver of a frame that the frame traversed a path that is experiencing congestion Backward explicit congestion notification (BECN): Informs a sender that congestion exists in the path that the sender is using Service providers are able to keep prices for their Frame Relay service reasonably low because of the bursty nature of the traffic typically offered to Frame Relay networks. The service provider generally oversubscribes its internal network, making the assumption that not all virtual circuits use all of their available bandwidth all of the time. Switches within the service provider’s network can use the FECN and BECN mechanisms to notify end-system devices of any congestion problems. The resulting behavior at the end systems depends on which protocol and which implementation of the protocol is being used. Note Congestion control in a Transmission Control Protocol (TCP) application is usually independent of the FECN and BECN mechanisms. Upon packet loss, TCP decreases its transmit window size, effectively slowing its transmission rate. It then gradually increases the window size until congestion occurs again. Frame Relay Traffic Control When you subscribe to a Frame Relay service with a provider, you establish an access rate and order the appropriate line service and interface for the router to support this access rate. The access rate is the maximum number of bits per second that a DTE, such as a router, can transmit into the Frame Relay network. In addition, many service providers let you specify other parameters related to bandwidth usage, including a committed information rate (CIR), a committed burst (Bc) size, and an excess burst (Be) size. The CIR specifies that as long as the data input by a device to the Frame Relay network is below or equal to the CIR, then the network will continue to forward data for that virtual circuit. If the data input rate exceeds the CIR, there is no longer any guarantee. The network might discard traffic beyond the CIR limit, although if there is sufficient bandwidth it might continue to forward traffic. CIR is measured over a time interval T. CIR is expressed in bits per second. The relationship between CIR and Bc is as follows: CIR = Bc/T CIR = Bc/T Bc is the maximum number of bits that the network is committed to transfer for a virtual circuit during the T timeframe. Bc is expressed in bits. The Be parameter is the number of bits in excess of Bc that a virtual circuit can send during the T time period. The network sends these bits if there is no congestion, but the first Frame Relay switch can mark the frames as eligible to be discarded (DE). Be is expressed in bits. Bc, Be, T, and CIR are defined per DLCI. The access rate is valid per each user-network interface. For Bc, Be, and CIR, incoming and outgoing values can be distinguished. If the connection is symmetrical, the values in both directions are the same. For PVCs, the incoming and outgoing Bc, Be, and CIR are defined at subscription time. When planning a Frame Relay network, if the service provider supports CIR, Bc, and Be, you must determine the values to use. This decision is based on the pricing model of the service provider and the analysis of traffic volume and flow that you did as part of the requirements-analysis phase of the network design process. The access rate and CIR of the Frame Relay connection at the hub of a hub-and-spoke topology should be more than the sum of the CIRs at the remote sites and less than or equal to the sum of the burst capacities of the remote sites. Many service providers don’t let you specify Be or Bc. Some providers don’t let you specify CIR either. To keep things simple, some providers base their Frame Relay offerings simply on the physical access rate. These carriers often offer a zero CIR, which means that they make only a best effort to send your traffic. The advantage of a zero CIR is that it is inexpensive. Although it is recommended that the CIR and other parameters be based on a careful analysis of traffic, keep in mind that the CIR and other parameters are based on a probabilistic service. Although some carriers market the CIR as a true guarantee, carriers actually oversubscribe their networks and cannot guarantee that their customers will correctly react to congestion feedback mechanisms, which means that no customer’s CIR or Bc is truly a guarantee. Frame Relay/ATM Interworking Some service providers offer WAN solutions that use both ATM and Frame Relay technologies. The term Frame Relay/ATM interworking is used to describe the protocols and processes for connecting ATM and Frame Relay WANs. Interworking can be implemented in two different ways, depending on the goals of the network design: Network interworking: Two or more Frame Relay networks are connected via an ATM core network. This is a common topology used by service providers who use ATM for their internal networks and offer Frame Relay to their customers. Service interworking: An ATM network connects to a Frame Relay network. This topology is less common, but might be used during a transition from Frame Relay to ATM or vice versa. ATM Despite the complexity of ATM, ATM is a good choice for WAN backbone networks for customers with accelerating bandwidth requirements and applications with advanced QoS requirements. ATM supports very high bandwidth requirements. When used on copper cabling, ATM can run at T3 or higher speeds. When used on fiber-optic cabling, ATM theoretically supports speeds up to OC-192 (9.952 Gbps) and beyond, especially if technologies such as wavelength-division multiplexing (WDM) are used. ATM facilitates the efficient sharing of bandwidth among applications with various QoS requirements. Applications can theoretically share bandwidth more fairly in a cell-based system compared to a frame-based system, because in a frame-based system, large frames can monopolize bandwidth. In addition, with a connection-oriented technology such as ATM, an application can specify upon connection establishment the QoS it requires, including peak and minimum cell rates, a cell-loss ratio, and a cell-transfer delay. Ethernet over ATM A disadvantage with ATM is that ATM interfaces for routers and switches are expensive. Some service providers allow the customer to use an Ethernet interface to access the provider’s ATM WAN. This service is often called Ethernet over ATM. In some cases, the provider places an Ethernet-to-ATM converter at the customer’s premises. In other cases, the customer doesn’t need any extra equipment. The conversion happens inside the provider’s network. Ethernet over ATM is gaining popularity with service providers. Many providers already have large ATM WANs. Allowing their customers to connect to the ATM WAN using Ethernet benefits both the provider and the customer. The provider can offer a new service without making major changes to its network. The customer gets the benefit of a lower-cost entry into the network through the use of an Ethernet interface. Note Metro Ethernet, which is discussed in the next section, can be implemented using Ethernet over ATM technology. Metro Ethernet can use a variety of transport protocols, including ATM, SONET, WDM, and MPLS. An Ethernet over ATM solution combines the advantages of Ethernet with those of ATM. Ethernet advantages include low cost, simplicity, ease of maintenance, interoperability with existing equipment, high speeds, and ease of upgrading to even faster speeds. ATM advantages include high speeds, reliability, and support for categorizing applications into different classes based on the service and QoS that the applications require. Separating applications into different service classes benefits multipurpose networks where high-bandwidth applications are mixed with delay-sensitive applications, such as voice and video. ATM supports a set of parameters that describe the traffic presented to the ATM network. ATM also supports a set of traffic-control mechanisms that the network can use to meet service requirements. The network can implement connection admission control and resource allocation differently for different service classes. A service provider can map Ethernet VLANs to ATM virtual circuits and set up service classes for particular VLANs or applications. Although many users of Ethernet over ATM won’t opt for the complexity and extra cost associated with service classes, customers with specialized applications can benefit from service classes. To reduce complexity, some service providers have the capability of mapping QoS parameters more familiar to LAN engineers (such as IEEE 802.1p QoS parameters) to the more complicated ATM QoS parameters. Metro Ethernet Chapter 10, “Selecting Technologies and Devices for Campus Networks,” briefly covered Metro Ethernet. This chapter covers it in more detail. Metro Ethernet is a service offered by providers and carriers that traditionally had only classic WAN offerings, such as dialup, T1, and Frame Relay. Metro Ethernet blends the capabilities and behavior of WAN technologies with those of Ethernet. Carriers offer Metro Ethernet to customers who are looking for a cost-effective method to interconnect campus networks and to access the Internet. One of the many advantages of Metro Ethernet is that the customer can use a standard 10/100-Mbps Ethernet interface, or a Gigabit or 10-Gbps interface, to access the service provider’s network. The customer can set up virtual circuits to reach other sites and to reach an ISP. Metro Ethernet supports a copper or fiber-optic interface, but uses fiber-optic cabling inside the provider’s network. It can use a variety of transport protocols, including SONET, ATM, dense-mode wavelength-division multiplexing (DWDM), and Multiprotocol Label Switching (MPLS). Metro Ethernet service providers allow subscribers to add bandwidth as needed. Compared to adding WAN bandwidth, adding bandwidth to a Metro Ethernet service can happen extremely quickly, sometimes as quickly as a few minutes or hours. Metro Ethernet providers offer a wide range of bandwidth options. In addition to the standard Ethernet speeds, many providers offer a 1-Mbps service and allow customers to add bandwidth in 1-Mbps increments. Some Metro Ethernet implementations use what is called an Ethernet virtual circuit (EVC). An EVC is similar to a Frame Relay PVC. An EVC is an association of two or more User-Network Interfaces (UNI), where a UNI is a standard Ethernet interface at a customer’s site. Three basic service types use EVCs: Ethernet line service (E-line service) provides a point-to-point EVC between two UNIs. Ethernet LAN service (E-LAN service) provides multipoint connectivity. It can connect two or more UNIs. It is also known as Virtual Private LAN Services (VPLS) or Transparent LAN Services (TLS). Ethernet tree service (E-Tree service) provides point-to-multipoint connectivity. Metro Ethernet is a blending of WAN and LAN technologies. It supports virtual circuits like a WAN and also provides support for a committed information rate (CIR), committed burst size, peak information rate (PIR), and peak burst size, like a WAN often does. In a similar fashion to a LAN, Metro Ethernet also supports VLANs, 802.1X port authentication, and the Spanning Tree Protocol. Metro Ethernet also supports many QoS features to optimize the forwarding of latency-sensitive traffic. Cisco routers and switches that implement Metro Ethernet, for example, support advanced queuing techniques, traffic shaping, and Random Early Detection (RED). Metro Ethernet is used to connect intranet and extranet sites. ISPs are also starting to use Metro Ethernet. The ISP typically multiplexes multiple subscribers over a high-speed Ethernet UNI. An ISP’s customer uses an EVC to connect to the ISP’s local point of presence (POP). The most common method for using Metro Ethernet for dedicated Internet access is to use the E-line service. If the customer wants to use the same UNI to support both Internet access and an intranet or extranet connection, this is also possible with the use of separate EVCs. A customer can also use multiple EVCs to access multiple ISPs for redundancy, thus multihoming the Internet connection. For more information about Metro Ethernet, see the Metro Ethernet Forum’s website at http://www.metroethernetforum.org. Selecting Routers for an Enterprise WAN Design An enterprise WAN connects high-performance routers. Chapter 10 covered typical criteria for the selection of internetworking devices in general. The criteria in Chapter 10 (such as the number of ports, processing speed, media and technologies supported, mean time to repair [MTTR], mean time between failure [MTBF], and so on) apply to enterprise and campus devices. In addition, enterprise routers should offer high throughput, high availability, and advanced features to optimize the utilization of expensive WAN circuits. Routers for an enterprise WAN network design should be selected carefully to avoid performance problems caused by an underpowered router that aggregates traffic from many networks. When provisioning enterprise routers, keep in mind that in a hierarchical design, such as the designs discussed in Chapter 5, “Designing a Network Topology,” a concentration of traffic from lower layers of the hierarchy aggregates at routers at the top of the hierarchy. This means you need to plan for adequate performance on the routers at the upper layers of the hierarchy. Based on an analysis of traffic flow, you should select routers that provide the necessary WAN interfaces to support bandwidth requirements, provide an appropriate packets-per-second level, and have adequate memory and processing power to forward data and handle routing protocols. In addition, you should select routers that provide optimization features such as advanced switching and queuing techniques, traffic shaping, RED, and express forwarding. Chapter 13, “Optimizing Your Network Design,” discusses router optimization techniques in more detail. Selecting a WAN Service Provider In addition to selecting technologies and devices for a WAN network design, you must also select service providers or carriers. One obvious criterion for selecting a service provider is the cost of services. Using cost as the main selection criterion, however, can make the choice difficult because providers offer distinct services and define terms and conditions differently. Also, for many network designs, cost is not the main criterion. The following criteria are often more important than cost: The extent of services and technologies offered by the provider The geographical areas covered by the provider Reliability and performance characteristics of the provider’s internal network The level of security offered by the provider The level of technical support offered by the provider The likelihood that the provider will continue to stay in business The provider’s willingness to work with you to meet your needs When selecting a service provider, try to investigate the structure, security, and reliability of the provider’s internal network to help you predict the reliability of your WAN, which depends on the provider’s network. Learning about the provider’s network can be challenging because providers generally do not share detailed information about their internal networks, but nonetheless, you should talk to systems engineers and current customers of the provider to try to determine the following characteristics of the provider’s network: The physical routing of network links Redundancy within the network The extent to which the provider relies on other providers for redundancy The level of oversubscription on the network Bandwidth allocation mechanisms used to guarantee application QoS requirements The types of switches that are used and the bandwidth-allocation and -optimization features available on the switches The frequency and typical causes of network outages Security methods used to protect the network from intruders Security methods used to protect the privacy of a customer’s data Disaster recovery plans in case of earthquakes, fires, hurricanes, asteroids that collide with satellites, or other natural or man-made disasters Most service providers can furnish customers with a service-level agreement (SLA) that defines the specific terms of the service and how the service will be measured and guaranteed. Some SLAs address only network availability, which is not sufficient for many applications. An SLA should also address application performance, including latency and throughput. An SLA should also specify the level of technical support that can be expected. Generally you should get a contract for 24-hour, 7-day support for a mission-critical WAN. In addition to specifying specific terms and conditions for support and service in an SLA, when negotiating a contract with a provider, try to get answers to the following support-related questions: What is the experience level of the installation and support staff? Does the support staff have experience with your particular protocols and applications? If necessary, can you request a dedicated single-point-of-contact support representative who will take responsibility for resolving all problems and questions? Does the provider adhere to industry standards for service quality such as the IT Service Management (ITSM) framework? How difficult is it for a typical customer to provision and price new services? Does the provider offer a customer training program on services and pricing structures? Example of a WAN Design This section presents a WAN design that was developed using some of the design steps in this book. The section describes an actual network design that was developed for Klamath Paper Products. The name of the company has been changed. The example is based on a real network design, but some of the facts have been changed to preserve the privacy of the company and protect the security of the company’s network, and to make it possible to present a simple and easy-to-understand example. Background Information for the WAN Design Project Klamath Paper Products, Inc. manufactures paper and packaging products, including office paper, newsprint, cartons, and corrugated boxes. They also manufacture wood pulp and chemicals used in the manufacturing of pulp and paper. Klamath Paper Products (which will be called Klamath from now on) has approximately 15 sites in the western United States. Headquarters are in Portland, Oregon. Klamath employs around 1500 people and has customers all over the world, with a large customer base in Asia. Klamath is concerned about reduced profit margins caused by fewer sales in Asia in recent years and the scarcity of lumber used to manufacture Klamath’s products. Klamath recently completed a strategic re-engineering project that identified ways to increase profits by improving the efficiency of internal processes and making more use of recycled postconsumer paper in the production of new paper products. As a result of the re-engineering project, the Conservation Initiative Task Force at Klamath plans to roll out an ongoing distance-learning program that will train all employees on ways to conserve raw materials, use recycled materials, and work more efficiently. Executive management considers the new training program vital to the continued success of Klamath, and approved funding to equip the training rooms at most sites with digital videoconferencing systems. After Klamath installs the videoconferencing system and the WAN to support it, there are plans to offer classes to other companies in the wood and paper manufacturing industries. Klamath has recognized a business opportunity associated with the federal government’s plan to help pay for workers in the timber industry to attend classes in modern methods for sustainable forest management and environmentally sound lumber and paper production. Business and Technical Goals Klamath’s main business goals for the WAN design project are as follows: Increase profits by implementing a WAN that will support the goals of the Conservation Initiative Task Force, in particular the new distance-learning program. Improve the performance of the existing WAN to support more efficient operations. Contain the rising costs associated with operating the existing WAN. Provide a network that will let employees more easily share ideas for further improving efficiency and increasing the use of recycled materials. Provide a new source of revenue from the timber-industry distance-learning program. Engineers in the telecommunications and networking departments added the following technical goals: Update the capacity and QoS capabilities of the existing WAN, which in its current state cannot support the new videoconferencing system. Design a network that uses currently available technologies from the WAN service providers in the region. Provide a network that offers a response time of 1/10th of a second or less for interactive applications. Provide a network that is available 99.98 percent of the time and offers an MTBF of 4000 hours (about 5.5 months) and an MTTR of 1 hour (with a low standard deviation from these average numbers). Improve the manageability of the network by simplifying the topology, which is currently a complex mesh of voice and data circuits. Design a network that will scale as new high-bandwidth applications are added in the future. Design a network that can support voice traffic in the future. Network Applications The new distance-learning application will use a two-way compressed digital video service based on the H.323 standards for videoconferencing. Each site with a training room will be equipped with a high-end digital video camera. Both synchronous and asynchronous distance learning will be supported. With synchronous distance learning, remote students attend classes taught by instructors at headquarters or other sites in “real time.” With asynchronous distance learning, students can check out a video class from a video server at headquarters and have the video transmitted to their site. Other applications in use at Klamath include the following: The manufacturing support system runs on a mainframe in Portland. The system keeps track of manufacturing schedules and work orders. Members of the various manufacturing departments access the system from their PCs. This system is considered critical to Klamath’s mission to deliver products by the dates that were promised to customers. The financial modeling system runs on UNIX and makes use of an Oracle database that resides on UNIX servers in Portland. Financial analysts use applications on their PCs to access this system. The sales order-entry and tracking system runs on Windows servers. Sales and marketing personnel use their PCs to access this system. The graphics production system runs on Macintosh computers and uses Apple Filing Protocol (AFP) servers. Most users also deploy a standard set of desktop applications that includes email, calendaring, web browsing, file sharing, and printing. These applications use TCP/IP and NetBIOS. User Communities Table 11-4 shows a summarized view of the user communities at Klamath. Table 11-4 Klamath User Communities User Community Name Size of Community (Number of Users) Location(s) of Community Application(s) Used by Community Headquarters 350 Portland All Office paper manufacturing and sales 200 Seattle All Newsprint, cartons, and boxes manufacturing and sales 250 Spokane All Wood pulp and chemicals manufacturing and sales 150 Boise All Other smaller manufacturing and sales offices 25–75 Western United States All Data Stores (Servers) Table 11-5 shows the data stores that were identified at Klamath. Table 11-5 Klamath Data Stores Data Store Location Application(s) Used by User Community (or Communities) Mainframe Portland Manufacturing support system All manufacturing sites UNIX servers Two in Portland Financial modeling Finance departments in Portland, Seattle, Spokane, and Boise Windows servers Portland, Seattle, Spokane, Boise Sales order-entry and tracking system All sales sites AFP servers Portland, Seattle, Spokane, Boise Graphics production Graphics departments in Portland, Seattle, Spokane, and Boise Video server (new) Portland Distance learning All Current Network The current WAN consists of dedicated 64-kbps data circuits that connect the 15 sites in a partial-mesh topology. Voice traffic is carried on separate 64-kbps circuits. A WAN service provider leases the 64-kbps lines to Klamath and also provides Internet access via a T1 circuit that connects a router at the Portland headquarters to a router at the provider’s site. The router at the Portland headquarters acts as a packet-filtering firewall. The core of the data network is a full mesh of 64-kbps circuits that connects the major sites. A router at each site connects Ethernet LANs to the WAN, as shown in Figure 11-5. Figure 11-5 Existing Core WAN at Klamath Traffic Characteristics of the Existing WAN As Klamath has grown over the years, network performance has degraded. Users report that the network is slow, especially during the busiest hour between 10 a.m. and 11 a.m. Users of the manufacturing support system report that it sometimes takes 2 or 3 minutes for their screens to unlock after they enter information. Users of the sales order-entry system and the financial modeling applications also report slow response times. A WAN protocol analyzer was used at each of the major sites to measure current bandwidth usage on the 64-kbps data circuits. It was determined that every circuit in Portland was approaching saturation, with an average utilization of 80 percent in a 10-minute window. WAN circuits between Seattle and Spokane, Spokane and Boise, and Boise and Seattle were also heavily used, with an average utilization in a 10-minute window of 70 percent. The protocol analyzer was also used to study protocol and traffic characteristics. The following conclusions were made: No single protocol was causing any serious problems. Although there were quite a few retransmissions, no applications appeared to retransmit too quickly. Applications appeared to have been optimized to use large frame sizes and large window sizes. Broadcast traffic accounted for about 5 percent of the network utilization and appeared to be normal routing and service-advertising packets. The average error rate for the circuits was one cyclic redundancy check (CRC) error per two million bytes of data (which is acceptable). The status of the routers in the core of the network was also checked. The following Cisco IOS commands, which were discussed in Chapter 3, “Characterizing the Existing Internetwork,” were used to check the routers: The show processes command indicated no problems with CPU overutilization. The show buffers command indicated no problems with buffers. The show interfaces command indicated that the routers were dropping frames from the output queue of the serial WAN ports at a rate of about 1 in 20 frames, or 5 percent. This appeared to be caused by too much network traffic destined for the 64-kbps circuits, and was considered a problem. The end result of the analysis of the existing core WAN was that the core WAN was congested due to too much traffic caused by normal application behavior. WAN Design for Klamath Paper Products A decision table was used as part of the design process for Klamath. Klamath’s major goals were consolidated and critical goals were placed at the top of the table, as shown in Table 11-6. Potential options were placed in the leftmost column and evaluated on whether they met a critical goal. Note If all options had met all critical goals, then other goals could have been listed also to further the decision-making process. Options could have been evaluated on how well they met noncritical goals on a scale from 1 to 10, as shown in Table 7-1, “Example Decision Table,” in Chapter 7. However, in the case of Klamath, it was not necessary to go beyond evaluating how well options met critical goals. After analyzing business and technical goals, characterizing the existing core WAN, and analyzing the options available from the WAN service providers in the area, Klamath decided to update the core WAN architecture from 64-kbps lines to Metro Ethernet using an E-LAN service and MPLS transport. This choice will keep costs low and benefit from the QoS features of Metro Ethernet. Table 11-6 WAN Technologies Decision Table The three main contenders, besides Metro Ethernet, were ATM, Ethernet over ATM, and Frame Relay. ATM was ruled out because ATM router interfaces are too expensive. Ethernet over ATM was ruled out because the services providers in the area don’t offer it. Frame Relay was seriously considered, but Metro Ethernet was selected instead of Frame Relay because it was designed to handle environments with diverse applications, such as the delay-sensitive videoconferencing and interactive manufacturing-support and financial-modeling applications at Klamath. In the new design, the delay-sensitive traffic will be carried on virtual circuits that are distinct from the circuits that carry other data. Traffic management parameters will be specified and implemented so that the network accepts and carries traffic according to the QoS needs of the different applications. The current WAN service provider that leases the existing 64-kbps circuits was selected as the service provider for the new Metro Ethernet WAN. The current provider was selected because it offers the following advantages over other providers: A proven history of supplying highly reliable Metro Ethernet services to customers Excellent pricing for Metro Ethernet that was comparable in price to the cost of adding numerous 64-kbps circuits to meet capacity requirements The ability to allow Klamath to keep their current IP addressing scheme 24-hour support, 7-days a week, with a guaranteed MTTR of 1 hour A single point of contact who is responsible for Klamath’s service Each site in the core of the network will connect to the network via a 10/100 Ethernet interface in a router. For now, 10-Mbps Ethernet will be used. Upgrading to 100 Mbps or 1000 Mbps will be possible in the future, but for now, 10-Mbps Ethernet was chosen because the service provider offers attractive pricing for 10-Mbps Metro Ethernet and because 10 Mbps is sufficient capacity for the current network applications. Klamath will replace the existing routers in the core of the network with new high-end routers that provide superior packets-per-second throughput, high-availability features, and support for optimization features. The routers will support Ethernet interfaces for connectivity to the service provider’s Metro Ethernet and to the internal LANs and mainframe. Figure 11-6 shows the new design for Klamath’s core network. Figure 11-6 New Core WAN at Klamath Summary This chapter continued the discussion of physical network design that was started in the previous chapter. It covered selecting technologies and devices for enterprise network designs, with a focus on the remote-access and WAN components of an enterprise network. Remote-access technologies include PPP, cable modems, and DSL. WAN technologies include the North American Digital Hierarchy, the European E system, SDH, leased lines, SONET, Frame Relay, ATM, and Metro Ethernet. You can use many selection criteria when choosing remote-access devices, central-site servers and concentrators, enterprise routers, and a WAN service provider to implement these technologies. These criteria include the types of ports, protocols, and optimization and security features offered by the device or service provider. The chapter concluded with an example of a WAN network design that was developed for Klamath Paper Products, Inc. To keep the example simple, not all steps of the top-down network design methodology were documented. The example demonstrated the use of the following steps: Analyzing requirements, including both business and technical goals Identifying existing and future network applications Identifying user communities and data stores Characterizing the existing network, including the existing topology, bandwidth utilization, bandwidth utilization by protocol, and network performance Selecting a WAN technology and service provider based on requirements and goals Review Questions Define CIR, Bc, and Be and explain how a Frame Relay service provider uses them. What are the most important criteria for selecting a WAN service provider? Why are QoS features often necessary in WAN routers? Some people think that Frame Relay will disappear over time. Do you think that is likely, and if so, why, and what do you think will replace it? Design Scenario This chapter included a detailed case study about Klamath Paper Products. Reread the case study and answer the following questions. Based on the design requirements and decisions that have been made, what routers would you recommend for Klamath? Do some Internet research to find a router that will meet Klamath’s needs and write two or three paragraphs about the product and why you chose it. In the future, Klamath’s separate voice network will be dismantled. All voice, data, and video traffic will traverse the Metro Ethernet network. This will simplify the topology of the current voice/data network and facilitate manageability. It will also allow Klamath to reduce the costs of operating separate data and voice networks. Research a VoIP solution that would work for Klamath. Write two or three paragraphs about the solution and why you chose it. Klamath doesn’t seem too concerned about security. This should concern you. Write a proposal for Klamath that discusses a security project that you would like to do for Klamath to help them understand their network assets, the security risks that they face, and the steps they should take to become more secure. Research a Metro Ethernet service that is offered by a vendor in your country (or another country if your country doesn’t have Metro Ethernet). Write a one-page paper that describes the service in technical terms. Also include pricing information if it is available. Summary for Part III This chapter concludes Part III, “Physical Network Design.” Physical design involves the selection of media, technologies, and devices for campus and enterprise networks. A physical design consists of cabling, Layer 1 and Layer 2 protocol implementations, and network devices. The physical design depends on business objectives, technical requirements, traffic characteristics, and traffic flows, which Part I of this book discussed. The physical design builds on the logical design, which Part II discussed. A network designer has many options for LAN and WAN technology for campus and enterprise networks. No single technology or device is the right answer for all circumstances. The goal of Part III was to present characteristics of typical options to help you make the right selections for your particular customer. Part IV, “Testing, Optimizing, and Documenting Your Network Design,” covers the final steps in designing a network: testing the network design, optimizing the network design, and documenting the design with a design proposal. Testing and optimizing a network design are
cftins69
0
