Revision: 1.6a Date: 12th March Network Equipment and Interconnectivity Guide

Transcription

1 Revisin: 1.6a Date: 12th March 2012 Netwrk Equipment and Intercnnectivity Guide

2 Table f cntents 1 Netwrking Equipment Guide Outline Purpse f this dcument Netwrk Infrastructure requirement fr new builds Ducting and Fibre Example Fibre Intercnnects Cluster I Netwrk Tplgy Edge Netwrk The Cre Data Netwrk Cre FM Netwrk Wireless Testing and Dcumentatin Figure 1: Example f blwn-fibre intercnnectins... 5 Figure 2: Example f netwrk tplgy in different areas Netwrk Equipment Guide v1.6a 2

3 Versin Cntrl Ver Date Wh Ntes December 2011 JRM Dcument created January 2012 JRM Cre/FM/Edge/Wifi specified January 2012 JRM PNT amendments January 2012 PNT PNT amendments January 2012 JRM Fix testing and dcumentatin February 2012 RPS Added cnsultant s cmments February 2012 PNT Minr amendments and additins 1.6a 12 March 2012 PNT Minr amendments Netwrk Equipment Guide v1.6a 3

4 1 Netwrking Equipment Guide Outline 1.1 Purpse f this dcument This dcument frms the basis f the requirements specificatin t be used in all new prjects where any aspects f IT netwrking are invlved, including, but nt limited t, prvisin f wiring centres, ducts, inter- and intra-building cnnectivity, active and passive equipment, security, authenticatin, and data-related services. Within this dcument, the term Specificatin refers t the mst recent versin f the University f Yrk IT Services Netwrk Infrastructure Specificatin, which frm a part f this requirement. The basic principle is that sufficient prvisin will be made fr a secure, pervasive, highly resilient and easily managed data netwrk, capable f meeting all f the University s requirements fr a cnverged netwrk system. This netwrk system is required t carry CCTV, Access Cntrl, Building and Energy Management (BEMS), IP Telephny (IPT, VIP), and Electrnic Pint f Sale (EPS) traffic in a secure and reliable fashin and in accrdance with any statutry r industry requirements, separately frm student traffic, and separately frm research and administrative traffic. At present, this is achieved using separate OSPF ruting meshes fr the netwrks. T this end, it is a requirement f any netwrk infrastructure designed r installed fr the University, whether including active cmpnents r nt, that it be capable f management and mnitring in detail by the University f Yrk IT Services / Infrmatin Directrate Netwrk Grup. In recent years the Netwrk Grup has made a large investment in develping management and mnitring systems, and any netwrk prvisin must be fully cmpatible with these requirements. One f the essential features f the University netwrk is the cmbinatin f the ne prt fits all cncept in cnjunctin with fld patching. This allws the deplyment and mvement f many types f netwrk-attached device with minimal interventin, dramatically reducing the resurce required t deal with mves, adds, and changes. At the time f writing the University netwrk has apprximately 900 Ethernet switches f varius ages, prviding apprximately 30,000 edge prts in ver 200 wiring centres. As wiring centres have, n average, ne switch that can nly be half-utilised (due t the inevitable difference in numbers between installed data utlets and available prts n a switch), ne wuld expect at least 4800 prts t be unused. In fact there are ver 25,000 devices registered fr use n the netwrk, sme f which have multiple interfaces, s it can be seen that there is nly a small verprvisin. The initial capital cst f fld patching is quickly ffset by the reductin in the technical staff csts that wuld therwise be required. Any netwrk slutin must therefre adpt the same fld-patched universal ne prt fits all regime. It is recmmended that this dcument be read in cnjunctin with the latest versin f the IT Services Netwrk Infrastructure Specificatin, cpies f which are available n request. Netwrk Equipment Guide v1.6a 4

5 2 Netwrk Infrastructure requirement fr new builds 2.1 Ducting and Fibre All new builds including Heslingtn East New Gdricke and Heslingtn East Cluster I have multiple ducting and fibre rutes int every building allwing us t build a resilient Netwrk architecture. Designed int each majr build area e.g. Cluster I r Cluster II are at least tw netwrking distributin pints typically part f a Data Centre, PABX telephne rm r built nt an electrical substatin. These distributin pints will be the fcal pint fr ducting and fibres within each area with nward cnnectivity t ther areas e.g. in Cluster I, S2 PBX cnnects t the nrthern Heslingtn East cmbined utilities crridr, TFTA cnnects t the suthern Heslingtn East cmbined utilities crridr, and these tw lcatins cnnect eastwards t substatins LTA/SUB and LBR/SUB. The Cmbined Utilities Crridr (CUC) uses Emtelle s heavy duty 14/10mm micrducts (Prduct cde 8506) tie-wrapped in a 7 way bundle as specified in the IT Services Netwrk Infrastructure Specificatin, Appendix 4. Each micrduct in the bundle has a different clur Example Fibre Intercnnects Cluster I Illustrated here are all the majr wiring centres fr the Heslingtn East Cluster I buildings as well as Cluster I distributin pints TFTA (Data Centre) and S2 PABX (GNU/SUB Telephne Exchange). Inter-building links n Cluster 1 will typically use the 7 way variant f Emtelle s Direct Install prduct (Prduct cde 6438) which uses 5/3.5mm micrducts. Legend 12 cre OS1 12 cre OM3 48 cre OS1 Law & Management WC3 (139A) 30 June Ready fr service date TFTA Catalyst Building <<<< L/PBX 48 Cre SM L/PBX-> Hes East TFTA WC1 (004) WC2 (048) <<<< L/PBX 48 Cre SM L/PBX-> Hes East S2PBX 48 Cre SM L/PBX-> Hes East S2PBX S2 PABX <<<< ATB 48 Cre SM ATB -> Hes East S2PBX 48 Cre SM ATB -> S2PBX XSAN Server Rm TFTV Cmputer Science The Hub WC3 (227) WC4 (271F) CT09 25 June WC2 (125) WC1 (012A) WC1 (025) WC2 (064C) WC2 (G67) WC1 (G79) Figure 1: Example f blwn-fibre intercnnectin Netwrk Equipment Guide v1.6a 5

6 2.2 Netwrk Tplgy Any active netwrk and ancillary equipment, including but nt limited t Ethernet switches, ruters, media cnverters, strage devices, firewalls and wireless equipment, shall be f a type apprved by IT Services / Infrmatin Directrate as these devices must integrate with existing infrastructure. Ethernet ruting devices, Ethernet switches, WAPs, firewalls, etc must be capable f management frm a cmmand line accessible by serial prt, SSH and by the SNMP prtcl, and must nt rely n menu-driven r web-based methds. T avid cngestin, the industry-standard general principle that all feed prts shall be f several times (nrmally ten times) the capacity f the prts they feed shall be adhered t. IP addresses, bth public (wned by r allcated t the University f Yrk r its partner rganisatins) and private (RFC 1918 and RFC 3330/5735) and VLAN IDs must be allcated by the IT Services / Infrmatin Directrate Netwrk Grup. Other IP addresses, ie any nt cntrlled by IT Services / Infrmatin Directrate and nt part f an allcated private range, are nt permitted. Use f NAT (netwrk address translatin) is nt permitted. All devices cnnected t the netwrk must be registered in the Infrmatin Directrate LAN database befre cmmissining them n the netwrk. Cntractrs must request the registratin f devices and allcatin f IP addresses via a web frm. The applicatin frm and explanatry ntes are accessible at the Infrmatin fr Cntractrs webpage at The frm requires a username and passwrd, which is allcated n a ne-per-cmpany basis, and there is a link n the explanatry ntes web page which may be used t request this. The develper will allw fr the University f Yrk IT Services / Infrmatin Directrate t design the netwrk architecture and t prepare suitable kits lists, fibre cnnectivity diagrams, rack layuts fr prvisin as part f their cntract. The IT Services department will als prvide cnfiguratin files fr apprved devices ready fr prcurement frm and installatin by University preferred data equipment vendrs with the final cmmissining and cnnectin t the campus Netwrk by University f Yrk IT Services staff. T be able t d this IT Services require data utlet prt cunts alng with drawn up diagrams shwing psitins f data utlets particularly shwing the lcatin f Wireless Access Pints, Access Cntrl, EPS and BEMS devices. Where rack space t huse third-party equipment is required in IT Services data racks the space allcatin will be carried ut and dcumented by the University f Yrk IT Services Edge Netwrk Any new develpments edge netwrk must utilise the latest type f the fllwing device/devices. The edge netwrk is based arund the HP Prcurve 2620 range (r its successr) f 48 prt 10/100 Pwer Over Ethernet (PE) switches fr mst applicatins and the HP Prcurve 2910 range (r its successr) f 48 prt 10/100/1000 PE switches where higher perfrmance is required e.g. specialist labs. All wiring centre utlets shuld be fld patched whether required r nt. The switches will be cnfigured t supprt the Universities One Prt Fits All architecture allwing simple, safe and seamless cnnectin f devices, whether that be a dr lck, till r a high perfrmance user device.

7 Ethernet switches, including ruting devices, must supprt, as a minimum, the fllwing features and prtcls: At least 48 x autsensing 10/100Mb/s RJ45 prts (this restrictin may be relaxed fr devices serving a purely Layer 3 ruting functin and equipped with mre than 24 ptical prts) RS232-cmpatible serial cnsle prt 802.1p Class f Service and traffic priritisatin with at least 4 queues 802.1Q VLANs, at least 64 per device multiple subnets CIDR LLDP LLDP-MED Vice VLANs 802.3af PE r 802.3at PE+ pre-standard PE supprt cnfigurable Aut-MDIX At least tw Gigabit ptical prts using SX and LX SFP transceivers RADIUS authenticatin and accunting Multilink trunking (supprting bth LACP and manual cnfiguratin) IGMP snping 802.1X authenticatin, with multiple 802.1X users per prt MAC address-based prt authenticatin t RADIUS Multiple authenticatin methds per prt VLAN allcatin per prt by RADIUS MAC address limiting MAC address lckut Surce-prt filtering Cnfigurable lgging using SYSLOG SNTP SNMP v3 RMON SFLOW Availability f all relevant standard and prprietary MIBs Prt mnitring, including remte prt mnitring Prt mirrring DHCP snping with DHCP prtectin Bradcast limiting rate limiting 802.1s multiple (per-vlan) Spanning Tree Prtcl sftware/firmware updates available fr a minimum f 5 years cmmand line interface SSHv2 TFTP file transfer Secure FTP (SFTP) file transfer Dual flash images fr firmware and cnfiguratin files Flexible munting ptins including standard 19 rack munting Switches supprting Gigabit RJ45 prts must additinally supprt: At least 24 x autsensing 10/100/1000Mb/s RJ45 prts At least tw (and nrmally fur) 10G ptical prts using SR and LR SFP+ transceivers Netwrk Equipment Guide v1.6a 7

8 2.2.2 The Cre Data Netwrk Any new develpments Cre data netwrk must utilise the latest type f the fllwing device/devices. The cre/distributin data netwrk will be cnfigured as an OSPF mesh based arund the HP Prcurve 5400zl range (r its successr) f mdular switch ruters hused within Data Centres, Substatins r majr wiring centres with multiple 10Gbit/s diversely ruted uplinks. Ethernet ruting devices must supprt, in additin t all f the abve, the fllwing: IPv4 Layer 3 ruting IPv6 Layer 3 ruting RIP, RIP2 and OSPF3 ruting prtcls static rutes multinetting per-vlan DHCP frwarding t multiple destinatins flw cntrl ACLs (access cntrl lists) IP address lckut VRRP (Virtual Ruter Redundancy Prtcl) IGMP MLD (Multicast Listener Discvery) PIM sparse and dense mdes At least fur ptical prts using SR and LR SFP+ transceivers In certain lcatins, Ethernet ruting devices must als supprt: MPLS Cre FM Netwrk Any new develpments Cre FM netwrk must utilise the latest type f the fllwing device/devices. The FM netwrk is als based arund the HP Prcurve 5400zl (r its successr) range f mdular switch ruters hused within distributin centres (substatins/pabx etc). These separately feed int edge switches giving ut-f-band, resilient and cmpliant Facilities Management netwrking t supprt an ever increasing list f FM devices (IP Telephny, CCTV, Access Cntrl, EPS, esuds, Alarm panels, BEMS,...). There are als separate fibre feeds frm each relevant substatin t supprt car park barriers & assciated devices Wireless All buildings shuld have an internal data infrastructure t supprt pervasive internal wireless cverage and additinal utlets and ducting t facilitate external Wireless Access Pints where apprpriate. Currently the Wireless architecture used by the University is by Aruba and supprts B, G & N dual-band high density technlgies. Any wireless slutin must be a centrally managed dual-band thin client wireless slutin that des nt require VLANs t be presented frm the netwrk cre directly t individual Wireless Access Pints. Wireless cverage shall be prvided in all cmmunal areas, seminar rms, lecture theatres, and all study bedrms. Netwrk Equipment Guide v1.6a 8

9 Additinal prvisin fr wireless cverage shall be made fr all ffice and research areas. Prvisin shall be made fr future cverage f utdr spaces. Wireless bandwidth shall be prvided using the 2.4GHz band t supprt g and n, and als in the 5GHz band t supprt n. All wireless cnnectivity shall be secured by WPA2-Enterprise. All wireless access pint cnfiguratin and management shall be carried ut n central cntrllers. All wireless traffic shall be carried n Netwrk Access Service VLANs and subnets lcal t the access pint. It shall nt be necessary t carry specific VLANs r subnets frm the netwrk cre t utlying wireless access pints; APs shall use lcal addresses, subnets, and VLANs t cmmunicate with central cntrllers. Wireless APs and their cntrllers must be capable f management and mnitring by SNMP. Wireless cntrllers (and APs if nt thin APs) must be capable f management by autmatically r semi-autmatically run scripts withut the use f prprietary sftware. Wireless cntrllers (and APs if nt thin APs) must be capable f management frm a cmmand line accessible by serial prt and by the SSHv2 prtcl, and must nt rely n menu-driven r web-based methds. Netwrk Equipment Guide v1.6a 9

10 2.3 Testing and Dcumentatin N part f the netwrk cabling r fibre-ptic infrastructure shall be deemed cmplete r fit fr purpse until standards-based test results in the apprpriate frmat are received by IT Services / Infrmatin Directrate Netwrk Grup. N pwered device shall be deemed ready fr use until it is issued with a PAT certificate prvided t the University r has a readily-visible sticker shwing the date f testing, renewal date, and the initials r signature f the tester. N active device r netwrk segment installed by ther than IT Services shall be deemed ready fr use until it is capable f being mnitred using SNMP by the IT Services / Infrmatin Directrate netwrk mnitring system. Netwrk Equipment Guide v1.6a 10

11 GNU (200) gdia1sw0 gdia1sw1 gdia1sw2 gdia1sw3 gdia2sw0 gdia2sw1 gdia2sw2 gdia2sw3 gdia2sw4 gdia2sw5 gdib1sw0 gdib1sw1 gshcsw0 gshcsw1 gshbsw0 gshbsw1 gbaa1sw0 gbaa1sw1 gbaa1sw2 gdia1sw3 gbaa1sw4 gbaa1sw5 gbaa1sw6 gbaa1sw7 spf 2094 gbaa2sw0 gbaa2sw1 gbaa2sw2 gdia2sw3 gbaa2sw4 gsha1sw0 gsha1sw1 gsha1sw2 gsha1sw3 gsha2sw0 gsha2sw1 gsha2sw2 gnusw0 gnusw1 a1 a16 d3 d2 b2 FM b1 c1 c2 c3 c4 d1 gnufr /28 d4 Typical Residential Architecture f2 f3 e3 e1 e5 e2 e4 e6 gnurs0(spf.201) e7 e9 e11 e12 e10 CORE 2200 e8 a1 fm spf 2313 (5,6) HEPBX (7,8) (16) (18) f2 f1 c1 hepbxrs0(spf.200) CORE c2 a2 a1 hepbxsw0 hepbxsw1 Typical Distributin architecture IPT ICC pbxfr0-trk1 siemens siemens LACP b23,24 a1 a2 b22 Trk1 hepbxfr1 FM /28 a9,10:trk2 b19 b17 b20 b21 (1) (24) (1) (18?)(12) (4)(5)(6) spf 2208 tftv priv? spf (7) d1 rch2rs0(spf.219) CORE a9-10 a7-8 b3-4 b5-6 a1-2 a3-4 a4-5 b17-18 b15-16 b13-14 b7-8 b9-10 b11-12 rch2sw12 rch2sw11 rch2sw10 rch2sw9 rch2sw8 rch2sw7 rch2sw6 rch2sw5 rch2sw4 rch2sw3 rch2sw2 rch2sw1 rch2sw0 b24 d3 HUB (218) (8) d2 (6) (6) b22 (1) (1) d (9) (13) (24) d3 b24 rch1rs0(spf.218) R CORE a21-22 a19-20 a17-18 a15-16 b3-4 b5-6 b7-8 a1-2 a3-4 a5-6 a7-8 a9-10 a11-12 a13-14 b9-10 b11-12 b13-14 b15-16 b17-18 rch1sw18 rch1sw17 rch1sw16 rch1sw15 rch1sw14 rch1sw13 rch1sw12 rch1sw11 rch1sw10 rch1sw9 rch1sw8 rch1sw7 rch1sw6 rch1sw5 rch1sw4 rch1sw3 rch1sw2 rch1sw1 rch1sw0 (16) b21 Typical University Nn-residential Architecture KEY Residential Edge Switch Cre Layer 3 ruter FM Layer 3 ruter Office Edge Switch 1 Gb Residential Netwrk 10Gb Cre Netwrk 1 Gb FM Netwrk 1 Gb Office Netwrk Figure 2: Example f netwrk tplgy in different areas

12 Netwrk Equipment Guide v1.6a 12