CSIR. Over NKN PIU, NKN

Transcription

1 CSIR Virtual Private Network Over NKN PIU, NKN 1

2 NKN TOPOLOGY 2

3 3

4 Application Requiring High Bandwidth Virtual Laboratories Collaborative Mega Science Projects Innovative Info-Bio-Nano Experiments Non-invasive Medicare for Diseases like Cancer Diagnostic Domes as Public Health Centers in Rural Areas Country-wide Classroom University without Walls Voice Conferencing among Researchers Video Conferencing among Researchers On-line access to Electronic Resources 4

5 NKN Design Philosophy To build a scalable network, which can expand both in the Reach (spread (p in the country) and Speed. To be a common Network Backbone like national highway, wherein different categories of users shall be supported. 5

6 Features NKN High Capacity, Highly Scalable Backbone Provide Quality of Service (QoS) and Security Wide Geographical Coverage Common Standard Platform Bandwidth from Many NLD s Highly Reliable & Available by Design Test beds ( for various implementation) Dedicated edcatedand downed. 6

7 NKN CLOUD Research Labs CSIR/DAE/ISRO/ICAR Educational Institutions NTRO Cert-IN EDUSAT National Internet NKN Exchange MPL Points (NIXI) S INTERNET Clou ds Connections to Broad Band Clouds Global Networks (e.g. GEANT) National / State Data Centers/ Networks Fig-1 GENERIC MPLS CLOUD OF NKN 7

8 NKN offering MPLS VPN CSIR Orissa CSIR Rajasthan CSIR Delhi CSIR hyderabad VOD DNS MCU Server CSIR Roorkee CSIR Chennai ISP Internet Internet Gateway NKN MPLS - VPN Network Internet Gateway ISP Internet CSIR Guwahati CSIR Gujarat CSIR Kanpur CSIR Kharagpur CSIR Patna CSIR Mumbai Fig-2 CSIR VPN 8

9 What NKN will provide? Bandwidth Availability and reliability IP space/ Interface with the APNIC NOC and DC DR NOC and DC 24 X 7 Support operations support Common Services like Web/Mail/ MX/DNS etc. All the MPLS VPN V4 / V6 and L2 VPN support. Guidelines and Procedures to effectively use the NKN. Routing/ Switching equipment at the end node to connect to the NKN. 9

10 What will NKN provide? Contd. Internet bandwidth Interface with other networks ( EU-GRID and others.) Applications like Video on Demand would be hosted on the Data Center Any other PORTAL / APPLICATION is deemed fit to be kept at Data center of NKN for efficient usage 10

11 Criterion to join NKN Must be a Knowledge Creator Participate in any of the killer applications that is envisaged Minimum bandwidth interface will be 100 Mbps Must comply to the policies i of NKN IP Usage Policy Security Policy - Operations policy 11

12 What logistics are expected from End Nodes Space for equipments. ( Router/ switch/ ups/ Racks from NLD) Typically 12 X 12 kind of space. Air- Conditioned Environment UPS (5 KVA & 10 KVA Based on router supplied) 24 X 7 access to NKN personnel or persons authorized by NKN. Seating space for one NKN appointed person. 12

13 What logistics are expected from End Nodes Contd.. Safety of the equipments supplied under NKN. Cabling with in the user location for connecting to the NKN router. Right of Way with in the User Campus for cabling to be done by the long distance providers. Nodal Officer appointed will be the single point of interface for NKN. ( Passion to NKN) 13

14 What NKN will not provide? Training / Troubleshooting on applications which are run internally by the end user. Interfacing with the end nodes which are not directly connected to the NKN (this includes broadband users, any end node of other MPLS cloud) Campus LAN support / maintenance inside the End Nodes ( whether connected directly or indirectly to NKN) Addressing security issues inside the END NODES. 14

15 Start Using NKN by creating a VPN connecting all the CSIRs Objective: Objective: To enable CSIRs to advertise the exisiting public IP segments (leased from ISPs) through NKN so that NKN connected institutes can reach any of the advertised public IPs through NKN links rather than spin around through ISPs 15

16 NKN link already in the institute and the NKN router is presently configured as a MPLS PE. Assumption: The Virtual Classrooms are on the NKN IP segment. Normally, the Institute's s campus LAN segments are terminated at a Core Switch, typically installed in the Computer Centre (CC). Internet access is provided through Prxy/Firewall/UTM devices. The Institutes router (which is connected to ISP) shall be capable of peering a BGP session with NKN router and the Institute router shall announce public IP segments to this BGP session. This will help the other institutes in the NKN cloud to reach the public IPs (hence webserver and other content enabled services) through NKN link. 16

17 How Do I start using the link immediately: Currently, NKN provides IP segments from RFC 1918's 10.n.n.n. n n These IP segments could clash with the exisiting assigned segment in the Institutes and re-assigning of the NKN suggested segments may be a daunting task. However, for the specified projects, the NKN suggested IP segments can be assigned from the day one. Connect the NKN router to the Institute's gateway router. Configure the gateway router to do a BGP session with NKN router and announce the public segment (normally provided by the ISP). This link at the NKN router is configured to be in VRF instance called NKNGEN. The public IPs are announced through the NKN who are part of this VRF instance NKNGEN. This way every CSIR's can announce their public IP segments in NKN and hence all the Institutes which are part of the VRF NKNGEN can reach the respective CSIRs public segment through NKN. 17

18 How Do I start using the link immediately: Incase the NKN links to the Institutes t fails, theroutes (public segments) will automatically ceases to exist and reachability to the Institute's public segment falls back through ISP link. In case of NKN link failure the routes from the NKN CLOUD will cease to exist and thereby the gateway of the institutes will start using the Internet link that they have for normal browsing. This way the internet t is being delivered d throughh theexisting provider. To Achieve Fig-1 and Fig-3, and Fig-3 the CSIRs must connect the NKN router to the CC router and announce the IP number allocated to them either from the ISP ( currently providing the Internet) or ERNET to NKN. If the CSIR wants to announce some resource, then it can be made available to all the others in NKN. The resource can be kept at the CSIR itself or could be transferred to DATA CENTER proposed in NKN. 18

19 NKN EXISTING ISP NKN Router Placed inside the institute MAIL server Link between NKN CSIR GW Layer 3 switch Proxy server WWW server Virtual Class Room on NKN private IP Institute t Campus IP schema is not changed in the existing setup OSDD LAB with IP schema which already exists Fig 3 Inside the Institute 19

20 Internet Browsing Only using the NKN: Objective: Using Internet facility on an immediate basis through NKN. Refer Fig 4 20

21 How Do I start using Internet using the NKN: Assumption: The Public IP number provided by ISP deployed currently. In case the institute wants to have the internet facility from the NKN, then the following needs to be done: The proxy server must have the real IP provided to the institute as a part of NKN. This IP shall be advertised by the NKN to the Internet world and hence the browsing is made possible through the NKN link. During this, any failure in the NKN link will result in proxy not getting internet connectivity. The other resources like the web site / mail server etc will still use the ISP as the IP numbers belong to the ISP and has been leased out to the institute. Refer Fig 4 21

22 NKN EXISTING ISP NKN Router Placed inside the institute Link between NKN CSIR GW MAIL server WWW server GARUDA LAB with IP schema which already exists External Interface with NKN public IP Proxy server Virtual Class Room on NKN private IP Layer 3 switch Block N Proxy server Block 2 Institute t Campus IP schema is not changed in the existing setup Block 1 Fig 4 Using a Proxy with NKN ext IP for browsing purpose. 22

23 Using the NKN when the USER has PUBLIC IP from APNIC/ ARIN: That is: /24 or more from APNIC/ARIN 23

24 Using the NKN when USER has PUBLIC IP from APNIC/ ARIN: The following are the assumptions for scenario in (Fig5): User with public IP pool Multi-homing to NKN & other ISP with separate local routers (running BGP between them). USER Requirement Primary (NKN) ISP & Backup (non-nkn) ISP Exit/Entry via Primary or Backup on Primary Fails Solution for preferred exit point Mark updates from NKN only with higher local preference. Solution for preferred entry point Advertise self public pool with AS ( number of NKN itself) path prepend to other ISP only and to NKN have a ibgp session. NKN s Role Accept only end node s prefixes & filter Advertise to the Internet with the ISPs connected to NKN 24

25 NKN EXISTING ISP ibgp between the NKN CSIR GW MAIL server Institute has IP number (public) provided by APNIC / ARIN NKN Router Placed inside the institute External Interface with NKN public IP Proxy server Layer 3 switch Proxy server WWW server GARUDA LAB with IP schema which already exists Virtual Class Room on NKN private IP Block N Block 1 Block 2 Institute Campus IP schema is not changed in the existing setup Fig 5 institutes having their own PUBLIC IP from APNIC/ARI N 25

26 Fanning-Out NKN NKN PoPP PoPP Engineering i collège Poly-tech Egress NKN Router NKN Cloud Ingress NKN Router Some NLD providing connectivity Médical collège VPN Green Site DAE LAB Education community VPN Blue Site BIO TECH PE -NKN MAIN UNIVERSITY With IN CAMPUS Colleges/ dpts 26

27 Short Term Migrating to NKN LAB #1 NKN IP Address Scheme Internet Service Provider NKN IP Address Scheme LAB # NKN RESOURCE DATA CENTER Internet Service Provider NKN CLOUD Internet Service Provider LAB #2 NKN IP Address Scheme NKN IP Address Scheme LAB #3 27

28 Migrating to NKN Institute #1 NKN IP SCHEMA CWCR Internet Service Provider NKN IP SCHEMA CWCR Institute # NKN RESOURCE DATA CENTER Internet Service Provider NKN CLOUD Internet Service Provider Institute #2 NKN IP SCHEMA CWCR NKN IP SCHEMA CWCR Institute #3 28

29 Short Term Migration Each one of the closed user group can advertise the IP numbers through the NKN. ( It will be the Public IP given to the organisation by the ISP currently engaged.) A separate VRF will be created which will allow the organisation to browse the others in the closed user group. This will also provide Internet facility. Provision can also be made on a short term basis for public IP for the organisation from NKN to cater to the PUBLIC/ INTERNET demands. 29

30 Killer Applications Peer to Peer Collaboration Desktop Video Enterprise ERP Central Web Based Applications Library resources MOST IMPORTANTLY A DESIGN THAT CAN CATER TO FURTURE INOOVATIVE IDEAS 30

31 HOW TO CONNECT EXISTING GARUDA LAB TO NKN? 31

32 HOW TO CONNECT GARUDA LABS? GARUDA: It has been decided to provide the bandwidth to Garuda through NKN. It is important that the LAB taking part in the GARUDA project gets a link from the router provided to the institutions through NKN project. Suggestion: The LAB has to extend the link from the NKN router which in many cases will be in the Computer Center and in some cases it could be a part of some other project like ERNET PoP. The approximate distance is 0-2 KM in most cases. Connect the cable provided to the NKN router in the institute and Garuda LAB. ( responsibility of GARUDA) 32

33 ISP Reliance/Bharti/TATA New Delhi/Hyderabad Internet Gateway Primary For NKN NKN Tier 1/2/3 POP PE Router Institute PE ISP Backup Institute Network Tier 1/2/3 POP PE Routers NKN MPLS Backbone Tier 1/2 POP PE Router Proxy server MAIL server WWW server Tier 1 POP P Router GARUDA LAB Details within the INSTITUTE Internal Cabling Fig: 6 Connecting Garuda lab to NKN 33

34 THANK YOU For further information: Contact: 34