Planning Guide for Deploying Microsoft Office Communications Server 2007 R2 in a Juniper Distributed Enterprise

Transcription

1 Planning Guide for Deploying Microsoft Office Communications Server 2007 R2 in a Juniper Distributed Enterprise Created for: Microsoft Network Optimization program June 2010 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, California USA JUNIPER 1

2 Table of Contents LIST OF FIGURES... 4 LIST OF TABLES... 5 OVERVIEW... 6 START HERE: PLAN YOUR JUNIPER/MICROSOFT OCS NETWORK IN THREE STEPS... INTRODUCTION... 7 SCOPE... 8 TARGET AUDIENCE... 8 INTRODUCING MICROSOFT OFFICE COMMUNICATIONS SERVER 2007 R MICROSOFT OCS 2007 R2 VERSIONS... 9 Microsoft OCS 2007 R2 Standard Edition... 9 Microsoft OCS 2007 R2 Enterprise Edition MICROSOFT OCS 2007 R2 DEPLOYMENT SCENARIOS MICROSOFT OCS 2007 R2 REQUIREMENTS MEDIATION SERVER MEDIA GATEWAY INTEGRATION OCS 2007 R2 IN A JUNIPER NETWORKS DISTRIBUTED ENTERPRISE WHAT DOES JUNIPER OFFER? JUNIPER DISTRIBUTED ENTERPRISE COMPONENTS EX Series Ethernet Switches M/MX Series with IMSG SRX Series Services Gateways for the Branch Additional Components STEP 1: DESIGN THE NETWORK ARCHITECTURE DATA CENTER ARCHITECTURE CONSIDERATIONS CAMPUS AND OFFICE CONSIDERATIONS Layer 3 Recommendations LAN Considerations Wireless LAN Considerations WAN Considerations LAN and WAN Connectivity Recommendations WAN CONNECTIVITY CONSIDERATIONS: OPTIMIZE MEDIA ROUTING Select the Appropriate High Level Topology SIP Trunking Topologies STEP 2: DESIGN THE QOS CONFIGURATION Packet Flow in a QoS Enabled Router Juniper QoS Recommendations STEP 3: ANALYZE DELAY AND JITTER Delay Considerations Jitter Considerations

3 Encoding Delay Audio Bandwidth Considerations Video Bandwidth Considerations Audio and Video Recommendations SAMPLE DEPLOYMENT OF MICROSOFT OCS 2007 R2 WITHIN THE JUNIPER DISTRIBUTED ENTERPRISE Small Office/Home Office Remote Offices Medium to Large Branch Offices Campus/Headquarters Data Center ANALYZING END TO END DELAYS SUMMARY LINKS FOR FURTHER INFORMATION ABOUT JUNIPER NETWORKS APPENDIX: PUBLIC AND PRIVATE WAN LATENCY AT&T VERIZON BUSINESS Private IP Service (MPLS) Internet Service QWEST

4 List of Figures Figure 1. Standard Microsoft OCS 2007 R2 deployment... 9 Figure 2. Microsoft OCS 2007 R2 expanded deployment Figure 3. Microsoft OCS reference architecture Figure 4. Basic Media Gateway Figure 5. Juniper Distributed Enterprise components Figure 6. Juniper "data center fabric." Figure 7. Hub and spoke model Figure 8. Mesh design Figure 9. Distributed SIP Trunking with STEP Figure 10. Regional SIP Trunking with STEP and IMSG Figure 11. VoIP requirements Figure 12. QoS processing model Figure 13. EX Series CoS model for classification, queuing, and scheduling Figure 14. End to end delay Figure 15. Juniper Networks product portfolio for the distributed enterprise Figure 16. SOHO reference architecture Figure 17. Remote office reference architecture Figure 18. Typical architecture for a medium to large branch office Figure 19. Campus/headquarters reference architecture Figure 20. Data center reference architecture Figure 21. End to end delay Figure 22. Delay reference architecture

5 List of Tables Table 1. Juniper Solution Components that Enable Microsoft UC Table 2. DiffServ Recommendations Table 3. Types of Delays and Definitions Table 4. Latency for RTAudio Table 5. RTAudio Information Table 6. Audio Capacity Planning Table 7. Voice Bandwidth with Layer 2 Header Table 8. Voice Bandwidth with Layer 2 Header and IPsec Table 9. WAN Bandwidth Sample Planning for SOHO with T1 Interface Table 10. SRX Delays for SOHO Table 11. WAN Bandwidth Sample Planning for Remote Office with T1 Interface Table 12. EX and SRX Delay for a Remote Office Table 13. WAN Bandwidth Sample Planning for Medium to Large Branch Offices Table 14. WAN Bandwidth Sample Planning for Medium to Large with Private WAN Table 15. EX and SRX Delay for a Medium to Large Branch Office Table 16. WAN Bandwidth Sample Planning for Campus/Headquarters with 8xDS3 Interface Table 18. WAN Bandwidth Sample Planning for Campus/Headquarters with Private WAN Interface Table 19. EX and SRX Delay for the Campus/Headquarters Table 19. Branches and Campus/Headquarters Supported per Data Center with Different WAN Bandwidths Table 20 Worst Delay from Different Distributed Enterprise Networks Table 21 Worst/Best Delays from Different Branch Types Table 22 Delays if All Connections are Terminated and WAN Queuing at Datacenter

6 Overview This planning guide presents the Quality of Service (QoS) and connectivity considerations that are important for a successful implementation of Microsoft Office Communications Server (OCS) 2007 R2 in a Juniper Distributed Enterprise network. The guide describes how to determine the bandwidth requirements for the five key architectures that make up Juniper s distributed enterprise: small office/home office (SOHO), remote office, medium to large branch office, campus/headquarters, and the data center. When you are planning a Microsoft OCS 2007 R2 implementation in a Juniper distributed enterprise, start by learning about the components. For a brief introduction to Microsoft OCS 2007, including a description of versions, deployment scenarios, and a summary of requirements, see Introduction to Microsoft Office Communications Server 2007 R2. For a description of a Juniper Distributed Enterprise and its components, including the SRX Series Services Gateway and the EX Series Ethernet Switches, see OCS 2007 R2 in a Juniper Networks Distributed Enterprise and Juniper Distributed Enterprise Components. A table in this section shows the Juniper solution components that enable an OCS implementation. Start Here: Plan Your Juniper/Microsoft OCS Network in Three Steps To plan your Microsoft OCS 2007 R2 implementation in a Juniper Distributed Network, you need to take a few basic steps. These steps include (but are not limited to) the following: 1. Step 1: Design the Network Architecture: engineer your network topology to optimize the media path. To ensure efficient network operation, you must seek the shortest media path by minimizing the number of hops (or links) used in order to minimize delay. You should therefore design the most appropriate high level topology mesh or hub andspoke, as well as consider the point of connection to remote telecommuters and SIP trunks so that you have as much direct traffic as possible. See Step 1: Design the Network Architecture. 2. Step 2: Design the QoS Configuration: plan forwarding queues. Once your architecture design is stable, plan the use of forwarding queues throughout the network, including priority and bandwidth allocation. See Step 2: Design the QoS Configuration. Also see Packet Flow in a QoS Router and Juniper QoS Recommendations. 3. Step 3: Analyze Delay and Jitter: verify that the expected delays for your implementation are acceptable. For a discussion of calculating end to end delays in a Juniper Distributed Network with Microsoft OCS 2007 R2 under bestcase and worst case conditions, see Step 3: Analyze Delay and Jitter. Based on your calculation results, repeat steps 1 and 2 above to reach acceptable delay estimates. Note that security is also a consideration. However, this document focuses on QoS only; security considerations are covered in other documents. 6

7 Introduction The promise of reduced costs combined with enhanced productivity and mobility has led many companies to adopt unified communications (UC) solutions solutions that combine the entire set of available information applications under the single, broad umbrella of communications. This evolution started with voice/video, instant messaging (IM), and e mail, and is moving forward to encompass corporate applications with real time communications even corporate systems that include Customer Relationship Management (CRM) and Enterprise Resource Planning (ERP). UC integrates both real time and non real time communications with business processes and requirements that are based on presence capabilities and presents a consistent unified user experience across multiple devices and media types. UC is not a single product, but rather a solution composed of a variety of communication tools and components that let people connect, communicate, and collaborate seamlessly to improve business agility and results. These results include better user and group productivity, dynamic collaboration and simplified business processes, with the goal of increasing revenues, decreasing costs and improving customer service. Microsoft approaches UC from the enterprise application side with Microsoft Office Communications Server (OCS) 2007 R2, a clientserver product that uses the Session Initiation Protocol (SIP) to facilitate real time communications between users. OCS 2007 R2 provides the infrastructure for: Enterprise instant messaging Presence File transfer Peer to peer and multi party voice and video calling Ad hoc and structured conferences (audio, video and Web) Public switched telephone network (PSTN) connectivity These features are available within an organization, between organizations, and with external users on the public Internet or on standard phones (PSTN as well as SIP trunking). Implementing a comprehensive UC solution with OCS 2007 R2 requires more than OCS server and OCS clients. Successful UC implementations need scalable, converged solutions that provide security, connectivity, and performance to ensure the reliability of data, voice, and video communications all while securing the network and protecting corporate assets. As a Microsoft OCS implementation grows and evolves, it can benefit from a single high performance network infrastructure that can deliver highquality voice and data services without latency, jitter, and packet loss, which can cripple real time voice and video communications. Juniper Distributed Enterprise networks deliver the solution. Juniper Networks Distributed Enterprise solutions are comprehensive, high performance networking solutions that include switching, routing, security, network management, and WAN optimization all with a lower total cost of ownership (TCO) than other solutions. The solutions accomplish this by providing consistent IT networking services for connectivity, security, and manageability for anyone, anytime, anywhere in the distributed enterprise. Deploying Microsoft OCS on a single, converged network requires careful consideration. UC implementations require high and consistent bandwidth to maintain performance. While latency, jitter, and packet loss rarely have an impact on the quality of data communications, they can have a crippling effect on voice and video communications. UC solutions have real time requirements and high availability (HA) connectivity expectations. These applications are particularly vulnerable to performance degradation and 7

8 failures in network links or devices. And because users expect their voice and video communications to be private, solutions must meet the highest standards for security. High performance routing, switching, and security must move the packets through the network with appropriate Quality of Service (QoS), ensuring that security appliances, switches, routers, gateways, and other components do not affect the Quality of Experience (QoE) for the user. This planning guide discusses the QoS and connectivity considerations that are important for a successful OCS 2007 R2 implementation in a Juniper Distributed Enterprise network. It provides bandwidth guidelines and recommendations for the five key architectures that make up Juniper s distributed enterprise: Small office/home office (SOHO) Remote office Medium to large branch office Campus/headquarters The data center Scope This paper presents guidelines to help ensure sufficient bandwidth when implementing Microsoft OCS 2007 R2 in a Juniper Networks distributed enterprise that includes SOHOs, remote offices, medium to large branch offices, campus/headquarters, and a data center. This document focuses on QoS and connectivity issues; security issues are addressed in separate documentation. Target Audience This guide is intended for the following network personnel: Network architects Network designers Network administrators 8

9 Introducing Microsoft Office Communications Server 2007 R2 Microsoft s UC solutions use the power of software to streamline communications. Microsoft OCS 2007, the cornerstone of Microsoft s UC solution, is the platform for presence, instant messaging, conferencing, and enterprise voice for businesses around the world. Microsoft OCS 2007 R2 adds chat rooms as well as additional IM, conferencing, and telephony functionality, such as interactive voice response (IVR) and conferencing auto attendant. User interfaces include Microsoft Office Communicator, a unified communications client, as well as Office Communicator Web Access, Office Communicator Mobile, Office Communications Server Attendant, and RoundTable. Microsoft OCS 2007 R2 Versions Office Communications Server 2007 R2 comes in different versions the Standard Edition and the Enterprise Edition. The Standard Edition includes all of the components on a single server, while the Enterprise Edition is deployed on multiple servers, allowing a customer to scale when demands increase. Microsoft OCS 2007 R2 Standard Edition Office Communications Server 2007 R2 Standard Edition is deployed with the Front End Server, Microsoft SQL Server, A/V Conferencing Server, Web Conferencing Server, and Web Components Server installed on a single physical computer. (See Figure 1.) Figure 1. Standard Microsoft OCS 2007 R2 deployment. 9

10 Office Communications Server 2007 R2 Standard Edition is recommended for small to mid sized organizations, such as branch and pilot deployments, which do not have high availability and performance requirements. All components in this topology are located on one server. This configuration is bundled with Microsoft SQL Server Express 2005 SP2 or SP3. The configuration shown in Figure 1 can support up to 5,000 users per server. Microsoft OCS 2007 R2 Enterprise Edition Enterprise Edition is recommended for most organizations. There are two possible topologies: expanded and consolidated. Enterprise Edition servers run the Front End Server, A/V Conferencing Server, Web Conferencing Server, and Web Components Server. Each of these components can be installed on one server or on separate servers to balance the load. Expanded Topology An expanded topology lets you place higher demand services, such as conferencing, onto dedicated servers, which allows a pool to service a larger number of clients than is possible using a consolidated topology (up to 125,000 users). However, an expanded topology tends to be more tedious and expensive to deploy; it is no longer a recommended scenario and requires command line installation and configuration in OCS 2007 R2. An expanded deployment is shown in Figure 2. Figure 2. Microsoft OCS 2007 R2 expanded deployment. Consolidated Topology The recommended topology for Microsoft OCS 2007 R2 is a consolidated configuration with Enterprise Edition in which all server roles in a pool are on a single computer. This topology reduces both deployment and operational overhead, which in turn reduces 10

11 cost of ownership. Scalability (up to 100,000 users) is achieved by adding computers to the pool or perimeter network and load balancing them. The topology uses a consolidated edge server, a monitoring server (CDR and QoE), and a dedicated archiving server. The following considerations apply to the Enterprise Edition consolidated configuration: A single Enterprise Edition server can be configured as an enterprise pool. A hardware load balancer is required when two or more Enterprise Edition servers are configured as a pool. The back end database must be deployed on a separate server. Figure 3 shows a consolidated topology that illustrates the server roles and components. Figure 3. Microsoft OCS reference architecture. 11

12 Microsoft OCS 2007 R2 Deployment Scenarios Microsoft UC leverages standards and published interfaces to integrate with existing telephony and application infrastructure investments. The result is a flexible integration of telephony with other business communications tools. Microsoft OCS 2007 R2 supports several deployment scenarios that address different customer deployment strategies and timelines, as well as customers existing telephony investment mix. Microsoft OCS 2007 R2 Co Existence In this deployment scenario, a PBX coexists with OCS 2007 R2 and Office Communicator to provide a flexible and powerful combination of traditional telephony and unified communications. If your PBX infrastructure does not natively support this scenario, you can use a Microsoft certified IP PSTN media gateway to provide integration between OCS 2007 R2 and the PBX. Microsoft OCS 2007 R2 Stand Alone You can exclusively use OCS 2007 R2 and associated elements for the voice communications needs of your enterprise, eliminating the PBX phone altogether. OCS 2007 R2 stand alone is distinct from OCS 2007 R2 co existence in that the enterprise dial plan is partitioned between OCS 2007 R2 users and PBX users. This means that you can have either a PBX phone or an Office Communicator endpoint, but not both. Remote Call Control In this scenario, you can issue commands from Office Communicator 1.0 to the PBX for your telephone extension (for example, click to call or accept a call). Office Communicator 1.0 merely sends commands to the PBX to carry out actions on the calls routed to your extension. The integration uses the CSTA over SIP standard TR/87 protocol, and commonly requires a third party CSTA server. The advantage of CSTA as an integration mechanism is that most PBX types and models support this technology, thereby enabling a powerful addition to user functionality without having to affect the PBX installation or configuration. With more recent versions of PBXs or the appropriate third party integration, the OCS 2007 and OCS 2007 R2 support this scenario and can continue to work alongside the co existence scenario. Microsoft OCS 2007 R2 Requirements There are many requirements to consider when planning a Microsoft OCS 2007 R2 deployment, including the following. (Consult the Microsoft OCS 2007 R2 documentation for a complete list of requirements.) Active Directory Domain Services Requirements OCS relies on Active Directory Domain Services (AD DS) to store global settings and groups that are necessary for deployment and management. The first step in deploying OCS 2007 R2 is to prepare AD DS by extending the schema and then creating and configuring objects. The schema extensions add the Active Directory classes and attributes that OCS requires. Network Infrastructure Requirement The network adapter card of each server in the OCS topology must support at least 1 Gigabit per second (Gbps). In general, you should connect all server roles within the OCS topology using a low latency and high bandwidth local area network (LAN). The size of the LAN is dependent on the size of the topology (described later in this document): o In Standard Edition topologies, servers should be in a network that supports 1 Gbps Ethernet or equivalent. o In Enterprise pool topologies, most servers should be in a network that supports more than 1 Gbps, especially when supporting audio/video conferencing and application sharing. Network Audio/Video Requirements If you plan to deploy an A/V edge server, a publicly routable IP address is required on its external interface. If you anticipate 12

13 a high volume of audio/video traffic or experience packet loss after you deploy, you should optimize the network interface card to accommodate the A/V traffic. Mediation Server Client access to OCS 2007 R2 is provided through either Microsoft Office Communicator 2007 or the Live Meeting client installed on a PC. OCS 2007 R2 also includes the Mediation Server, which provides a front end element to: Enable intermediate signaling and call flows through a back to back user agent (B2BUA), including adding or removing elements of a SIP transaction that were not supported by most telephony elements. Transcode real time protocol (RTP) media flows from traditional codecs, such as G.711, to the Microsoft advanced audio codec, Real time Audio (RTAudio). Act as an interactive connectivity establishment (ICE) client to enable PSTN originated media flows to traverse intervening network address translations (NATs) and firewalls. Enroll in the management, monitoring and provisioning scheme (leveraging Microsoft management technologies such as WMI, MMC, AD DS, and System Center) to extend management functions to the PSTN and PBX. Provide intermediation for a pool of media gateways. Interoperate with PSTN Service Provider network elements. Provide branch office survivability functions. Provide legacy telephone device interoperability. Media Gateway Integration Media gateways play a vital role in unified communications. Bridging users from the OCS 2007 R2 and PSTN worlds together when a SIP enabled PBX is not present requires a media gateway, as illustrated in Figure 4. Figure 4. Basic media gateway. 13

14 OCS 2007 R2 in a Juniper Networks Distributed Enterprise Today s enterprise footprints are distributed far beyond the corporate headquarters to globally distributed locations that encompass several branch locations, numerous remote offices, and even home offices and mobile workers. Furthermore, enterprises are more fluid than ever. An employee may work at the main campus one day and from a remote location the next. This means all work centers are now business critical and require consistent, secure, high performance IT networking systems. The key to successful OCS deployment for these distributed enterprises is to have a network infrastructure that provides fast and consistent application performance, high availability, reliability, and security. When designing the network, it is critical for the network architect to have a clear understanding of the codecs used, of the network requirements (in terms of latency, jitter, and packet loss), and of the new security vulnerabilities that are continually being introduced. It is also important to assign appropriate QoS to the network traffic so that downstream network devices can expedite time sensitive packets to ensure a satisfactory user experience. Juniper Networks Distributed Enterprise solutions enable OCS 2007 R2 to provide service without boundaries by delivering consistent connectivity, security, and management services across all workforce centers, regardless of size or location. In addition, Juniper s distributed enterprise systems maintain a focus on reducing the overall total cost of ownership (TCO) of the networks. What Does Juniper Offer? Juniper solutions offer IP switching, routing, security, wide area network (WAN) application acceleration, and Integrated Convergence Services (ICS) for the UC/VoIP solutions that power and protect the network as well as the Microsoft applications and services that run on it. As a Microsoft Certified Partner, Juniper works closely with Microsoft to create a responsive and trusted environment for accelerating the deployment of Microsoft OCS over a single converged network. The Juniper/Microsoft collaboration helps customers meet their single network needs by providing: Comprehensive QoS functionality to classify, prioritize, and schedule voice and video traffic in a way that ensures the end user s communications quality. Voice enabled architecture and link fragmentation and interleaving (LFI) to provide low latency and jitter in support of clear voice communications. Application specific integrated circuit (ASIC) based processing to accelerate the performance of processor intensive functions in routing, switching, and security appliances. Modular Juniper Networks JUNOS software to reduce integration costs and increase network efficiency. Compressed Real Time Protocol (crtp), which compresses packet headers to increase network efficiency. Internet protocol security (IPsec) VPN technology to support low latency, encrypted voice traffic for large scale WAN deployments. Power over Ethernet (PoE) for standard, managed, and undisrupted power for VoIP phones. Link Layer Discovery Protocol (LLDP) and LLDP Media Endpoint Discovery (LLDP MED) for VoIP capabilities, power management, and network inventory of VoIP devices. Dynamic Host Configuration Protocol (DHCP) services and DHCP relay for Layer 3 addressing of VoIP phones and desktops that share a connection to the same access port. Peering with PSTN, PBX, and SIP Trunking services with the use of Juniper SRX ICS (SIP Media GW), SRX STEP (SIP Trunking Edge Point), M/MX IMSG (Integrated Multiservice GWs), and SRX/ SSG ALGs. 14

15 JUNOS is the common language running across every router, switch, and security device that makes up a Juniper solution. JUNOS is an open, adaptive, and customizable application development platform. JUNOS software offers standard based IETF DiffServ, which interoperates well with the Microsoft UC system. The JUNOS operating system supports application layer gateways (ALGs) for SIP and other protocols that are prevalent in UC deployments. The ALG dynamically opens and closes firewall ports to allow incoming and outgoing calls to transit the network. A complementary solution aimed at carrier peering scenarios and based on SIP back to back user agent (B2BUA) functionality uses integrated multi service gateways (IMSG) implemented over M/MX Series routers and SIP trunking edge point (STEP), a function embedded within the media gateway (MGW) in SRX Series for the Branch; both STEP and IMSG incorporate SIP signatures that support intrusion prevention systems (IPS). For more detail, see M/MX Series with IMSG. The Juniper Networks security solution works in a NAT environment that uses private IP addresses, which can complicate the process of receiving calls. Juniper offers plug and play functionality in NAT environments for Microsoft UC customers can choose a strict NAT scheme for tight security environments or a full cone NAT scheme. In either case, Microsoft OCS Interactive Connectivity Establishment (ICE) can be used for NAT traversal, but with different media routing patterns. ICE makes use of existing protocols, such as Simple Traversal of UDP through NAT (STUN), Traversal Using Relay NAT (TURN), and Real Specific IP (RSIP), and works through the mutual cooperation of both endpoints in a SIP dialog. For more detail, see Step 1: Design the Network Architecture. Juniper Distributed Enterprise Components The Juniper Distributed Enterprise core solution components include service gateways (the SRX Series Services Gateways), switches (the EX Series Ethernet switches), routers (including the M/MX Series routers with IMSG), as well as additional components to address security, switching, and other functionality. Note that all products are based on JUNOS and share the same IPS service. Figure 5 illustrates some features of these components. 15

16 Figure 5. Juniper Distributed Enterprise components. EX Series Ethernet Switches Juniper EX Series Ethernet Switches (EX2200, EX3200, EX4200, EX4500, and EX8200) deliver carrier class reliability, security risk management, network virtualization, application control, and reduced total cost of ownership (TCO) because of the scalable, pay asyou go architecture. The EX Series switches feature Juniper Networks Virtual Chassis technology, which enables multiple switches to be interconnected and operate as a single system. For example, up to 10 EX4200 switches can be interconnected over a 128 Gigabit per second (Gbps) backplane, creating a single virtual switch supporting up to /100/1000BASE T ports and up to 40 GbE or GbE uplink ports. The EX Series switches also support generic routing encapsulation (GRE) tunneling. This technology allows mirrored traffic to be sent from remote locations to monitoring devices in the network operations center for centralized troubleshooting and analysis. It also supports the construction of segregated overlay networks without the challenges associated with Spanning Tree Protocol (STP). Each of the EX Series switches delivers wire speed performance on all ports for any packet size. For instance, the EX8200 modular switches deliver up to 128 wire speed 10 Gigabit Ethernet ports per chassis with nearly 2 billion packets per second throughput. The 16

17 EX Series switches support eight QoS queues per port, ensuring proper prioritization of control plane, voice, video, and multiple levels of data traffic with room to converge other networks, such as when adding automation and video security systems. Additional features that are VoIP or UC specific include: Support for LLDP and LLDP ME, which enables the switches to automatically discover Ethernet enabled devices, determine their power requirements, and assign virtual LAN (VLAN) parameters. Class 3 PoE with 15.4 W on some or all ports to VoIP phones, closed circuit security cameras, wireless access points, and other IP enabled devices X with VoIP VLAN support, which provides 802.1X (port level) access control as well as Layer 2 4 policy enforcement based on user identity (such as those contained in Microsoft Active Directory), locations, and/or device. M/MX Series with IMSG Juniper M Series Multiservice Edge Routers (M7i, M10i, M120, and M320) have a wide array of WAN interfaces typically deployed in head office locations that require high performance packet processing, such as Internet gateways, WAN aggregation devices, data center routers, or backbone routers. The Juniper MX Series 3D Universal Edge Routers (MX80, MX240, MX480, and MX960), are optimized for Ethernet and provide highperformance and high port density routing and switching in both campus core and aggregation, in data center core and aggregation, and WAN edge. The M and MX Series offer IMSGs with session border control (SBC) in the core, as well as IPS, GW, IPsec, and video QoS monitoring. For the data center or large campus with many endpoints, IMSG provides large scale peering between the enterprise and the carrier or service provider. The Juniper IMSG package is similar to STEP, but can do much more, including the following: Routing SIP properly. Managing trunks and multiple carriers. Controlling bandwidth between the enterprise and the service provider. Providing security to prevent outside attacks. SRX Series Services Gateways for the Branch Juniper Networks SRX Series Services Gateways provide the essential capabilities necessary to connect, secure, and manage enterprise and service provider networks, from the smallest sites to the largest headquarters and data centers. When they consolidate switching, routing, and security services in a single device, organizations can economically deliver new applications and services, secure connectivity, and ensure quality end user experiences. The SRX series is offered in versions for the branch (SRX100, SRX 210, SRX240, and SRX650), and for the data center (SRX3400, SRX3600, SRX5600, and SRX5800). SRX Series Services Gateways for the Branch The SRX Series Services Gateways for the Branch (SRX100, SRX 210, SRX240, and SRX650) combine JUNOS routing, switching and security with integrated convergence services (ICS) security within a single device. Features of the SRX Series Gateways for the Branch include: OCS 2007 R2 compatible Direct SIP Media Gateway Branch SRX Series Media Gateways integrate with OCS, Standalone or Enterprise Edition. This allows customers to adopt and deploy UC at branch locations on a Juniper converged network. 17

18 Onboard PSTN Interfaces These interfaces integrate branch telco lines and analog phones with OCS call routing. o o FXS ports enable existing analog phones, faxes, or PBX systems for OCS across distributed enterprise locations. FX0 ports allow for local PSTN call routing, local access number preservation and direct E911 calling from the branch. Onboard PoE This feature directly powers IP phones or other devices through the Ethernet cable up to 15.4W per port using 802.3af standards. This capability eliminates the need to purchase and deploy a separate PoE switch for smaller branch locations where four or fewer PoE ports are required. STEP onboard SIP trunking STEP is a function embedded within MGW in Branch SRX (no additional license needed). It optimizes media routing to SIP trunking services to assure the highest quality service and security. It also reduces cost and adds survivability and flexibility. This gateway for SIP/RTP traffic going to/from local SIP trunks is responsible for security, topology hiding, QoS, and more. SIP Survivable Call Server (SCS) SCS provides local call handling and call routing for branch analog and IP phones (standard SIP phones) when the centralized SIP call server (or peer call server) that provides them under normal conditions is unreachable. Supported features include class of restriction for stations, auto attendant, call transfer, voic forwarding, three way calls, and more. SRX Series Services Gateways for the Data Center Based on the Dynamic Services Architecture, the SRX Series Services Gateways for the Data Center (SRX3400, SRX3600, SRX5600, and SRX 5800) provide performance, scalability, and security. The SRX Series is designed to meet the network and security requirements for data center consolidation, rapid services deployment, and aggregation of security services such as IPsec tunnels. With the SRX Series Services Gateways, security services such as firewall, application level gateway (ALG), intrusion prevention system (IPS), and IPsec can be applied to all traffic going to/from MGW and the SIP trunk edge point in the branches. Additional Components Additional Juniper solution components include the following. For application acceleration: o WX/WXC Series Application Acceleration Platforms: Deliver fast and consistent application response across the WAN to help ensure uncompromised access to mission critical applications and services. For network management: o Network and Security Manager (NSM): Provides a single pane of management for the entire network infrastructure, including routing, switching, and security devices. o STRM Series Security Threat Response Managers: Collect events and alerts from different Juniper and third party products and aggregate them to deliver an enterprise wide threat management view. For the network operating system: o Junos Software: Integrates routing, switching, and security services, and offers the power of one operating system to reduce complexity, achieve operational excellence, and deliver dynamic services with lower TCO. For security: 18

19 o o SA Series SSL VPN Appliances: Feature best in class performance, scalability, and redundancy for organizations requiring high volume secure access and authorization. Unified Access Control (UAC) Appliances: The IC4500 and IC6500 Unified Access Control Appliances are nextgeneration hardened, centralized policy management servers that deliver superior scalability, performance, and cryptographic operations for large, multinational organizations and government agencies. For services: o J Care Technical Services: J Care Technical Services ensure rapid response from Juniper engineers and offer hardware replacement options so you can choose the timing and resources that are right for your network. For routing: o MX Series Ethernet Services Routers: Provide Ethernet switching capabilities coupled with the carrier class routing features customers expect from Juniper. Table 1 lists the specific Juniper solution components for the distributed enterprise. Table 1. Juniper Solution Components that Enable Microsoft UC. Enterprise Location Routing Switching Security/VPN Access Control WAN Optimization Policy Management Integrated Convergence Services Data center MX960 MX480 MX240 M320 M120 M10i EX820 EX4200 EX3200 ISG2000 ISG1000 NetScreen 5400 NetScreen 5200 IDP8200 SA6500 IC6000 IC4000 WXC Stack WXC3400 WXC2600 WXC590 WXC500 WXC250 IC6000 IC4000 SRX 3000 SRX Series Services Gateways for the Data Center (SRX3400, SRX3600, SRX5600, and SRX 5800) Campus/Headquarters M10i M71 EX8200 EX4200 EX3200 ISG2000 ISG1000 NetScreen 5400 NetScreen 5200 IDP8200 SA6500 SA4500 IC6000 IC4000 WXC3400 WXC2600 WXC590 WXC5000 IC6000 IC4000 SRX 650 SRX Series Services Gateways for the Data Center (SRX3400, SRX3600, SRX5600, and SRX 5800) Medium to Large branches SRX240 SRX650 EX220 EX3200 SRX240 SRX650 SA2500 SA700 IC4000 WXC2600 WXC250 Provided from a central location SRX240 SRX650 Small office/home office SRX210 SRX100 SRX210 SRX100 SRX210 SRX210 WXC250 Provided from a central location SRX210 19

20 Step 1: Design the Network Architecture Quality of Service (QoS) refers to the standards based capability of a network to provide better service to selected network traffic. Considering QoS means that the bandwidth, error rates, and latency are monitored, sampled, and optimized so you can deliver data efficiently by reducing the impact of delay during peak times when networks are approaching full capacity. It also means that network devices are properly configured to respect QoS priority assigned to data packets. QoS does not mean adding capacity; it means managing data traffic better so that top priority traffic is not queued behind lower priority traffic. QoS helps manage the use of bandwidth by applying a set of tools, such as a priority scheme, so that certain packets (such as mission critical or voice and video packets) are forwarded first. End to end QoS is critical for Microsoft OCS and UC applications. These are real time applications that are extremely sensitive to latency, jitter, and packet loss. Failure to implement QoS opens the possibility of contention, or interference from other applications on the network. Simply adding bandwidth does not solve the problem. Even a network with large bandwidth capacity can have poor VoIP call quality due to network contention. Some of the most common challenges associated with deploying UC include: application performance, lack of network infrastructure, insufficient expertise, and lack of bandwidth. Knowing the amount of bandwidth required for voice and video applications helps to determine the amount of WAN/LAN bandwidth needed throughout the distributed enterprise. (Layer 2 headers and IPsec headers should be included in the calculation because they can easily double the amount of bandwidth required.) When planning an OCS implementation, it is also important to consider the possible congestion points. Although several places on the network typically experience congestion, the access level and WAN edge experience the most. This is mainly due to bandwidth mismatch and over subscription. The only way to guarantee service is to enable queuing and policing at any node that has the potential for congestion. In general, to deploy OCS successfully, WAN links must provide policy and compression, and must prioritize voice and video traffic as VoIP moves onto and throughout the WAN; WAN queuing introduces significant delay in VoIP traffic. Data Center Architecture Considerations The data center stores the majority of servers and call controllers and is the termination point for the aggregated WAN and LAN links from the campus/headquarters and from the branches. Frequently, a three layer hierarchical model is used for the network design of a data center; this model permits traffic aggregation and filtering at three successive routing or switching levels, each of which has a specific role: The core layer provides optimal transport between sites. The distribution layer connects network services to the access layer and implements policies regarding security, traffic loading, and routing. The access layer consists of the routers at the edge of the campus networks in a WAN design. In a campus network, the access layer provides switches or hubs for end user access. Typically, a data center has a large number of ports that need to be aggregated, and the three switching layers for aggregating all of the ports are oversubscribed. This leads to delays and inefficiency. The Juniper solution uses High End SRX Series Services Gateways (SRX3400, SRX3600, SRX5600, and SRX 5800) and EX Series switches to simplify the network. The solution collapses the core and distribution layer in the data center into a single layer using the Virtual Chassis technology built into the EX switches. This data center fabric decreases latency and increases availability. 20

21 Note that this solution can also apply to a large campus. Figure 6. Juniper "data center fabric." Campus and Office Considerations For the campus and office (which may be a small office/home office, remote office, or medium to large branch office), considerations center on Layer 3, LAN, Wireless LAN (WLAN), and WAN. Layer 3 Recommendations For Layer 3, you should plan for the use of VLANs groups of devices configured to communicate as if they were attached to the same broadcast domain regardless of their physical location. A VLAN has the same attributes as a physical LAN, but it lets end stations be grouped together even if they are not located on the same network switch. This capability lets you reconfigure the network through software instead of by physically relocating devices and reconnecting cable to different ports. VLANs provide the segmentation services traditionally provided by routers in LAN configurations. VLANs also address issues such as scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, address summarization, and traffic flow management. Juniper recommends keeping the voice and data traffic in separate VLANs. This can be done by either configuring the port as a trunk port or using the VoIP VLAN command feature, which allows both tagged packets and untagged packets on an access port. Packets that are tagged are assigned to the voice VLAN, while untagged packets are assigned to the data VLAN. Once an IP phone has been placed on the network, the branch network infrastructure, services gateway, or switch should be able to auto sense it by using the LLDP MED protocol. (LLDP and LLDP MED are IEEE 802.1AB and IEEE 801.1AB extensions that allow network devices to advertise and receive their identity and capabilities on a LAN segment.) 21

22 LLDP MED offers the following capabilities: Network policy discovery LLDP MED lets endpoints and switches advertise their VLAN IDs (for example, VoIP VLAN), Layer 2 class of server (CoS), and differentiated services code point (DSCP). PoE management LLDP MED lets endpoint devices advertise their actual PoE levels. This helps power sourcing equipment such as switches to allocate and manage their power budget. Inventory management discovery LLDP MED lets switches store endpoint device information such as vendor, model firmware, and serial numbers. This information is accessible from neighboring network devices and provides a means for reporting inventories. IP phones and desktops require an IP address for communication with call servers. DHCP services are either provided locally by EX Series switches or DHCP relay can be used to forward DHCP discovery messages to DHCP servers. Since Layer 3 termination is usually at the aggregation or core layer for a two tier model, DHCP relay is configured at the core switch. In addition, to enable high availability, Virtual Router Redundancy Protocol (VRRP) is implemented at the core switch to provide failover. LAN Considerations An enterprise branch office LAN infrastructure typically comprises one or two layers depending on its size. Small offices or retail stores These normally need five to 50 Ethernet ports, partial or full PoE, and typically use the integrated switching functionality of the branch services gateway device. Medium branch offices of 50 to 100 Ethernet ports These typically use a fixed configuration switch for interconnecting more devices such as laptops, desktops, phones, printers, access points, and security cameras. Larger branch office sites, supporting from 100 to 500 end users These typically have an access layer with multiple access switches in one or many wiring closets. The access layer in the branch LAN hierarchical topology has a specific function. It serves as the periphery of the LAN network and provides interfaces to personal computers, printers, IP phones, and wireless access points deployed within the branch office. When planning the office LAN deployment, you should consider the following: The capacity requirements of the LAN This dictates the speed and number of ports required for connecting all machines at a branch to the LAN. Logical segmentation and how many logically separate networks should share the same LAN Application specific requirements, such as redundancy of LAN switching PoE capabilities of the LAN devices QoS marking at the source Support for 802.1X Available security features such as access control lists (ACLs) Wireless LAN Considerations Wireless access can be found in each type of office. When designing a wireless network, a primary concern is often security. WLANenabled branch products should offer enhanced security functionality for WLAN and should support multiple service set identifiers (SSIDs) per device. By using multiple SSIDs, different security functionality can be used on different wireless networks, providing the 22

23 best in both security and ease of use capabilities. Network architects tend to select the tighter security functionality with WiFi Protected Access (WPA) encryption and 802.1X authentication to provide a truly secure WLAN for the office. Additionally where needed, architects can grant open access to a wireless network with limited risk by employing the user identity based access control Layer 3 and/or Layer 2 security policies to allow different levels of user access for different functional groups (for example, Finance, Human Resources, or engineering departments). For more information about WLAN, see the Juniper Research report, Broadband Wireless LAN. Also, see information about the AX411 WLAN access point at AX Series in the Juniper product documentation. WAN Considerations It is important to consider the competing demands of cost containment and increased network traffic. Since WAN costs typically account for the IT department s highest expenditure after headcount, most enterprises do not have the luxury of simply adding more WAN capacity to their networks. A SOHO or branch office typically uses one or a combination of the following three WAN connection types: Private Management of Point to Point circuits Typically these circuits will provide Layer 2 (L2) connectivity between two locations. A branch office is more likely to use this connection type, typically referred to as L2VPN or private circuits, where locations are permanent and the importance of data communications is high. Provider Provisioned VPN (PPVPN) With PPVPN, the enterprise receives a full mesh of connectivity between multiple nodes. Normally referred to as MPLS L2/L3 VPN, this connectivity is typically managed by the service provider, and the provider manages routing, or metro Ethernet switching if it s L2, to form a full meshed topology. The Internet This is usually a connection between sites over the Internet, wired or wireless, with IPsec tunneling to secure the internal traffic. A WAN optimization and application acceleration platform must have specific attributes in order to overcome the bandwidth, latency, congestion, and manageability issues that impede application performance over the WAN. It must also support QoS and bandwidth optimization features that are critical to deployment of real time applications like voice and video. For information about Juniper WAN acceleration (WX/WXC platforms), see WXC Series in the Juniper product documentation. LAN and WAN Connectivity Recommendations In general, connectivity means providing connections for the LAN, wireless LAN (WLAN), and WAN. The medium to large branch office will generally have to deploy Multiple Protocol Label Switching (MPLS) layer 2 or layer 3 connectivity as well; this is typically deployed transparently by a service provider, offering a reliable VPN service to the enterprise. MPLS networks and network traffic engineering capabilities are typically deployed to configure Label Switch Paths (LSPs) with Resource Reservation Protocol (RSVP) or Label Distribution Protocol (LDP). This is especially critical with voice and video deployments, because QoS can mitigate latency and jitter issues by sending traffic along preferred paths or by enabling fast reroute to anticipate performance problems or failures. You should provide seamless LAN and WLAN connectivity and ensure service availability for the office. Recommendations for office LAN and WAN connectivity include: Flexible connectivity You should ensure flexible connectivity to the WAN and Internet such as Metro WAN as primary and Internet (thirdgeneration wireless or ISDN) as backup that supports a variety of interfaces (third generation wireless, xdsl, cable, T1/E1, DS3, and other) that scale from Kbps speeds to Gbps speeds. 23

24 Split tunneling You should allow for split tunneling so that Internet traffic goes straight to the Internet while data center traffic is tunneled. Sufficient bandwidth You should ensure that sufficient bandwidth is allocated for critical applications, especially with server centralization where most or all applications are accessed from remote data centers. Granular QoS You should support granular QoS so that traffic can be prioritized as real time, business critical, or best effort so that new applications like VoIP and video can be rolled out without requiring any (or little) change to the branch office infrastructure. PoE You should support PoE in order to deploy devices like IP phones, cameras, and similar devices. WAN Connectivity Considerations: Optimize Media Routing To ensure efficient network operation, you must optimize the number of hops (or links) used to minimize delay. Wherever possible, you should explore ways to allow direct media routes. Select the Appropriate High Level Topology There are several ways to optimize media routing by selecting an appropriate high level topology. You can use mesh structured MPLS. Alternately, you can use Internet carried Real time Transport Protocol (RTP) with split VPN tunnels; this allows voice and video traffic to route directly to telecommuters or to other branches if all of the end points register externally and are using full cone NAT. Hub and Spoke Model Because of the cost, scalability, and manageability constraints, traditional private WAN designs usually use a hub and spoke model, implementing either a centralized hub design or a more efficient regional hub design. Under hub and spoke designs, QoS is primarily administered by the hub router, or WAN aggregator, by the enterprise customer. As long as the service provider meets the contracted service levels, the packets received at remote branches reflect the scheduling policies of the WAN aggregator. The WAN aggregator controls not only the campus to branch traffic, but also the branch to branch traffic, which is homed through the hub. (See Figure 7.) Figure 7. Hub and spoke model. 24