HEAnet & The Schools Network

Transcription

1 HEAnet & The Schools Network Presentation to TERENA by Ronan Byrne, Senior Project Manager, HEAnet 24 th October 2005

2 Presentation Structure Schools Network Overview & Responsibilities Access Technologies Project Management Approach Network Design Network Management Provisioning Security Services Services HEAnet Schools NOC Roll-Out Issues & Update

3 Schools Network Overview Free always on broadband connectivity to Schools 3 Year Agreement Dept of Education/Dept of Communication/Telecomms Industry 3,925+ Schools 6 Access Providers HEAnet backbone network Onward connectivity to Internet & Educational Networks HEAnet Managed Services: Network; Security; 1 st Line NCTE Service Desk & 2 nd Line HEAnet Schools NOC

4 Schools Network Activity Responsibility Areas Responsible Party Backbone Network HEAnet Network Monitoring (Backbone & Schools) HEAnet Security Services HEAnet (Tender) Services HEAnet (Tender) 4,000 Router Configurations HEAnet 2 nd Line NOC HEAnet 1 st Line Support Dept of Education Agency (NCTE) School Broadband Connections (& SLA) 6 x Access Providers School Routers Build & Install 1 x Access Provider Security Policy Dept. of Education Policy Dept. of Education

5 Dept of Education Access Tender Evaluation HEAnet Technical Advisors to DES/DCMNR Strong response to RfT Evaluation by Evaluation Team over Sept-Dec 2004 Evaluation of 104 broadband service offerings Evaluation of 85 different router offerings Report to Ministers - Christmas 2004

6 Schools Network by Access Provider 1033 DIGIWEB 1655 BT IRELAND HS DATA LAST MILE 588 IRISH BROADBAND SMART TELECOM

7 Schools Network - Broadband Technologies SATELLITE WIRELESS 1508 DSL/COPPER

8 Schools Network Bandwidth School Tier Total CfT Anticipated Bandwidth Contract Award Bandwidth Schools 512 kbps 1 Mbps 2 Mbps 512 kbps 1 Mbps 2 Mbps POST-PRIMARY Very Large Post-Primary (>1000) Large Post-Primary ( ) Medium Post-Primary ( ) Small Post-Primary (<100) Sub-Totals PRIMARY Large Primary ( ) Medium Primary ( ) 1,388 1, Small Primary (50-99) 1, Very Small Primary (<50) Sub-Totals 3,238 1,707 1, ,453 1, OVERALL TOTALS 3,955 1,707 1, , ,428

9 Project Management Approach

10 Project Management Approach Project Initiation Document (scope, constraints & exclusions) Risk Register Project Financials (by Tender award outcomes) Project Timetable Indemnity Project Organisation

11 HEAnet Project Organisation Executive Board DES, DCMNR, HEAnet, NCTE HEAnet Executive JB / MN / VR / RW Project Manager Ronan Byrne Technical Manager Tim Maher WG8 DES Tender Ronan Byrne WG4 Network Management Ann Harding Colm MacCarthaigh WG9 IP Allocation/ DNS Brian Scanlan WG7 Access Network Dave Wilson WG2 Security Warren Daly WG3 Brian Scanlan WG6 NOC Support Brian Nisbet WG11 PoP Planning Donal Cunningham WG12 Provisioning Donal O Cearbhaill WG10 Web Hosting Colm MacCarthaigh WG8 Access Tender Evaluation Group MN/VR/AB/BC BS/DOC/DW/JL WG5 Trouble Ticketing AB & NCTE

12 HEAnet Schools Team 1 x Senior Project Manager 1 x Technical Project Manager 2 x Systems Administrators 2 x NOC Engineers (2 nd Line)

13 Network Design

14 Schools Network Topology

15 Access Network Principles Layer 2 service from Access Providers PPPoE over L2TP with RADIUS database VLANs (802.1q) and ATM VC s for remaining schools Managed Router in schools (uniform model Cisco 871) Public (HEAnet) IP addresses IPv6 (later service) Multicast (later service) BGP between PoPs OSPF within PoPs Subnet per Access Provider

16 Access Provider Aggregation Overview SERVICE PROVIDER BROADBAND TECHNOLOGY NO. OF SCHOOLS HEANET POP PROPOSED PRESENTATION PROTOCOLS DIGIWEB Satellite 1047 Kilcarberry (& Citywest) GigE VLANs/PPoE Wireless 608 GigE L2TP/PPPOE ESAT BT ADSL 333 Citywest STM-1 VCs per Schools (PPPoE) Leased Line 3 G703 G703 Wireless 3 STM-1 VCs per Schools (PPPoE) SDSL 2 STM-1 VCs per Schools (PPPoE) HS DATA Wireless 94 Citywest FastE L2TP/PPPOE IRISH BROADBAND Wireless 588 Kilcarberry FastE L2TP/PPPOE LAST MILE Wireless 214 Kilcarberry FastE L2TP/PPPOE SMART ADSL 376 Kilcarberry GigE L2TP/PPPOE Satellite 530 GigE UDLR/GRE/PPPOE ULL 127 GigE L2TP/PPPOE Total School Connections 3925

17 Example PoP Layout Kilcarbery Park Schools POP Service provider aggregation router link details are subject to change Aggregation KP-BR1 To HEAnet backbone & internet Servers Digiweb KP-AR1 Radius Tails FW\CFS Smart KP-AR2 Auth DNS Skeletor Recursive DNS Zig Recursive DNS Zag Irish BB KP-AR3 KP-CR1 KP-SR1 DNS Servers Last Mile KP-AR4 Nagios Galvatron Smokeping Guile Cricket Penfold Monitoring Servers HS Data KP-AR5 Ardnet links to CWT-CR1 and BH-CR1

18 Scalability of Network Design /12 IP Address Space = over 1 million public IP addresses solution can accommodate 200,000 mailboxes, scalable up to 800,000 mailboxes Security solution scalable up to 4Gbps (& expandable also)

19 IP Subnet Allocation Very Large Post-Primary (>1000) /23 (510) Large Post-Primary ( ) /24 (254) Medium Post-Primary ( ) /25 (126) Small Post-Primary (<100) /26 (62) Large Primary ( ) /24 (254) Medium Primary ( ) /25 (126) Small Primary (50-99) /27 (30) Very Small Primary (<50) /27 (30)

20 87.47/ / / / / / / / / / / / /16 Infrastructure Link Esat IBB Last Mile HS Data Digiweb Smart Spare 87.34/ / /16 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

21 Network Management Systems

22 HEAnet: Centralised Network Services Monitor schools connectivity Generation of intelligent alerts Monitor services Graph network usage Capacity planning Access Provider measurements vs. SLAs: Latency (RTTs) Packet loss Network availability

23 SmokePing Cricket Nagios

24 Provisioning Systems

25 Provisioning Challenges! individual school router configurations School-specific router configuration Config for each provider/technology Secure URL for delivery of router configurations to eircom Also, configurations for network management tools SmokePing Cricket Nagios Bulk provisioning & push exceptions to 1 st Line NB: AUTHORATIVE DATABASE FOR PROVISIONING

26 Provisioning Model Order Entry SBIS Authoritative DB Work Flow System DNS System IP Allocation Forward/Reverse Zones Config Schools Router PoP Router/Radius Config Network Management/ Monitoring Username/ Password Allocation/Creation Mail/LDAP

27 Security Design

28 Schools Network Security Design

29 Centralised Content Filtering DES Requirement Fortinet solution (best in class) Security node at each PoP 500Mbps capable in-line checking High Availability & ASIC technology Content filtering capability: In-Line Anti-Virus blocking Allow by White List Block by Black List 56 Categories block/allow (CIPA) Database of 28 million rated URLs 24x7 Managed Service Intrusion Detection/Protection System (IDS/IPS) Security Profiles set by Dept of Education

30 Section Lists Level 0 Level 1 Level 2 Level 3 Level 4 Level 5 Scoilnet list (Educational) Allow Allow Allow Allow Allow Allow Scolinet: Irish list of Educational Organisations Allow Allow Allow Allow Allow Allow Scoilnet: Irish List of websites including Gov Websites Allow Allow Allow Allow Allow Allow Whitelist for Level 1 & 2 Allow Allow Allow NA NA NA Whitelist for Levels 3 & 4 Allow NA NA Allow Allow NA Whitelist for Level 5 Allow Allow NA NA NA Allow Blacklist for Level 1 NA Block NA NA NA NA Blacklist for Levels 2 & 3 NA NA Block Block NA NA Blacklist for Levels 4 & 5 NA NA NA NA Block Block Fortinet Category Potentially Liable 1.Abused Drugs Allow Block 2.Cult or Occult Allow Block 3.Hacking Allow Block 4.Illegal or Questionable Allow Block 5.Racism or Hate Allow Block 6.Violence Allow Block Objectionable or Controversial 7.Abortion Allow Allow Allow Block Block Block 8.Adult Materials Allow Block Block Block Block Block 9.Advocacy Groups Allow Allow Allow Block Block Block 10.Alcohol and Tobacco Allow Block 11.Gambling Allow Block 12.Militancy and Extremist Allow Block 13.Nudity Allow Block 14.Pornography Allow Block 15.Tasteless Allow Block 16.Weapons Allow Block Potentially Non-Productive 17.Advertisements Allow Allow Block Block Block Block 18.Brokerage and Trading Allow Allow Allow Block Block Block 19.Freeware and Software Download Allow Allow Block Block Block Block 20.Games Allow Allow Block Block Block Block 21.Internet Communication Allow Allow Block Block Block Block 22.Pay to Surf Allow Block Block Block Block Block 23.Web-based Allow Allow Allow Allow Allow Allow Potentially Bandwidth Consuming 24.File Sharing and Storage Allow Block Block Block Block Block 25.Streaming Media Allow Allow Allow Allow Block Block Potentially Security Violating 26.Malicious Web Sites Allow Block 27.Spyware Allow Block General Interest 28.Arts and Entertainment Allow Allow Allow Allow Block Block 29.Cultural Institutions Allow Allow Allow Allow Allow Block 30.Education Allow Allow Allow Allow Allow Block 31.Financial Data and Services Allow Allow Allow Allow Block Block 32.Gay or Lesbian or Bisexual Interest Allow Allow Allow Block Block Block 33.Health Allow Allow Allow Allow Block Block 34.Job Search Allow Allow Allow Block Block Block 35.Medicine Allow Allow Allow Block Block Block 36.News and Media Allow Allow Allow Block Block Block 37.Personals and Dating Allow Allow Block Block Block Block 38.Political Organizations Allow Allow Allow Allow Block Block 39.Reference Materials Allow Allow Allow Allow Allow Block 40.Religion Allow Allow Allow Allow Block Block 41.Search Engines and Portals Allow Allow Allow Block Block Block 42.Shopping and Auction Allow Allow Allow Block Block Block 43.Social Organizations Allow Allow Allow Allow Block Block 44.Society and Lifestyles Allow Allow Allow Allow Block Block 45.Special Events Allow Allow Allow Block Block Block 46.Sports Allow Allow Allow Allow Allow Block 47.Travel Allow Allow Allow Allow Allow Block 48.Vehicles Allow Allow Allow Allow Block Block Business Oriented 49.Business and Economy Allow Allow Allow Allow Block Block 50.Computer Security Allow Allow Allow Allow Allow Block 51.Government and Legal Organizations Allow Allow Allow Allow Allow Block 52.Information Technology Allow Allow Allow Allow Allow Block 53.Military Organizations Allow Allow Block Block Block Block Others 54.Dynamic Content Allow Allow Allow Allow Block Block 55.Miscellaneous Allow Allow Allow Allow Block Block 56.Web Hosting Allow Allow Allow Block Block Block Unrated Websites Allow Block/Allow Block

31 Services

32 Schools Service DES Requirement Web front end Anti-Spam blocking Anti-Virus blocking LDAP foundation Address list facility Calendar facility Autonomy at school level to administrate some services (e.g. new mailboxes) Scalable to accommodate all staff & pupils Dept of Education set policy

33 Supporting Schools

34 HEAnet Schools NOC Separate to main HEAnet NOC Different customer needs Separate processes 2 nd Line role Shared ticketing system with NCTE De-risk to main HEAnet NOC Dedicated telephone line

35 Support to 1 st Line Service Desk Tailored Network Management Tools Acceptance Test Tools Lot 1 (SmokePing) Lot 2 (Remote Router Login) Documentation Training Installation Troubleshooting Guidelines Technical Advice & FAQs

36 School Support Escalation Channel Freephone Telephone, , fax 2 way communications between schools and the Service Desk Referral* Referrals Schools Service Desk NCTE HEAnet Broadband/ & Router Providers

37 Schools Broadband Roll-Out Update

38 Roll-Out Issues Technology Failures (DSL Copper, LOS) Disabling existing DSL & ISDN Technical Issues MTU / MSS Packet Loss Latency Access to Schools (holidays) Schools AUP Weather!

39 Roll-Out Status Lot 1 (Broadband): Target completion: end 2005 Lot 2 (Routers) : Target completion: end Q HEAnet delivering to project deadlines HEAnet delivering to project budget

40 HEAnet & The Schools Network Presentation to TERENA by Ronan Byrne, Senior Project Manager, HEAnet 24 th October 2005