National Education Network. KAREN School Cluster High-level Design

Transcription

1 National Education Network KAREN School Cluster High-level Design

2 Contents 1 Audience Reference Documents Version control Review and Approval Distribution Background Introduction Regional School Clusters/Loops School Cluster/Loop Trusts Network Services Functions School Cluster Border Router School Cluster Internet Service Provider Physical Last Mile Connectivity School Edge Router/Firewall School Cluster IT Support KAREN School Cluster Design Principles School Cluster Border Router School Edge Router/Firewall Diagram Examples KAREN School Cluster as a single Autonomous System KAREN School Cluster by Function OF 9

3 1 Audience The intended audience for this document are: REANNZ Staff members REANNZ Board members External Interested Parties 2 Reference Documents National Education Network Trial Documentation IP Address Allocation policy Aggregators Policy KAREN Service Portability for the Education Sector Connectivity Standards 3 Version control VERSION DATE REASON FOR UPDATE AUTHOR /08/2011 Document Creation Andrew McKegg /08/2011 Updated Draft Andrew McKegg /08/2011 Second Draft Andrew McKegg /08/2011 Updated & Approved Andrew McKegg 4 Review and Approval This document has been approved for release by the following: NAME ROLE ORGANISATION DATE Mark Cordy Interim Chief Executive REANNZ 09/08/ Distribution This document has been distributed to the following persons or parties: NAME ROLE ORGANISATION Staff Review REANNZ 3 OF 9

4 6 Background 6.1 Introduction The National Education Network (NEN) Trial aimed to provide highperformance network access to a range of learning resources for up to 200 schools, using the backbone infrastructure provided by KAREN (Kiwi Advanced Research and Education Network). School Clusters already connected to open access fibre networks were invited to join the Phase III trial with priority being given to the established loop Clusters in the Manawatu, in Wellington, Nelson-Marlborough, Christchurch and Ashburton. Implementation plans were developed for each geographic Cluster to clarify the actions required and respective responsibilities of the parties involved. This document covers the development of a simple and repeatable KAREN School Cluster high-level design, based on the learnings made as a result of the NEN Trial, in support of the fundamental principles of KAREN, and on designs agreed with the Ministry of Education. The design concept involves considering the KAREN School Cluster as the distributed campus of a single logical entity for the purpose of delivering shared IT services from a variety of Suppliers. 6.2 Regional School Clusters/Loops The rationale behind Regional approach for IP Address allocation is covered in the IP Address Allocation Policy, and also discussed in KAREN Service Portability for the Education Sector. IP address/service Portability is a key design principle; Schools should not be constrained in any way from moving Internet Service Providers. IP addresses that are assigned to the institution will become a unique identifier that does not change when that institution chooses to change Internet Service Provider. The assumption is Schools will move from independently sourcing services, like Internet access, by aggregating their demand on a Local/Regional basis and possibly even a National basis over time. One of the primary goals of the IP Address Allocation policy is to preserve service portability options. 4 OF 9

5 6.3 School Cluster/Loop Trusts Local School Clusters (or loops) are encouraged to form a Trust as a Legal Entity capable of providing the governance, procurement and management of shared resources and services to the constituent members of the Cluster. The formation of a Trust is a straight forward exercise and is critical to the success of local School Clusters realising the full benefit of participation in the School Cluster, National Education Network, and KAREN. Support for this process is available upon request. A School Cluster Trust can be given the authority to enter into commercial arrangements with suppliers to procure Internet connectivity and other services, on the School Cluster s behalf. It is also a prerequisite for the allocation of IP address space and Autonomous System Numbers (ASNs) by REANNZ. 6.4 Network Services Functions The scope of Network Services for the delivery of a KAREN School Cluster can be broken down as follows: School Cluster Border Router The KAREN Distribution Layer has been designed to deliver School Cluster border router functionality. This is to relieve the School Cluster of the administrative burden and cost of delivering a complex routing function. This Service is provided by KAREN, to School Clusters/Loops School Cluster Internet Service Provider The School Cluster Internet Service Provider is procured by the School Cluster Trust. This allows the Cluster to aggregate the individual School s Internet demand/budget, achieve cost savings, and/or other operational benefits Physical Last Mile Connectivity Schools will access KAREN through an Ethernet (preferably optical) connection, delivered by local last mile network service providers. Ideally, each local last mile network service provider will deliver a single shared School Cluster VLAN to both the School Cluster Border Router and 5 OF 9

6 Edge Firewall/Router. The delivery of Ethernet (Layer 2, as oppossed to dark fibre) services by a local last mile network service provider will minimise the number of physical connections required on the School Cluster Border Router. All connections to KAREN must comply meet the KAREN connectivity standards, as described on Local Loop Unbundling (LLU), ADSL, and ADSL2+ present an opportunity to explore alternative last mile connectivity options with the network service provider community, and has not been part of any trials to date. Physical Last Mile connectivity is to be procured by the School Cluster/Loop School Edge Router/Firewall REANNZ RFPs were completed for the bulk procurement of: Compliant edge devices Management of School edge router/firewall This does not preclude the use of alternative compliant edge devices, nor alternative router/firewall management service providers. These Services are to be procured by the School Clusters/Loops either independently, or by contacting REANNZ with regards to the above RFPs School Cluster IT Support Local School Cluster professional IT Support services are expected to be the interface between the KAREN School Cluster and other Service Providers (e.g. KAREN, ISP, Network Device Managers). This would also provide the opportunity to deliver shared services (e.g. Content Filtering, Proxy Servers, Remote Access, SANs, Authentication etc). These Services are to be procured by the School Clusters/Loops. 6 OF 9

7 7 KAREN School Cluster Design Principles 7.1 School Cluster Border Router The School Cluster Border Router is to be delivered via a Virtual Router Instance on the KAREN Distribution Layer MX80. This Virtual Router Instance will be configured for the exclusive purpose of delivering the border router functionality and associated routing policy for the KAREN School Cluster. School Cluster Border Router key design principles: Connected to both the Local Access Service provider and the Internet Service Provider. ibgp peered with each School in the Cluster as a Route Reflector with the KAREN School Cluster ASN. School s private IP prefixes will be redistributed internally. ebgp peered with KAREN, local preference configured in favour of these prefixes. ebgp peered with the ISP, receiving default routes and redistributing them internally. ASN prepending will be configured to prevent asymmetric routing. Management and support provided by the KAREN Help Desk, via the School Cluster IT Support/Wranglers (not end users). 7.2 School Edge Router/Firewall The School edge device key design principles: Ideally connected to a common VLAN to allow direct inter-cluster member connectivity, and in support of BGP 3 rd party next hop (switching as opposed to routing where possible). The School edge router provides the firewalling on behalf of the school. Firewall policy schould be setup on the edge router to ensure all traffic is compliant with the KAREN School Cluster s security & acceptable use policies (e.g. Content Filtering/Proxy Services). Edge router will provide Network Address Translation (NAT) on behalf of the school as an exception only. Kawahiko IP Address allocations used in support of NAT sensitive applications like Video Conferencing etc. 7 OF 9

8 IPv6 allocations to be configured and routed in anticipation of future widespread utilisation. 7.3 Diagram Examples KAREN School Cluster as a single Autonomous System. 8 OF 9

9 7.3.2 KAREN School Cluster by Function. 9 OF 9