1) Will 911 funds pay for the internet connection needed to provide access to ECaTS?

Transcription

1 ECaTS Connection Discussion Excerpt from FAQ Posted on 1) Will 911 funds pay for the internet connection needed to provide access to ECaTS? ECaTS will use an existing internet connection. The Direct Technology Project Manager will work closely with all the required parties to ensure appropriate support from Telecommunication Vendors, CPE Support Vendors, NC 911 Board and the PSAPs in the scheduling and installation of each visit. Direct Technology will be responsible for scheduling and deploying a team of Field Engineers using a multi-site deployment technique. Field Engineers will arrive at each site on the pre-determined date as agreed by each affected PSAP and will perform, at a minimum, the following tasks: Install the RDDM buffer box in brackets for rack mount or in brackets for wall mount; Install power cord to buffer box; Validate circuit, CPE inventory and trunk grouping information with preliminary data; Connect laptop to the buffer box and validate configuration of circuits, CPE and trunk group information; Install new or remove existing Y or straight serial cable from the router and connect to buffer box; Begin CDR capturing test using local laptop connected to the RDDM box: o Analyze incoming data stream for validity (baud rate, parity bit, etc.) o Validate expected parsing format o Validate circuit display information o Validate compression utility o Validate encryption utility Install network connection or dial up line to the RDDM buffer box: o If network connection, then validate IP address and ability to get to the using the laptop connected to the RDDM buffer box o If a non network connection then: Validate connectivity from the PSAP to the Data Center Validate Access to Data Center Regional Collectors Network Access Test Response Times Network Routing Tests Hang up Configure Automated Dial up Routines

2 1 Requirements 1. One (1) RDDM (Remote Data Distribution Module) 2. An active and available CDR port on the CPE equipment which will provide the call data 3. One (1) Y cable if data feed needs to be split. 4. If required, an escort for the ECaTS Field Engineer to install and configure the RDDM 5. Rack space for a 1U 19 inch device 6. If a modem is used, will need a shelf in the rack for the modem. 2 Preparation 1. Data a. CDR Port should be actively sending data, this can be tested with a serial printer b. Control Leads on the CDR port should be active and the pin out configuration should be provided either before the tech arrives or on site. 2. Connectivity a. For DSL: i. Modem and router have been put in place ii. Port forwarding for inbound requests has been configured 1. Port 22 (TCP) 2. If an enhanced RDDM* is in place port 3389 as well (TCP/UDP) iii. LAN side IP has been set as static IP which will be assigned to the RDDM b. For LAN sharing (ECaTS shares the existing network) i. Identify the switch the RDDM will connect to ii. Identify the switch port the RDDM will plug into iii. Ensure network routes between the switch and gateway are in place iv. See the security section for ports and IP s to allow. 3 Network Configuration This section is only required for an ECaTS deployment that does not use a dial-up connection. In those instances, either a DSL line will be used, or the PSAP/ILEC will enable ECaTS to share the existing network. The information contained below describes a DSL deployment, however, the same configuration requirements exist for share LAN deployments as well the only difference is there is no DSL connect rather the PSAP uses their existing routers to move traffic. How ECaTS Works ECaTS connects to the CPE (Customer Premise Equipment) via a RS232 port. This port supplies our RDDM or buffer box with all of the CDR (Call Detail Records). Once

3 the RDDM receives a call it is then encrypted and compressed and sent to our data center in Sacramento, CA via sftp. The Figures below represent the three types of connectivity configuration available for the RDDM to uplink to the internet in order to deliver the data payloads. PSAP Phone Room ECaTS approved users access CDR data via the web 911 Equipment (ex: Vesta, Sentinel, Viper, etc) ACCREDITATION BOUNDARY External RS232 CDR Printer Port interface Serial Interface (RS-232) Firewall DSL Modem RDDM Remote Data Distribution Module buffers each 911 Call Detail Record (ANI, ALI, Timestamp) over DSL out modem ECaTS Data Center Provides secure, web based E911 call reporting capabilities to PSAP s. Herakles Data Center - Sacramento, CA FIGURE 1 RDDM DSL NETWORK TOPOGRAPHY

4 PSAP Phone Room ECaTS approved users access CDR data via the web 911 Equipment (ex: Vesta, Sentinel, Viper, etc) ACCREDITATION BOUNDARY External RS232 CDR Printer Port interface Serial Interface (RS-232) Secure VPN Connection Over PSAP Switch PSAP (connects RDDM to network) Firewall/Router RDDM Remote Data Distribution Module buffers each 911 Call Detail Record (ANI, ALI, Timestamp) over shared network with VPN connectivity. ECaTS Data Center Provides secure, web based E911 call reporting capabilities to PSAP s. Herakles Data Center - Sacramento, CA *Each PSAP will be configured a little differently depending on local environmental constraints. FIGURE 2 RDDM SHARED NETWORK/VPN TOPOGRAPHY

5 PSAP Phone Room ECaTS approved users access CDR data via the web 911 Equipment (ex: Vesta, Sentinel, Viper, etc) ACCREDITATION BOUNDARY External RS232 CDR Printer Port interface Serial Interface (RS-232) USR 56K Modem RDDM Remote Data Distribution Module buffers each 911 Call Detail Record (ANI, ALI, Timestamp) over dial out modem ECaTS Data Center Provides secure, web based E911 call reporting capabilities to PSAP s. Herakles Data Center - Sacramento, CA FIGURE 3 RDDM DIAL UP MODEM TOPOGRAPHY Connection Information Requirements to set up ECaTS for a DSL or a Shared Network connection: 1. The IP address must be made public ECaTS manages the RDDM (Remote Data Distribution Module) or buffer box remotely. There may be an internal and external IP address depending on your network configuration, please send both. Supply Subnet, Gateway & DNS information Please send this IP address to [email protected]. 2. Allow bidirectional traffic between the RDDM and our Data center for the addresses below:

6 4 Security Considerations Security considerations vary depending on the type of connectivity that is used for the RDDM. 1. Security Considerations for Dial Up Modems are directly connected to the RDDM and do not present a new network, there are no real considerations with this configuration as the RDDM is completely isolated from the CPE equipment with exception of the serial feed from the CDR port, which itself is one way. 2. Security Considerations for DSL DSL router/modem will need to connect to RDDM device Firewall/router configurations for DSL line must have the proper ports open, see section 4 below. If DSL router/modem is plugged into a switch, ideally a VLAN should be established between the RDDM and DSL router/modem to isolate the traffic within the switch. 3. Security Considerations for LAN RDDM is likely sharing a segment with current PSAP traffic If needed, create VLAN s to segment ECaTS traffic from the rest of the network Firewall/router configurations need to have the proper ports open, see section 4 below. 4. Port forwarding for DSL/Shared LAN installation: Port 22 (SSH / sftp) o TCP in and out traffic Port 123 (NTP) o UDP/ outbound traffic only Port 53 (DNS) o UDP out traffic. Port 443 (HTTPS) o TCP outgoing

7 From: Tina Bone Sent: Tuesday, August 07, :52 PM To: Dodd, David D Cc: Doug Hammond; Pair, Donna L; Allen Moore; Linda Jones; Leigh Parker Subject: Re: question David, Thank you so much for your timely response regarding ECATS. We have 2 issues regarding ECATS: connectivity and the security/integrity of our 911 system. At this time, the city's Information Systems team will not allow a connection from Direct Technology for ECATS, and I have recommended to the command staff to not allow a modem to be connected to an administrative line. There are too many "if's" in both scenarios. However; I would like to explore the option of having a DSL or cable connection for ECATS, but it would have to be fully funded by 911 funds and meet certain security criteria. Even though we will not be implementing ECATS at this time, we would still like to be informed of its progress with other agencies and kept up to date of the 911 boards decisions regarding "standalone", if you will, service for ECATS. Thanks again for all that you do! Tina Bone Here is the I got from Jeff Wilson at Holly Springs, which came from Doug Hammond at Direct Technologies. His concerns are (1) allowing Direct Technologies access to their network, and (20 tying up a very limited number of admin phone lines on a dial up connection for them to manage and maintain the RDDM.

8 Jeff Wilson IT Director Town of Holly Springs PO Box South Main St Holly Springs, NC