Group Member Access LCH.Clearnet Ltd Network Connectivity Guide () Owner: Director, Commercial Services Document Version Number: 1.0 Issue Date: 22 June 2009
COPYRIGHT The copyright in this work is vested in LCH.Clearnet Limited. It must not be reproduced in whole or in part without the prior written consent of LCH.Clearnet Limited and then only on the condition that this notice is included in any such reproduction. 2009 LCH.Clearnet Limited, 33 Aldgate High Street, London, EC3N 1EA LEGAL NOTICE This Member Connectivity Guide () does not constitute a contractual agreement between LCH.Clearnet Ltd, its clearing members or any other entities. The contents of the Member Connectivity Guide () do not constitute a representation, warranty or undertaking of any kind to clearing members by LCH.Clearnet Ltd or. The contractual relationship relating to the provision of the network by LCH.Clearnet Ltd is governed entirely by the Network Services Agreement as executed by LCH.Clearnet Ltd and its clearing member(s) in advance of the provision of the network. No party shall have any remedy in respect of misrepresentation or untrue statement contained in this Member Connectivity Guide (). LCH.Clearnet Ltd and Members Only This document can be freely distributed within LCH.Clearnet Limited and Member organisations but should not be copied beyond these limits without the agreement of the information owner. TRADEMARKS All trademarks are duly acknowledged. and RadianzNet are the registered trademarks of British Telecommunications plc.
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () Contents 1. Introduction 1 1.1 Background ----------------------------------------------------------------------------------------- 1 1.2 Purpose of the guide ----------------------------------------------------------------------------- 1 1.3 Contact information ------------------------------------------------------------------------------- 1 1.4 Abbreviations --------------------------------------------------------------------------------------- 2 1.5 Related documents ------------------------------------------------------------------------------- 2 2. Network overview 3 2.1 Architecture ----------------------------------------------------------------------------------------- 3 2.2 Connectivity ----------------------------------------------------------------------------------------- 4 2.2.1 Resilience... 4 2.2.2 Network Security... 4 2.2.3 Capacity... 4 2.2.4 Local Access Providers... 4 3. Network connection policies 5 3.1 Common Member connectivity option -------------------------------------------------------- 5 3.2 connections ------------------------------------------------------------------------- 5 3.2.1 Bronze service connectivity... 6 3.2.2 Silver service connectivity... 7 3.2.3 Silver Split-Site service connectivity... 8 3.2.4 Gold service connectivity... 9 3.2.5 Platinum service connectivity... 10 3.3 Member responsibilities ------------------------------------------------------------------------ 10 3.3.1 Network demarcation... 11 3.3.2 Connectivity problems... 11 3.4 Maintenance -------------------------------------------------------------------------------------- 11 3.5 Data Centre fail-over --------------------------------------------------------------------------- 11 3.5.1 LCH.Clearnet Ltd business continuity... 11 3.5.2 Member business continuity... 11 3.6 Relocation of service --------------------------------------------------------------------------- 12 4. Continuity and Security 13 4.1 Continuity ------------------------------------------------------------------------------------------ 13 4.2 Security -------------------------------------------------------------------------------------------- 13 4.3 Physical security --------------------------------------------------------------------------------- 13 Appendix A. provisioning process 14 A.1 Contractual framework ------------------------------------------------------------------------- 14 A.2 Ordering ------------------------------------------------------------------------------------------- 14 A.3 Timeline ------------------------------------------------------------------------------------------- 15 LCH.Clearnet and Members Only i
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () Figures Figure 1: General network architecture --------------------------------------------------------------------- 3 Figure 2: Bronze single minimum 2Mbps test access (Ltd) or minimum 4Mbps test access (Group) ------------------------------------------------------------------------------------------------------- 6 Figure 3: Silver resilient minimum 2Mbps single site (Ltd) or minimum 4Mbps single site (Group) ------------------------------------------------------------------------------------------------------- 7 Figure 4: Silver resilient minimum 2Mbps split sites (Ltd) or minimum 4Mbps split sites (Group) ------------------------------------------------------------------------------------------------------- 8 Figure 5: Gold resilient access on main site and single access on other site --------------------- 9 Figure 6: Platinum resilient access on dual sites ------------------------------------------------------- 10 Figure 7: Contractual framework outline ----------------------------------------------------------------- 14 LCH.Clearnet and Members Only ii
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 1. Introduction 1.1 Background LCH.Clearnet Ltd is using as part of the Group Member Access (GMA) strategy to provide Members with network connectivity to its clearing applications. This guide explains the connectivity options available to LCH.Clearnet Ltd Members for connecting via. 1.2 Purpose of the guide The intention of this guide is to provide LCH.Clearnet Ltd Members with a high-level technical overview of the options available for connecting to LCH.Clearnet Ltd s clearing service via. This information will assist Members in their decision making process of how best to connect to LCH.Clearnet Ltd services. Members are then invited to discuss their connectivity preferences further with both LCH.Clearnet Ltd and technical staff with the intention of reaching a preferred network topology decision. The practical process of connection to will involve Member specific detailed technical discussions, including agreeing IP addressing details and identifying network demarcation points. This level of detail is not included in this high level guide. Please note: only provides a path, which is dependent on the service tier selected, to the clearing applications. Consequently, this guide addresses connectivity to at network level only. LCH.Clearnet Ltd will from time to time refine this document to reflect the ongoing development of the clearing services. Amended versions of this document will therefore be issued accordingly. 1.3 Contact information For technical issues and other queries relating to the managed network service provided by for LCH.Clearnet Ltd, Members need to contact the Service Desk: telephone on +44 (0) 20 7426 7200 Or, e-mail ServiceDesk@lchclearnet.com Version 1.0-22 June 2009 LCH.Clearnet and Members Only 1 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 1.4 Abbreviations The following table defines the abbreviations used within this document. Abbreviation BC CE GMA HA ISV MMTP NAT NSRP POP SPOF TCP/IP VPN Definition Business Continuity Customer Edge Group Member Access High Availability Independent Software Vendors Multimedia Multiplexing Transport Protocol Network Address Translation NetScreen Redundancy Protocol Point of Presence (of a network solution provider) Single Point of Failure Transmission Control Protocol/Internet Protocol Virtual Private Network 1.5 Related documents This document is one of a set of documents, listed below: Managed Service Network Order Form Network Services Agreement Version 1.0-22 June 2009 LCH.Clearnet and Members Only 2 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 2. Network overview LCH.Clearnet Ltd has chosen as the network service provider for its clearing services. owns and operates RadianzNet, an IP-based global financial extranet that provides highly reliable and scalable network services. RadianzNet connects North America, Europe and Asia to provide a 24*7 Follow the Sun service. 2.1 Architecture Figure 1 illustrates the general network architecture, using, between the Member and LCH.Clearnet Ltd. LCH.Clearnet Services Resilient access Group Member Access 2 10Mbps resilient & secured access POP Net Managed VPN routers LCH.Clearnet Ltd Datacentre Managed VPN routers POP LCH.Clearnet Services Member Site Resilient access Managed VPN routers LCH.Clearnet Ltd Datacentre RadianzNet secured resilient managed connection Figure 1: General network architecture The Group Member Access (GMA) managed service network solution provides a secure and resilient network which guarantees enhanced levels of performance over the legacy network it replaces. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 3 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 2.2 Connectivity 2.2.1 Resilience A GMA standard access is constructed using two diversely provided telecom circuits connecting the Member site to LCH.Clearnet Ltd. In the standard configuration one network path is active and the other passive. Members can choose their network topology for standard connectivity. The following connectivity options are available: Silver Single Member site connecting to RadianzNet via two diversely provided access circuits. Split-Site Silver 1 Dual Member sites, accessed via two circuits with one circuit to each site. Gold - Dual Member sites, the site accessed via two circuits, and the site via a single circuit. Platinum Dual Member sites, each connected via dual diversely provided circuits. Bronze Single circuit access. For sites where dual circuit access is required this is always provided (where available) by two different Telecom Path Providers and connecting to physically separate POPs (network Points of Presence) on RadianzNet. 2.2.2 Network Security 2.2.3 Capacity Logical security is enforced by VPN Encryption Gateways located on Member premises. Each GMA network path has its own distinct VPN Encryption Gateway. Members can connect via RadianzNet to LCH.Clearnet Ltd services in a scalable manner in 2Mbps steps from 2Mbps to 10Mbps. constantly monitors bandwidth utilisation at each RadianzNet POP to ensure threshold limits are not exceeded. provides bandwidth allocation on the last mile to guarantee service delivery to subscribers on RadianzNet. 2.2.4 Local Access Providers In order to provide physical path separation utilise multiple telecom path providers for local loop access. For LCH.Clearnet Limited the prime suppliers for local access circuitry are COLT & Verizon Business, with a third alternative being BT 2. 1 Members must provide Layer 2 connectivity between their sites in order for this Silver option to function. 2 The precise choice of local access circuit suppliers will depend on geography and other factors. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 4 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3. Network connection policies This section describes LCH.Clearnet Ltd s policies with respect to a BT Radianz network connection. connects Members to the clearing service through its IP-based RadianzNet network. Policies will be updated when new applications, technologies and standards are agreed and implemented. 3.1 Common Member connectivity option Members requiring to connect to both LCH.Clearnet Ltd and LCH.Clearnet SA clearing services through GMA will require, subject to confirmation, a minimum bandwidth network path of 4Mbps; 2Mbps for each service. These network paths do not contend and are presented as unique physical ports on the VPN Terminating device, typically a Juniper. 3.2 connections will install, configure and monitor the network routers, switches and IPSec-based VPN devices at Member sites. The network provides access to the clearing service of LCH.Clearnet Ltd and is based on Cisco Systems network infrastructure platforms, which include Cisco routers at Member sites and LCH.Clearnet Ltd, primary and secondary data centres. A standard Member connection is two fibre leased-line circuits at a minimum speed of 2Mbps provided by diverse local loop Telecoms providers. The bandwidth is scalable from 2Mbps to 10Mbps in 2Mbps increments, dependent on users clearing activity profile. The minimum bandwidth requirements will be agreed between the parties concerned during further negotiations. Member connection is provided through one of five tiers: Version 1.0-22 June 2009 LCH.Clearnet and Members Only 5 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.2.1 Bronze service connectivity LCH.Clearnet Ltd Services LCH.Clearnet SA Services LCH.Clearnet Ltd Services Net Secured IP Network Net Secured IP Network POP1 POP1 2Mbps single access 4Mbps single access Member LAN internal @IP Member LAN internal @IP Test Test Member Site Member Site Figure 2: Bronze single minimum 2Mbps test access (Ltd) or minimum 4Mbps test access (Group) Bronze Service key points: A single, non-resilient connection of between 2Mbps and 10Mbps to a single site. Typically used for connectivity to a Members 3rd site or to access an ISV. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 6 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.2.2 Silver service connectivity LCH.Clearnet Ltd Services LCH.Clearnet SA Services LCH.Clearnet Ltd Services Net Secured IP Network Net Secured IP Network POP1 POP2 POP1 POP2 2Mbps resilient access 4Mbps resilient access Untrust LAN Untrust LAN NSRP & HA VPN Gateway NSRP & HA VPN Gateway Member LAN internal @IP Member LAN internal @IP Member Site Member Site Figure 3: Silver resilient minimum 2Mbps single site (Ltd) or minimum 4Mbps single site (Group) Silver Service key points: A single site, resilient connection of between 2Mbps and 10Mbps. Two access circuits typically provider by alternative Telco path providers. This tier option is a typical choice by Members without a separate BCP site. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 7 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.2.3 Silver Split-Site service connectivity LCH.Clearnet Ltd Services LCH.Clearnet SA Services LCH.Clearnet Ltd Services Net Secured IP Network Net Secured IP Network POP1 POP2 POP1 POP2 2Mbps resilient access 4Mbps resilient access VPN Gateway VPN Gateway Member Site - A Member Site - B Member Site - A Member Site - B Figure 4: Silver resilient minimum 2Mbps split sites (Ltd) or minimum 4Mbps split sites (Group) Silver Service split-site key points: Single non-resilient connections of between 2Mbps and 10Mbps to each of two Member sites Circuits provided by alternate Telco path providers. Member sites connected at Member s own Layer 2 network path. Typically this will be provided for Members who have already standardised on this delivery topology with. Within this tier, there are two options available: Option 1 resilient split site Layer 2 with Untrust shared LAN provided Option 2 - resilient split site Layer 2 with no Untrust shared LAN provided Version 1.0-22 June 2009 LCH.Clearnet and Members Only 8 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.2.4 Gold service connectivity LCH.Clearnet SA Services LCH.Clearnet Ltd Services Net Secured IP Network POP1 POP2 Untrust LAN VPN Gateway NSRP & HA VPN Gateway VPN Gateway Member LAN internal @IP Member LAN internal @IP Member Site Member Site - B Figure 5: Gold resilient access on main site and single access on other site Gold Service key points: Connection based on three circuits of between 2Mbps and 10Mbps on two different Member sites. On the Member s primary site, resilient access is provided using two network paths from alternate local circuit providers. The secondary Member site is connected by a single network path. This tier option is a typical choice by Members requiring to connect to 2 sites. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 9 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.2.5 Platinum service connectivity LCH.Clearnet SA Services LCH.Clearnet Ltd Services Net Secured IP Network POP1 POP2 Untrust LAN Untrust LAN NSRP & HA NSRP & HA Member LAN internal @IP Member LAN internal @IP Member Site - A Member Site - B Figure 6: Platinum resilient access on dual sites Platinum Service key points: Connection provided to two Member sites using dual, resilient network paths of between 2Mbps and 10Mbps. Each site is connected by two physically separate network paths provided by alternate carriers. 3.3 Member responsibilities Members responsibilities are detailed in the Network Services Agreement they have signed with LCH.Clearnet Ltd. It is expected that the Member will provide all structured cabling between their equipment and the managed VPN routers. Members are also expected to provide adequate space to house the equipment and the necessary power and other environmental provisions that are deemed necessary to effectively operate the equipment. Members connecting via the Split-site Silver option will be required to confirm Layer 2 connectivity and that suitable failover arrangements are in place. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 10 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () Any connection between the network equipment and the Member s LAN must go via a firewall or router capable of performing Network Address Translation. The connection must be provided and managed by the Member. Network Address Translation (NAT) should take place according to LCH.Clearnet Ltd addressing standards. 3.3.1 Network demarcation The network demarcation point on the Member site is the output port of the IPSec VPN Terminating device, typically an SSG20 or SSG140 Juniper. 3.3.2 Connectivity problems Any issues associated with the LCH.Clearnet Ltd service, whether application or technology related, should always be reported to the LCH.Clearnet Ltd Service Desk (see section 1.3 Contact information). The LCH.Clearnet Ltd Service Desk will make every effort to assist Members with all service related matters. The LCH.Clearnet Ltd Service Desk will analyse the reported issue and determine whether the issue is application or technology related. If this analysis indicates that the matter relates to the network service then LCH.Clearnet Ltd s technical staff will formally raise the matter directly with the Global Service Centre for resolution and will cooperate with the RadianzNet technical staff to resolve the matter. 3.4 Maintenance is responsible for maintaining all RadianzNet equipment on Member sites. 3.5 Data Centre fail-over 3.5.1 LCH.Clearnet Ltd business continuity LCH.Clearnet Ltd hosts its clearing services from two geographically separated, purpose built data centre sites. Under normal operational conditions, all production services are provided from the primary data centre. In the event that it is not possible to deliver the service from the primary data centre, operations are switched to the secondary data centre. The failover between data centres is transparent to Members. 3.5.2 Member business continuity LCH.Clearnet Ltd recognises that Members will have implemented varying capabilities for business continuity and recovery. To accommodate the diversity of requirements, there is the capability to connect Member BC site(s) to the network. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 11 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 3.6 Relocation of service Should a Member have the requirement to modify their connection arrangements with LCH.Clearnet they should contact the LCH.Clearnet Ltd Service Desk, supplying details of the new location and the site to be decommissioned. The LCH.Clearnet Ltd Service Desk will manage the network connectivity process on behalf of the Member and will provide the Member will the relevant documentation and will notify the relevant LCH.Clearnet Ltd Commercial Services contact. Once the documentation has been signed and full details supplied, the forms should be returned to the LCH.Clearnet Ltd Service Desk for action. Members can contact the LCH.Clearnet Ltd Service Desk for details of costs and lead times for relocation solutions. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 12 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () 4. Continuity and Security The new Member Network Connectivity solution is based on a trusted third party managed network service provided by. 4.1 Continuity Excluding the Bronze Service tier option, all other network topologies provided are resilient. The LCH.Clearnet Ltd service is accessed via a managed service comprising; 4.2 Security Resilient Site Equipment: Dual network equipment on Member site with active failover mechanisms operative. Dual Site Carrier Access: Resilient site access with no SPOF (Single Point of Failure) based on dual alternate carriers. Core Network: Secured and fully-meshed. Resilient Provider Service: LCH.Clearnet Ltd connect to RadianzNet via multiple network paths provided by alternate carriers. All data centre infrastructure is dual provisioned with automatic fail over. The security aspects (encryption and authentication) are provided by the new GMA network, with end-to-end VPN tunnelling based on IPSec protocol (the VPN gateway is fully managed by ). All data flows are secured by this VPN layer. 4.3 Physical security The Member is responsible for the physical security of the equipment installed on their site and for ensuring that it is provided with a stable power supply. The building within which the equipment is located must have an adequate level of physical and environmental security. The equipment itself should be located within a locked room with access controlled on a need-to-go basis. The Member is expected to insure the equipment installed on their site; details are provided in the LCH.Clearnet Ltd Terms and Conditions of service. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 13 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () Appendix A. provisioning process A.1 Contractual framework The diagram below shows the contractual arrangement between the three parties involved in the provisioning of the network services described in this document. In essence LCH.Clearnet Ltd has a contract in place with BT Radianz. A separate contract exists between each Member and LCH.Clearnet Ltd regarding the connectivity necessary to access LCH.Clearnet services. 1 LCH.Clearnet Ltd 2 Agreement = Member Order Form + Network Service Agreement Members / ISVs Figure 7: Contractual framework outline 1. A Framework Services Contract (Master Services Agreement) is in place between and LCH.Clearnet giving the right to LCH.Clearnet Ltd to offer Members access to their clearing services over the BT Radianz network (RadianzNet). 2. An Order Form and Network Service Agreement is signed between the Member and LCH.Clearnet defining the provision of the Member network service necessary for accessing the LCH.Clearnet clearing applications. Please note: LCH.Clearnet Ltd will bill Members. A.2 Ordering Members who want to order the network service must complete a Managed Network Service Order Form and return it to LCH.Clearnet Ltd. Typically, will carry out the following activities: 1. Confirm the circuit termination details with the Member 2. Process and validate orders within 3. Perform site surveys at Members sites Version 1.0-22 June 2009 LCH.Clearnet and Members Only 14 of 15
LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide () A.3 Timeline 4. Provision local access circuits as necessary 5. Confirm local access lead times and liaise with the Member 6. Confirm IP address details with Members and prepare router configurations 7. Install Member site equipment as necessary 8. Download router and VPN configurations 9. Perform technical acceptance testing with the Member The provisioning lead times of the new Member network service over BT Radianz is dependent on whether the Members is already connected to RadianzNet for access to other services or not. For LCH.Clearnet services the network service level agreement (SLA) for network delivery is as follows: 1. For Members who are already connected to RadianzNet, and whose existing connectivity paths have sufficient capacity, the network delivery lead time is 39 working days. 2. For Members who are not already connected to RadianzNet the network delivery lead time is 69 working days. Version 1.0-22 June 2009 LCH.Clearnet and Members Only 15 of 15