WHITEPAPER Expediting Migration of Critical Legacy Applications to Modern Defense IP Networks Written by Rosemarie D Agostino Cornet Technology, Inc. October 2012
Expediting Migration of Critical Legacy Applications to Modern Defense IP Networks The battle cry among Department of Defense (DoD) Chief Information Officers (CIO) is Increase mission effectiveness, improve cyber security, and deliver cost and manpower efficiencies. To that end all defense agencies are looking for ways to: Ensure that the warfighter across all agencies receives all the information needed to effectively carry out a mission, Assure that information is secure, Deliver the information in a cost efficient manner Tear down stove-piped networks This paper addresses how Cornet Technology s IPGate solutions tackle these requirements by inherently connecting legacy Time Division Multiplexing (TDM) and other circuit/serial based applications over standard-based IP networks. IPGate solutions ensure that those critical applications that cannot quickly and cost effectively be modernized can still play an effective role in the new defense communications strategy. Cornet Technology, Inc. (CTI) has over 23 years of experience in providing government agencies with networking solutions that are built to government standards and interoperability requirements. CTI s switching solutions have played a significant role in network operability, providing the ability to switch virtually all available interfaces required for today s communication environment. These interfaces range from low speed Voice Frequency (VF) to high speed digital, narrow and wide band voice, and video. Building on its tech control expertise in operational control, test and monitoring of TDM and, serial circuit legacy technologies, Cornet Technology has designed a family of products that give governments worldwide the ability to interface their legacy networks with IP networks to provide a smooth and cost effective IP migration path while managing the existing infrastructure. 1
Traditionally, DoD s information networks have grown on an as-needed basis, leading to organization centric networks that cannot be easily integrated and are inadequate for today s needs. This model may have worked in the 20 th century but will not be effective in the 21 st where reliance on inter and intra agency information has taken a preeminent role in warfare and the emphasis on cost reduction and cyber security have become paramount necessities. Figure 1 Goals Deliver a streamlined, rationalized, and simpler network by consolidating infrastructure across DoD. This aggressive consolidation cannot, however, come at the price of degraded capabilities for the warfighter or inflexible commitment to specific technological solutions. Provide DoD with sufficient flexibility to respond to and incorporate emerging technology and to identify and take appropriate actions for those efforts that are not producing Teri M. Takai, DoD Chief Info officer Increase mission effectiveness, improve cyber security, and deliver cost and manpower efficiencies To help achieve the above goals, the DoD is looking to data center and network reduction, as well as data convergence. While business applications such as finance, logistics support, personnel, email etc. can be standardized to achieve unanimity and cost savings across agencies, this is not true for many legacy tactical applications. Allowing legacy tactical applications to take advantage of the benefits of modern technologies, such as IP networks, fall to solutions such as CTI s IPGate. IPGate TDM serialcircuit to packet solutions provides the advanced technology required to transport and migrate legacy tactical applications across IP networks. The IPGate combines serial data 2
and/or voice communication streams into an IP packet at one end of the network, sends them over the IP network, and then provides the necessary processing to regenerate them at the other end with minimal latency while still maintaining T1/E1 access points. Migrating tactical applications to IP networks allows DoD to eliminate dedicated TDM trunks and expensive leased-lines, serial line encryption devices, digital and analog voice trunks and other legacy serial data connections. By collapsing all network traffic onto IP networks, networks are simplified and equipment and manpower costs are greatly reduced. With IPGate, tactical application users can easily and reliably take advantage of converged IP networks as well as allow quick network upgrades to SIP, IP, and MPLS levels. Recent advances in bulk encryption technology can now be utilized to secure this IP data stream at a fraction of the cost. In addition to the primary function of converting legacy TDM and serial-based endpoints to IP, each IPGate has the ability to provide circuit monitor and legacy interface break functions. This bus function permits a tech control operator to test a connection anywhere in the network. The ability to test and monitor the legacy portion of a circuit is unique to the IPGate family. It is an invaluable aid in diagnosing network problems thus reducing the time to restore service. Bringing Legacy Circuits to the IP Network Government agencies are moving quickly to take advantage of modern IP networks; however, a sizeable number of proprietary circuit-based applications still exist. The Cornet Technology IPGate allows government agencies to maintain their investment in legacy TDM, PBX and encryption devices while preparing, both monetarily and technically, to take advantage of IPbased services when appropriate. Figure 2 3
Moving TDM to IP Government organizations still use TDM to aggregate and transport voice and data applications across higher speed connections. Often these legacy systems result in stovepipes that preclude interoperability. As seen in Figure 2, Cornet Technology s IPGate-AC provides network access to these stove pipes by aggregating various legacy interface technologies, encapsulating them into an IP packet and transmitting them over the IP Network to a de-encapsulating IPGate anywhere in the network that restores the data to its original format. In situations requiring both TDM and modern IP networking, the IPGate supports both. PBX over IP Many existing government PBX-systems still connect via costly point-to-point or private T1 lines, to ensure quality and privacy, or connect via satellite links. These lines are expensive and require dedicated management systems. IPGate offers a PBX over IP function that ensures reliable transfer of each voice link through the IP network to the remote end. With the IPGate-AC s routing priority features, each packet is delivered promptly allowing seamless voice connections and error-free data delivery, all with no changes to the existing applications or hardware. The IPGate eliminates the need for costly leased lines between locations. Serial Encryptions Devices Secret or Top Secret secure government communication is accomplished through the use of non-ip encryption devices connected to point-to-point or private lines. The IPGate-AC allows these lines to connect to an IP network so that there are less encryption devices needed and less networks to watch. Additionally, the IPGate support bulk encryption devices on IP trunks. IPGate Technology As discussed, Cornet Technology s IPGate series of serial over packets solutions aid government agencies in the migration of their serial and TDM applications to IP technology. To do this TDMoIP technology is used to provide the functions required for translating TDM data streams into and out of TDM-over-Packet data streams. TDMoIP Before addressing TDMoIP a brief discussion of TDM and Packet Switch Network (PSN) technology is a necessity. TDM -- There are countless tutorials concerning TDM technology. Suffice it to say that TDM is a deterministic technology that depends on constant bit rate data streams with highly accurate frequency, jitter and wander timing requirements to reliably send voice, video, and data across dedicated or point-to-point channels. What TDM gains in reliability it loses in efficiency, since each application requires its own dedicated line. 4
Packet Switch Networks - PSN are highly efficient as they enable multiple applications to share the same bandwidth. However, this comes at a loss to reliability since packets must compete for bandwidth resulting in delay discrepancies and lost packets. PSNs offer no guarantee that the packets will arrive at all. TDM-over-IP -- TDMoIP offers the best of both these technologies by emulating pointto-point T1, E1, T3, E3, and N*56k/N*64K links and adapting and encapsulating the TDM traffic into packets as it enters the network and restoring them at the egress point. TDMoIP enables TDM signaling and timing to be recovered accommodating a determined amount of packet loss. The IPGate uses TDMoIP to give government agencies the ability to preserve the reliability of existing circuit and serial technology while gaining the economy of a PSN network. Residing at the physical layer, the IPGate ensures that connections are made regardless of application. The widest range of protocols are supported by the IPGate covering IPv4 and IPv6, UDP, RTP, MPLS, L2TPv3, ITU-T Y.1413, IETF CESoPSN, IETF SAToP, TDMoIP, Unstructured, Structured, and Structured with CAS. Additionally, the IPGate also complies with the G.823, G.824 and G.8261/Y.1361 Timing, Synchronization, Jitter, and Wander requirements of ITU-T. A single 3U high IPGate unit can handle up to 16 cards of various interfaces. Each card manages 16 to 64 ports depending on the interface. Up to 32 TDM ports can be translated into as many as 256 individually configurable point-to-point emulators (pseudowires) for transmission over a 100/1000 Mbps Ethernet port. Clocking Clocking is a highly important facet of digital networking. The clock that is used at the beginning of a signal must be the same clock that reconstructs the signal at the other end. Separating clock information or tinkering with the time relationship between signal transitions leads to errors. These errors can convert valuable data into worthless trash resulting in a potential loss of critical data. The IPGate enables each port to independently support synchronous and asynchronous TDM data streams. These TDM ports have an internal Clock Recovery Engine to reconstruct the timing of a TDMoIP pseudowire packet stream. Should an application not require clock recovery, the IPGate also supports other clocking options. These include Differential Clock Recovery (DCR) which is used when a common clock (i.e. a station clock, a BITS clock for a public network, or a GPS clock for a cellular network) is available at both ends of the point-to-point emulator. Differential clock recovery needs a Common Reference Clock in order to function. When data is transmitted, the IPGate measures the relationship between the local clock and the Common Reference Clock, and sends this information to the IPGate at the other end along with the data. The receiving IPGate uses this information to recover a clock associated with the Common Reference Clock, to ensure good frequency matching. Since the recovered clock is related to the common clock its packet delay variations are minor. 5
In instances where there is no Common Reference Clock available, the IPGate uses Adaptive Clock Recovery to monitor the packet stream received from the PSN and then calculates the clock frequency based on received data rate. Redundancy CTI recognizes the importance of maximizing network availability, especially in situations dealing with critical data applications and communications. The Cornet Technology IPGate supports both packet redundancy and full network redundancy via GigE network controllers with automatic failover to a standby network. IPGate-AC port cards offer two levels of packet redundancy. In the first, each packet is split into a primary and secondary packet with unique headers and sent to the IPGate-AC network controller. Through the controller s network connection the redundant packets are then routed over two distinct network paths. In the second, for added reliability, full packet redundancy is offered where the primary and secondary packets are also duplicated. Each duplicate pair goes through a different IPGate-AC network controller (two are offered) through a separate network connection and are then routed over two distinct network paths. Dual redundant power supply modules are part of every IPGate-AC chassis configuration. These modules are configured to share the total load but are capable of powering the entire unit. If a power module fails, the redundant module will automatically assume the entire load ensuring that the port-to-ip connections continue to pass data without interruption. A failure status will be displayed and reported to IntelView, Cornet Technology s control and management software. Virtual Matrix The IPGate-AC provides far more inter-connect possibilities than traditional tunneling units which are basically an IP pipeline connection between two devices. The distributed architecture in the IPGate AC unit allows any-to-any connectivity between ports and devices enabling a user to create a Virtual Matrix connection between DTE/DCEs (digital) and lines/trunks (analog). User Interface Monitoring The IPGate-AC s optional bus interface cards let operators attach their test and monitoring equipment to the unit s backplane DB-25 female connectors. Port data is collected and presented in real time for monitoring without data disruption. DACX Functionality The IPGate-AC unit offers full DACX functionality. The DACX function multiplexes low speed TDM voice and data signals such as DS0s into higher speed signals (DS1s etc.) and demultiplexes them. The DACX also performs traffic grooming which reduces carrier costs by building T1/E1 signals from individual (nx56/64k) channels, removing these input channels from T1/E1 frame input-signals and converting the individual DS0 into the appropriate IPGate-AC interface. 6
Management CTI s system management software is designed to collect, transmit, route, share, display and manage the data and the hardware associated with communication systems. It combines high functionality with user friendly applications and operations. The software supports a variety of device and excels in scenarios where multiple network interconnections and users are common. IntelView can support redundant server capabilities. Its modular architecture facilitates system customization to address individual requirements. IntelView has a platform independent client/server architecture that supports the number of operators and devices defined by the Cornet Technology hardware system. IntelView s standard set of modules and services cover Switch Management, User Management, as well as Alarm Monitoring and Management operations. Its modular platform allows the users to add capabilities as needed. With IntelView, the complexity of networking is masked through the use of a user-friendly, point-and-click Java-based Graphic User Interface (GUI). A standard tree structure allows the user to quickly find functions and devices. IntelView protects the configuration of each port against the possibility of a power failure. When power is restored, the system automatically restores user ports to their last configuration; restoring circuits without any operator intervention. Benefits Eliminates the cost of expensive dedicated telecommunication circuits between locations. Simplifies management and eliminates point-to-point inefficiencies Ability to monitor both the tech control and network side Integrates voice communications and conferences, and radio remote control into a single unit. JITC The IPGate-AC has undergone JITC testing for information assurance (IA) and for interoperability. Acceptance is expected by November 2012. 7
Acronyms and Glossary Asychnronous not occurring at scheduled or regular times CAS Channel Associated Signaling CESoPSN Circuit Emulation Service over Packet Switched Network Common Reference Clock Clock that comes from a central location GiGE Gigabit Ethernet IETF Internet Engineering Task Force IP Internet Protocol IPv4 and IPv6 Internet Protocol versions 4 and 6 -- used to identify network devices through an addressing system version 6 comes with a number of upgrades ITU-T -- International Telecommunication Union Telecommunication Jitter small variations between the scheduled and actual arrival times Latency time delay L2TPv3 Layer 2 Tunneling Protocol Version 3 MPLS Multi-Protocol Label Switching Pseudowire -- is an emulation of a point-to-point connection over a packet-switching network RTP Real Time Transport Protocol SAToP Structure Agnostic TDM over Packet SIP Session Initiation Protocol Synchronization agreement in time TDM Time Division Multiplexing Timing Time between sending and receiving of a bit UDP User Datagram Protocol Wander accumulation of jitter variations 8
IPGate-AC Frequently Asked Questions 1. Can the IPGate-AC software be upgraded without requiring a unit power-down? Yes, the IPGate-AC software can be upgraded via the Ethernet interface without powering down the unit. 2. Can new/replacement cards be installed on the IPGate-AC units without requiring unit power down? The IPGate-AC units support hot swapping, hence new/replacement card installation does not require powering down the unit. 3. Does the IPGate-AC units monitoring software permit passive monitoring of circuits? Are cards disabled during BERT testing? The IPGate-AC supports passive monitoring as well as active testing of circuits. The units support both internal and external BERT testing. 4. Do the IPGate-AC units support identifying new circuits by CCSD (Control Communications Service Designator) when adding or troubleshooting existing circuits? Yes, the IPGate-AC units support circuit identification by CCSD through IntelView (Cornet Technology s management and control software) which permits setting up user specified names and through the CLI. 5. What is the minimum size of IP packets supported by the IPGate-AC units? The minimum size of an IP packet supported is 32 bytes. This ensures minimal signal propagation delays. 6. Is Timing Distribution standard on the IPGate-AC units? Yes timing distribution is standard for all interface cards supported by the IPGate-AC units. 7. Can configuration changes to the IP side be made without rebooting the IPGate-AC units? 9
Re-booting of the IPGate is not required for configuration changes on the IP-Side. 8. Can the IPGate-AC units conduct pseudo BERT on a DS-1? Non-traffic affecting pseudo BERT on an ESF DS-1 does not affect other DS1s. 9. Is the IPGate-AC software upgrade and downgrade compatible? Yes the IPGate-AC software can be upgraded or downgraded over the Ethernet network. 10. Do the IPGate-AC units support operation in high density configurations (e.g. >100 IPGates)? Both high and low density configurations are supported via IntelView software. 11. Are both DTE and DCE interfaces supported on a circuit by circuit basis? Yes the IPGate-AC units support both DTE and DCE interfaces on a circuit by circuit basis. 12. Do the IPGate-AC units support passing of Secure Terminal Equipment (STE) and Secure Telephone Units (STU) compressed voice signals through the IP interface? Yes the IPGate-AC units support STE/STU passing through the IP interface. 13. Do the IPGate-AC units support a GUI interface and SNMP v3 traps? The IPGate-AC units support a GUI interface but not SNMP v3, as SNMP v3 does not meet JITC certification. 14. Do the IPGate-AC units support monitoring of serial signals via an Oscilloscope? Yes, the IPGate-AC units support serial signal monitoring via an Oscilloscope connected to bus ports such as EIA-530. 15. Do the IPGate-AC units support inversion of data and clock signals? Yes, inversion of data and clock signals is supported by the IPGate-AC units. 16. What kind of timing is supported on the IPGate-AC units and at what level? The IPGate-AC units have a chassis level clocking source and support individual circuit clocks. IPGate-AC can also be station clock timed. 10
17. Is FIPS 140-2 encryption support on the IPGate-AC Circuits? FIPS 140-2 will be supported on the IPGate-AC data card by March 2013. 18. Do the IPGate-AC units support ATM over IP? ATM over IP is supported on the IPGate-AC unit s DS3 card. The IPGate-AC also offers multiple ways to handle optical interfaces into the IPGate-AC units. 19. Is Synchronous Ethernet supported? The IPGate-AC units support synchronous Ethernet. 20. Are the IPGate-AC units IEEE1588 PTP (Precision Time Protocol) timing capable? IEEE1588 PTP will be supported on the IPGate-AC by March 2013. ABOUT CORNET TECHNOLOGY Founded in 1989, Cornet Technology, Inc. offers superior C4ISR communications equipment to the defense and aerospace industries in the United States and overseas. CTI communications, surveillance, and distribution solutions fulfill the need for commercial-offthe-shelf video, voice and data product engineered to the exacting customer needs. Headquartered in Northern Virginia, CTI has wholly owned subsidiaries in Germany, Japan, and India. All CTI products are designed and manufactured in the United States at its 9001:2008 registered facility in Springfield, VA. Additional information is available at the CTI web site www.cornet.com. For more information on how your government organization can benefit from a Cornet Technology, Inc. IPGate series TDM and serial circuit to IP solution, please contact a Cornet Technology sales representative at 703-658-3400.. 11