Network Refresh Technology Briefing
December 1, 2006
ITS Systems and Networks and Technology Planning and Security
Why should you care about Network Refresh?
What are the key issues that drive and affect Network Refresh?
How do we compare to our peers on these issues?
What are the goals, benefits and weaknesses of the new network design and why will UNCG be better off as a result?
What is the implementation plan?
Today’s Topics
Why should you care about Network Refresh?
The services we offer as a higher education institution are dependent on the campus data network.
If the network doesn’t work, our critical services don’t either.
What is the UNCG Campus Data Network?
The data network infrastructure
SUPPORTS – 300 enterprise application servers – 7,200 computing devices – 18,000 faculty, staff and students computing needs
TRANSPORTS – 1,200 – 1,600 Gigabytes of data daily
TRAVERSES – 650 Ethernet switches– 200 wiring closets– 73 buildings– 24,000 access ports
•Academic computing services
•Administrative Computing Services
•Student Housing (RESNET) computing services
•Human safety related devices
•Remote access for campus services
•Web services
Today, we depend on our campus network to support
How UNCG uses its network
UNCG faculty, staff and students create or modify about 2.5 TB of data every day, which is equivalent to approximately a quarter of the total contents of the Library of Congress.
EMAIL: 750,000 and 1,000,000 incoming internet email messages daily
UNCGENIE: 1.1GB of data transported per hour, 29GB of data daily
NETWORK PRINTING: Since the Fall semester began, 616,996 sheets have been printed
We collectively use the campus network to transport 63GB of data per hour, or 1,521GB of data per day, which is equivalent to approximately 250,000 books.
Traffic during regular hours of operation 54%8am – 5pm, M – F
Traffic during off-hours 46%5pm – 8am, M – ThFriday at 5pm – Monday at 8am
When UNCG uses the network
Campus network traffic generated outside of the University’s traditional hours of operation comprises 46% of the total volume of traffic on the network.
Web hits on the Blackboard server in a typical 24-hour period:
Total hits, on and off campus: 2,508,885
On-campus only: 1,219,934 49%
Off-campus only: 1,288,951 51%
8 AM to 5 PM (on and off campus): 1,387,590 55%
On-campus only: 780,681 56%
Off-campus only: 606,909 44%
Off hours (on and off campus): 1,121,295 45%
On-campus only: 439,253 39%
Off-campus only: 682,042 61%
Impact of the Network on the Classroom 24x7
“All students want to be — expect to be, demand to be —connected to the internet, each other, and all capabilities of the university 24/7.”
Campus Technology Whitepaper: THE CIO’S DILEMMA... AND SOME SOLUTIONS
The Network is not only a strategic asset, but
also a strategic differentiator
How UNCG residential students use the campus network
Significant activity: 24 x 7
Peak activity: noon - midnight
As a Carnegie Foundation research university with “high research activity”, these and other new research initiatives will shape our future network service requirements:
• Joint School of Nanoscience and Nanoengineering• North Carolina Research Campus at Kannapolis• Chemistry Department• Geography Department• Greensboro Center for Innovative Development
What will UNCG’s campus data network needs be tomorrow?
What are the key issues that drive and affect Network Refresh?
The need to refresh is driven by equipment age which affects:
• Support• Services that can be offered• Security
The cost of refresh is affected by:
• How much intelligent switching is implemented• Network speed• Length of the refresh cycle
0% 20% 40% 60% 80% 100%
Phone Systems
Network Equipment
Servers
Desktops
Management Software
Storage Devices
Every 3 Years or Less Every 5 Years
Every 7 Years Every 10 Years or More
Product Replacement— Avg. Useful Life, Yankee Group Enterprise Survey, Nov. 2005.
The industry standard lifespan of network equipment is 3 - 5 years.
2005 Data
The need to refresh is driven by equipment age
• hardware spares/replacements not available
• software upgrades not available
• technical support not available
“end of life” means
At end of life, equipment vendors no longer offer replacement parts, software upgrades or technical support
What does it mean for network equipment to become “end of life”?
As network equipment becomes “end of life”, we lose our ability to:
• Support the network effectively
• Offer services that meet campus needs
• Defend ourselves effectively against security threats
Effective July 2007, 48% of UNCG’s building switching is end of life.
Would it be cost effective for us to support Windows 98 as our primary desktop OS today?
52% of the 231 total enterprise level service outages at UNCG between 4/1/2006 and 10/31/2006 resulted from
network outages
Diminishing ability to support the network effectively
Diminishing ability to offer services that meet campus needs
Client Needs Example 1Spring/Summer 2005: Financial Aid office required a network communications solution that enabled them to setup stations in the Elliott Center quickly that had access to restricted data.
Current Solution: In the current environment the solution we offered was one of registering each computer in Elliot using NetReg and then install and configure VPN to access the secure data. It works, but it’s not a good solution from the user’s perspective.
Preferred Solution after Refresh: The next generation of the network will allow us to implement identity-based networking. With this service, users will authenticate based on who they are (rather than what machine they are using or where they are on campus) and be free to roam around campus with full secure access to the data and services they are supposed to see from any location, without additional requirements for machine registration or VPN software.
Wherever you are, login and compute just like you are sitting at your desk – no assistance required.
Clients Needs Example 2
2006: Chemistry department contacted ITS with a request to enhance building network security and performance in order to meet current research needs.
Current Solution: An add-on firewall solution was deployed to address building security needs. No solution is available today to address high performance computing needs.
Preferred Solution after Refresh: Quick turnaround of an integrated firewall solution to provide the enhanced level of building security that research projects require and Gigabit access ports to allow in-building high performance computing.
Diminishing ability to offer services that meet campus needs
Diminishing ability to defend ourselves effectively against security threats
We all are aware of our institutional requirements to be compliant with state and federal regulations for handlingrestricted data.
Equally important, is our ability to combat security threats that become increasingly more sophisticated every day.
In 2006, there are hundreds of tools that we know about that can be easily obtained by an average person and used maliciously to compromise restricted data and networks.
There are hundreds more that we don’t know about.
The following demonstration is one example of many possible scenarios.
Don’t Try This Yourself
http://its.uncg.edu/Policy_Manual/Acceptable_Use/
C. Unacceptable Use
i. Prohibited System and Network ActivitiesExecuting any form of network monitoring which will intercept data not intended for the employee's host. Authorized ITS employees are permitted to monitor network traffic data as part of their normal job duties.
One example of an attack
There are many different types of attacks and the one I'm showing today is called man in the middle.
There are a variety of ways to perform this attack. We will be performing what is called arp poisoning to get all machines in this building to send this computer all their data.
The software I'm using (ettercap) is easily downloaded and has been available since 1/25/01. However, Dug Song's "dsniff" does the same thing and predates this by a couple of years with a release date of Fri Dec 17, 1999
Man in the middle attack
THE BAD NEWS:
This attack is easy to do. The computer host firewall will not prevent this attack or detect it.
SSL encryption will not prevent this attack.
THE GOOD NEWS:
New network equipment finally prevents this attack.
• all usernames and passwords• all email being read/sent• all instant messages• all network phone calls• all websites being viewed• all print jobs• all files being saved to Novell• everything
This attack allows us to see:
The cost of network refresh is affected by
How much intelligent switching is implemented: Extending security out to the edge of the network can
increase costs significantly!
Network speed: 1 Gigabit vs. 10 Gigabit. Choosing 10 Gigabit speeds can
increase costs significantly!
Length of the refresh cycle: Choosing a 3 year versus 5 year refresh cycle can
increase costs significantly!
BUILDING ACCESS NETWORK600 + building switches
Premium: Intelligent switching present in core, distribution and building access
DISTRIBUTION NETWORK8 distribution switchesAdequate: Intelligent switching present in core and distribution
CORE NETWORK2 core switches Less than adequate: Intelligent switching present in core only
Building intelligence out to the edge of the network
$$$$
$$
UNCG chose a moderate, middle-ground solution
BUILDING ACCESS NETWORK
Building intelligence out to the building layer would have been a very expensive “premium” choice. Additional benefit to end users: contain outages at the workgroup level within a building.
DISTRIBUTION NETWORK
UNCG Chose this configuration: Intelligent switching present in core and distributionContain outages at building level.
CORE NETWORKIntelligent switching present
UNCG chose a moderate, middle-ground solution
Network speed: UNCG chose a 1 GB network speed at less than half the cost of the 10 GB solution. 1 GB speeds will more than support our current network usage.
Length of the refresh cycle: UNCG chose a four year refresh cycle for our core and distribution equipment and a five year refresh cycle on our building access equipment, which effectively trimmed 1/3rd off of the bottom line cost of the project.
The overall solution is built to scale such that if pockets of higher performance are required, they can be seamlessly accommodated.
How does our network strategy compare to
those of our peers?
In 2005, the EDUCAUSE Center for Applied Research (ECAR) published a comprehensive national study that provides a detailed insight into how higher education approaches IT networking, titled “Information Technology Networking in Higher Education: Campus Commodity and Competitive Differentiator”.
Senior IT leaders from 517 institutions responded to the survey.
Network Refresh issues are not unique to UNCG
98% of the national study respondents report that leadership “views the campus network as
an essential resource”.
66.7% of the national study respondents said their institution’s spending on data networking increased during the past three years and 74.6% anticipate this trend will continue.
2005 Data
79.5% of the national study respondents report that “the most frequent funding source for central networking upgrades and improvements” is an annual data networking budget.
2005 Data
National study respondents reported that their institutions plan to invest most in network components and software (64.4%) and wireless networking (60.5%) over the next three years.
2005 Data
How UNCG’s refresh strategy compares locally
The following information comes from peer to peer conversations between UNCG networking staff and
Networking staff at UNCC and ECU. This information has not been confirmed by detailed on-site study.
UNC Charlotte East Carolina UNCG
Intelligent switching:
Distribution layer Building access layer
Distribution layer
Network speed: Gigabit Gigabit Gigabit
Reported length of refresh cycle:
3 year high end and intermediate
4 year network mgmt hardware
5 year building access
3 year high end and intermediate
3 year network mgmt hardware
5 year building access
4 year high end and intermediate
4 year network mgmt hardware
5 year building access
Reported funding source:
One-time money One-time money Annual ITS allocation + TBD
How UNCG’s refresh strategy compares locally
What are the goals, benefits and weaknesses of the new network design?
Brief History of the Campus Network
• 1999 – 2002:– Large project to install fiber optics, and shift to Cisco Systems Ethernet
based technology.– 100 Mbps to buildings– 10 Mbps switched to desktops– 622 Mbps NCREN/Internet speed– Time span: Windows 95 -> Windows 98
• 2003 – 2006:– 1000 Mbps (1Gbps) to buildings– 10/100 Mbps switched to desktops– 2,400 Mbps (2.4 Gbps) NREN/Internet speed– Various Security Solutions
• Intrusion Prevention• Firewall around data center• Email Anti-Virus / Anti-Spam
– Time span: Windows 98 -> Windows XP
McNuttRouter
BryanRouter
ForneyRouter
JacksonRouter
Sniffer Servermonitoring/analysis
IPS
Data CenterFirewall(Active)
Sniffer Servermonitoring/analysis
IPSNCREN
InternetData Center
Firewall(Standby)
ForneyData CtrRouter
BryanData CtrRouter
CampusBldg
CampusBldg
CampusBldg
CampusBldg
CampusBldg
Today’s Network
• Causes of network failure– Software defects in (bugs) switches / routers– Hardware failure– Security related events
• Particularly those involving unusual traffic conditions (DDoS) such as the infamous Sobig, Blaster and Welchia.
– Human failure / misunderstanding– Growth challenges
Today’s Network - Weaknesses
• Targets of software hacking exploits:– Network Infrastructure
• Routers
• Switches
• Firewalls
• Intrusion Prevention Systems
– Applications• Desktop computers
• Application Servers
• Its all software whether application level or network level device!
Security Considerations
The security landscape is changing• SANS TOP-20 Critical Vulnerabilities for 2005:
“This SANS Top-20 2005 is a marked deviation from the previous Top-20 lists. In addition to Windows and UNIX categories, we have also included Cross-Platform Applications and Networking Products. The change reflects the dynamic nature of the evolving threat landscape and the vulnerabilities that attackers target.”
• SANS TOP-20 Critical Vulnerabilities for 2006:
“This announcement comes in the midst of an explosion in cyber crime, driven in part by a surge in the number of online criminals in Asian countries along with continuing growth in attacks from Eastern European countries. The surge is so great that several banks have reported 400 to 500 percent increases in losses to cyber fraud from 2005 to 2006.”
Design Choices and Goals
• Increase/improve– Reliability, Redundancy– Configuration Flexibility– Performance– Security
• Provide client-facing communications security– Admin clients and academic where needed.
• Provide Identity Based Network Service / Network Admission Control
• Maintain open access academic networks.• Prepare for possible voice support (VoIP).• Prepare for IPV6 and Internet2 support.
Building AccessVoice and Wireless ready
Building Distribution
Campus Distribution
Core
Services Distribution
Services Access
Metro Ethernet
Internet
WAN
Server Farm
Resnet
New Design Overview
Limitations of Design for 2007 - 2011
• Access layer switches are over-subscribed– 1 Gigabit access ports– 1 Gigabit uplink ports between switches
• Very high performance needs can potentially overwhelm a building network.
• Layer 2 only networking in buildings• Workstation peer to peer traffic will frequently come back to a
distribution area if crossing layer 3 routed boundary.
• Limited “in-building” network customization if need to keep traffic localized.
• Potential network failure can be contained to a building level only.
• Multi-Protocol Label Switching (MPLS) and Virtual Routing / Forwarding (VRF)– BENEFITS:
• Network virtualization• Creation of distinct closed user communities (CUG)
• Identity Based Network Service (IBNS), 802.1X, Network Admission Control (NAC)– BENEFITS:
• Increased mobility.• Vulnerability remediation.
• Quality of Service (QoS)– BENEFIT: Selective network traffic prioritization
• Firewall Services Module– BENEFIT: Communications security / risk mitigation
• Intrusion Prevention Systems– BENEFIT: Communications security / risk mitigation
Key Technology Areas
• Benefits of new network design / implementation– Security
• Further reducing risk of data exposure• Targeting security implementation to risk areas• Enabling IBNS / NAC / Networked Virtual Organization
(NVO)
– Performance• Implementing quality of service (QoS) traffic protection• Increasing access port speed to 1 gigabit per second
– Reliability• Redundantly connected buildings throughout• Designed for reduced failure domains.
New Design BenefitsWhy will UNCG be better off as a result?
What is the Implementation Plan?
THE NEW CORE AND DISTRIBUTION NETWORK (12/8/06 - 2/26/07)– NETWORK VIRTUALIZATION– IDENTITY BASED NETWORKING– FIREWALL SERVICE MODULE– NETWORK TOPOLOGY– QUALITY OF SERVICE– INFRASTRUCTURE SERVICES– PROBES/TRAFFIC ANALYSIS– DIRECTORY SERVICES– GUEST USER
THE NEW ACCESS / BUILDING NETWORK (1/16/07 - 3/26/07)– NETWORK TOPOLOGY– L2 / VLAN SEGMENTATION– QUALITY OF SERVICE– VOIP COMPATIBILITY– ACCESS PORT SECURITY FEATURES
FIRST OBJECTIVE: Develop the Test Environment
October 2006 – March 2007: Networks is currently building a test lab at DSINet. During the initial lab phase, Networks will be working with key technical clients across campus to define
Five-Year Implementation Plan Overview
SECOND OBJECTIVE: Actively Engage Clients
October 2006 – March 2007: Engage key clients across the University to participate as formal members of the Network Refresh Project, helping to define the evolution of the campus network and its associated services, build understanding among client groups for this critical work and test potential solutions with client applications.
ACADEMIC NEEDS
Open academic network
High Performance Computing
Guest access
BUSINESS NEEDS
Highly secure restricted business network
Specialty networks (HVAC controls,…)
Mobility for transaction processing - “mobile road shows” for events like SOAR
Vendor Access
Five-Year Implementation Plan Overview
Goals for Winter 2006 – Winter 2007
Upgrade the Core Network to a “Core + Distribution” design in accordance with best practices (Network Refresh Project: PM – Natsu Carr)
Upgrade some Buildings to current technology (Network Refresh Project: PM – Natsu Carr)
Upgrade the Server Farm to current technology (Data Center Relocation Project: PM – Natsu Carr)
OVERVIEW: Annual schedule and deliverables
Five-Year Implementation Plan Overview
YEAR 1 DEPLOYMENT (2/12/07 - 5/14/07)
• “Deployment Kickoff"• CORE AND DISTRIBUTION: Install and test routers • MOSSMAN: Install and test switches • GRAY HOME: Install and test switches • POLICE STATION: Install and test switches • Install, test, accept security components • Conduct user acceptance testing • Provide user acceptance / sign off
February 2007 – May 2007: Two core and four distribution routers, along with three new building networks will be deployed (pending full funding of non-recurring portion).
YEAR 1: Annual schedule and deliverables
Five-Year Implementation Plan Overview
Year 2: Remainder of Core Network, Server Farm,
Enhanced Security, more buildings,…
Years 3 – 4: more buildings,…
Year 5: core and more buildings,…
Year 6: do it again!
YEARS 2 – 5: Annual schedule and deliverables
Five-Year Implementation Plan Overview
Campus-wide Communications:
December Technical Briefing (Donna Heath/John Gale/Joff Thyer/Chris Roys)
December IT Professionals Roundtable (Chris Roys/Joff Thyer)
Quarterly Technical Professionals Meeting (Brad Lytle/Chris Roys)
Project Meetings
Project Webpages
Five-Year Implementation Plan Overview
Questions?
Top Related