Los Rios Community College District Enterprise WAN Backbone

Size: px

Start display at page:

Download "Los Rios Community College District Enterprise WAN Backbone"

Jocelyn Wilkins
5 years ago
Views:

1 Enterprise Backbone Comcast Internet 10GB RING Point-to-Point ps fiber connections provide highspeed ethernet transport with micro-second end-to-end latency. Good for file-synchronization and service distribution between campuses. DO FLC COMCAST ENS Point-to-Multi-Point ethernet transport used for simple high-availability enterprise-wide routing. This service interconnects all Los-Rios sites. ARC Comcast ENS SCC REDUNDANCY Each campus is provisioned with three ps backbone links and are configured to use all of the available links in an active-active forwarding fashion. Traffic between the links will failover without disruption in less than a second. CRC Date: November 16, 2017 Designed By: Ezra Systems V1.0

2 Enterprise Planned Comcast 1Gb Comcast Internet DO FLC ARC SCC CRC DMVPN / DMVPN Comcast ENS FM EDC EGC NAT WSC RCC EWC DAV MCB-8 MCB-686 MCB-28 MCB-39 MCB-28 MCACT MCD TRC Date: November 16, 2017 Designed By: Ezra Systems V1.0

3 Enterprise Current Comcast 1Gb Comcast Internet Legacy Fiber DO FLC ARC SCC CRC DMVPN 10 Gb / DMVPN Comcast ENS Legacy Fiber FM EDC EGC NAT WSC RCC EWC DAV MCB-8 MCB-686 MCB-28 MCB-39 MCB-28 MCACT MCD TRC Date: November 16, 2017 Designed By: Ezra Systems V1.0

4 Enterprise High-Level Design MULTIPLE CONNECTIONS LRCCD is incorporating multiple service providers and circuits at each site, allowing for improved redundancy and bandwidth through and active-active design. is providing the internet services to the LRCC District. A hand-off exists between DO and FLC. A high-level routing protocol called BGP (Border Gateway Protocol) will be used to exchange route information between each of the sites. BGP is designed for integrating multiple circuits and paths. BGP is very scalable in that it is configured once and then is agnostic to the number of underling paths. In this way each site will be configured once in its BGP peering with another site and then will use however many circuits and providers that are integrated underneath COMCAST MULTI-POINT ETHERNET Each site within the district is receiving a Comcast handoff. The colleges are DO are receiving a circuit, while outreach centers are receiving a 1Gb circuit. - 10GB Ring These circuits are leveraged at each college to build an enterprise backbone Each college and the DO will receive two directly connected fiber connections. Each of these connections will connect to a neighboring campus forming a ring topology is internet only, so the outreach centers will need to tunnel over this provider. DMVPN can be used for this. Comcast will be the districts primary mode of transport as all sites will interconnect with Comcast. ENS is a fully-meshed L2 domain. An OSPF area will be provisioned for local transport over ENS and BGP will ride over this for inter-site routing DMVPN DO Comcast ENS FLC Cisco s will be provisioned at the 4 colleges and the DO for interconnection and transport. DecaMAN is a P2P physical fiber backbone. This is being leveraged to create a ring between the 4 colleges and the DO. Leveraging BGP this ring provides high-availability for the district as each campus can be used as an interconnect to the Comcast ENS service. The BGP routing protocol will be used to peer between each site. This protocol allows for the easy scaling of multiple service providers and circuits. In this design each circuit will actively forward traffic ensuring the fully utilization of all LRCCD bandwidth. is used as the districts internet connection at FLC and DO (they each have a circuit). Five outreach centers will additionally receive a circuit, but will use a VPN tunnel to treat the internet connection as a private service. 5 outreach centers will integrate with and will use a Cisco, the rest will only use Comcast. Out Reach ARC CRC SCC Date: November 16, 2017 Designed By: Ezra Systems V1.0

5 Outreach Topology and Device Standards Primary Secondary SERVICE PROVIDER 1Gb Comcast Primary 1Gb / Secondary Advanced routing Site Zone-based firewall DMVPN Encryption 1Gbps LRCCD OUTREACH CENTER 1Gps Cisco 4451 Router Site Firewall 1Gps 12 port SFP L3 enterprise routing (OSPF, VRF, etc.) L3 / L2 boundary Routes Security Zones to Site Firewall 1Gbps Cisco 3850-X (12p SFP) FIREWALL Zone-based from Site local inter-vrf routing Site L2 ACCESS POE 48 port RJ45 POE to wireless and phones L2 ACCESS STANDARD 48 port RJ45 ACCESS 1Gbps Cisco 3850-X (48p POE) Access 1gbps Cisco 2960-X (48p) Access WIRELESS Use flex-connect to nearby campus Cisco Air 2802 Polycom VVX 311 AP

6 Campus Topology and Device Standards High-Speed Ring Neighbor Site 1 Multi-Point High-Speed Ring Neighbor Site 2 SERVICE PROVIDER Comcast Primary / Ring / Ring LRCCD COLLEGE CAMPUS ps ps ps Advanced routing DMVPN Encryption ps Cisco 1002-HX Router L3 enterprise routing (OSPF, VRF, etc.) High port capacity Interconnects campus service modules Cisco Wireless Controller 20Gbps Cisco 6880 VSS Cisco Firepower 4110 FIREWALL highspeed firewall Next g POE to wireless and phones Wireless Controller Site Site Firewall L2 ACCESS POE 48 port RJ45 POE to wireless and phones L2 ACCESS STANDARD 48 port RJ45 AGGREGATION / ACCESS ps Cisco 3850-X (48p POE) Cisco 3850-X (12p SFP) Aggregation 1Gbps 1gbps WIRELESS Campus services self +1 for redundancy ACCESS Polycom VVX 311 Cisco Air 2802 AP Cisco 2960-X (48p) Access

7 DataCenter Topology and Device Standards Enterprise Internet Internet Connection LRCCD DATACENTER SERVICE PROVIDER Comcast Primary / Ring / Ring Advanced routing DMVPN Encryption ps ps Cisco 5585-SSP40 Edge Firewall Cisco Firepower 4110 L3 enterprise routing (OSPF, VRF, etc.) port capacity Interconnects datacenter service modules FIREWALL highspeed firewall Inter-VRF routing DATACENTER 96 port -T (RJ45) Cisco Wireless Controller Wireless Controller? 20Gbps Cisco 4500x VSS Site Cisco Nexus 9k Site Firewall Cisco 1002-HX Router ps ps ps High-Speed Ring Neighbor Site 1 Multi- Point High-Speed Ring Neighbor Site 2 WIRELESS Campus services self +1 for redundancy Site Access Site Access Access ENTERPRISE APPS / SERVICES

8 /

9 12Mb 12Mb 12Mb 12Mb 12Mb ASIC ASIC ASIC ASIC ASIC 12 Ports 12 Ports 12 Ports 12 Ports 4x

Cisco Group Encrypted Transport VPN

Cisco Group Encrypted Transport VPN Q. What is Cisco Group Encrypted Transport VPN? A. Cisco Group Encrypted Transport is a next-generation WAN VPN solution that defines a new category of VPN, one that