HSCN Internet Protocol (IP) addressing policy

Transcription

1 HSCN Internet Protocol (IP) addressing policy Published 24 May 2017 Copyright 2017Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body created by statute, also known as NHS Digital.

2 Contents 1 Introduction 3 2 The HSCN IP addressing policy 4 3 Compliant IP addresses 5 4 Non-compliant IP addresses 6 5 Network Address Translation (NAT) 6 6 Requests for additional HSCN RIPE addresses 6 7 Return of HSCN registered RIPE address space 7 8 Authorisation and allocation process 8 9 Further information and enquiries 8 10 Glossary of terms 9 Copyright 2017 Health and Social Care Information Centre. 2

3 1 Introduction The Health and Social Care Network (HSCN) programme will deliver new and significantly different network services for health and social care as part of its remit to provide successor services to the current N3 network. The HSCN will create the effect of a single network across health and social care providers and their partners. All health and social care organisations (in England) are within scope of the HSCN solution, which supports greater integration of care delivery. This HSCN Internet Protocol (IP) addressing policy defines the legitimate addressing schemes and the working principles for their use, to support the smooth transition to the HSCN, ensure continued access to Transition Network (TN) services (such as national applications), and to provide a solid infrastructure for IP networking in health and social care. This policy statements set out in this document are necessary to underpin the transition to the HSCN in support of the business needs of health and social care. The HSCN IP addressing policy applies to all direct connections to the HSCN from organisations of all types, such as NHS, social care, and third party organisations such as application providers. Copyright 2017 Health and Social Care Information Centre. 3

4 2 The HSCN IP addressing policy The HSCN implements standards and policies to support existing connectivity and services and in parallel will work to ensure that the structure and frameworks are in place for a seamless transition to the cloud/internet environment. NHS Digital recognises that existing connectivity and services use a number of different addressing schemes and that a mandatory move towards a public address scheme in the short term is, for many organisations, unachievable due to cost, impact on existing services, timescales, and other factors. To support this, the HSCN IP addressing policy is set out in a hierarchical structure. Recommended/optimal IP address schemes Registered Réseaux IP Européens (RIPE) addresses at the point of connection for new and migrated connectivity services. HSCN registered RIPE allocations will typically comprise of either a /31 or /30 subnet per connection. See section Requests for additional HSCN RIPE addresses for more information. These RIPE addresses may be newly allocated by NHS Digital, or previously allocated (by NHS Digital or predecessor organisation). Predecessor organisations include Health and Social Care Information Centre, NHS Connecting for Health, NHS Information Authority, or Central/Local Communications Management Group, or locally owned legitimately assigned to the connecting organisation by RIPE Network Coordination Centre (NCC). Supported IP address schemes The use of NHS private address space (centrally allocated subnets from the /8 and space), for HSCN connectivity and to advertise hosted services may be maintained upon migration to the HSCN. Copyright 2017 Health and Social Care Information Centre. 4

5 Business/operational rules 1. The allocation of HSCN RIPE addresses will be managed by the HSCN operations IP address management (IPAM) team. 2. The HSCN network will support Network Address Translation (NAT). 3. RIPE addresses owned and allocated by NHS Digital (or predecessor organisation) must not be shared outside of the HSCN or be presented as a viable route reachable from the internet. 4. RIPE address allocations made by NHS Digital (or predecessor organisation) that are no longer required during the life of the HSCN service must be returned. See section Return of HSCN registered RIPE address space for more information. 3 Compliant IP addresses The following IP address schemes are valid for connection to and routing across the HSCN. 1. NHS Digital allocated RIPE addresses for use at the point of connection to the network. 2. Valid assigned RIPE addresses: a. Owned by and assigned to NHS Digital with RIPE NCC and allocated to customers by NHS Digital (or predecessor organisation); b. Owned by the connecting organisation and assigned to that organisation by RIPE NCC. 3. Addresses and subnets from the NHS private address space ( /8 and to ) that were allocated by the predecessor network, NHS national network (N3) or the Transition Network (TN), service provider. Copyright 2017 Health and Social Care Information Centre. 5

6 4 Non-compliant IP Addresses 1. Addresses and subnets from the RFC1918 private address space /16 will not be routed across the HSCN. 2. Addresses and ranges from the RFC1918 private address space previously adopted as NHS private address space ( /8 and to ) that have been deployed independently, meaning those not allocated by the predecessor network service provider, are deemed non-compliant and will not be routed across HSCN. 3. RIPE addresses and subnets, meaning not held or assigned to the organisation, will not be routed across the HSCN. NHS Digital is not responsible for any instances of litigation against organisations that knowingly or otherwise route illegal IP addresses to the Internet. 5 Network Address Translation Network Address Translation (NAT) is supported at the point of connection to HSCN to aid the allocation and use of registered RIPE addresses at all connection points to the HSCN and to allow organisations to maintain existing internal addressing. Connecting organisations can refer to the HSCN IP addressing good practice guidelines document for guidance on the use of NAT and other key protocols and methods within HSCN. 6 Requests for additional HSCN RIPE addresses Health and social care organisations that connect to the HSCN and adopt a HSCN allocated RIPE address and NAT at the point of connection may apply for an additional allocation of HSCN RIPE Copyright 2017 Health and Social Care Information Centre. 6

7 addresses. This may be, for example, to support the advertisement of hosted services that cannot currently be configured to work with NAT. Requests for additional HSCN allocated RIPE addresses are made via the IP authorisation and allocation request process. It is important to note that the pool of HSCN RIPE addresses is a limited resource therefore requests will be carefully scrutinised and allocations rigorously controlled. NHS Digital does not preclude the use of RIPE ranges already owned by the connecting organisation, or organisations obtaining additional subnet assignments from RIPE. Given that the HSCN RIPE address pool is a finite resource, requests for additional RIPE addresses from health and social care organisations will be prioritised. Therefore, commercial third party Supplier organisations that need to advertise services across the HSCN are advised to use locally owned RIPE assigned addresses or obtain additional subnets from RIPE NCC. 7 Return of HSCN registered RIPE address space A substantial amount of RIPE registered address space registered to NHS Digital is still allocated to a number of public and private sector organisations. It is essential that any NHS Digital assigned RIPE address space that is not in use, no longer required, or in use on private networks, should be identified and returned to NHS Digital. Organisations may return NHS Digital owned RIPE addresses. NHS Digital will actively pursue the return of allocated registered RIPE address space. This activity will be managed by the NHS Digital HSCN IPAM function. Copyright 2017 Health and Social Care Information Centre. 7

8 8 Authorisation and allocation process NHS Digital manages and administers the HSCN IP addressing policy and the IPAM function. The IPAM function manages the allocation and return of subnets from the HSCN IP address space. 9 Further information and enquiries For further information and enquiries please the HSCN IPAM team at ipamteam@nhs.net. Copyright 2017 Health and Social Care Information Centre. 8

9 10 Glossary of terms Term / initialism DHCP DNS HSCN IPAM N3 NAT RFC RIPE NCC TN What it stands for Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (a scope) configured for a given network. Domain Name System - The internet's system for converting alphabetic names into numeric IP addresses. For example, when a Web address (URL) is typed into a browser, DNS servers return the IP address of the Web server associated with that name. Health and Social Care Network IP (Internet Protocol) address management NHS national network. Network Address Translation (NAT) is a method of remapping one IP address space into another by modifying network address information in Internet Protocol (IP) datagram packet headers while they are in transit across a traffic routing device. A Request for Comments (RFC) is a formal document from the Internet Engineering Task Force (IETF) that is the result of committee drafting and subsequent review by interested parties. The Réseaux IP Européens Network Coordination Centre (RIPE NCC) is the Regional Internet Registry (RIR) for Europe, the Middle East and parts of Central Asia. Transition Network - a backbone network service providing core network functionality; points of presence (PoPs); external Gateways; access PoPs supporting legacy N3 access services, head end services; broadband; video conferencing (VC); virtual private network (VPN); IP address management (IPAM); Domain Name System (DNS); Network Time Copyright 2017 Health and Social Care Information Centre. 9

10 Protocol (NTP); Enhanced Internet Gateway (EIG); Enhanced Monitoring Service (EMS); Advanced Behavioural Analysis Suite (ABAS); security management services; connectivity to the HSCN peering exchange network; and transitional assistance to migrate TN end users from the legacy environment to the new HSCN environment. Copyright 2017 Health and Social Care Information Centre. 10