Bechtle on Bechtle How We Reinvent Our Corporate Network Cisco Live Berlin 2017 CCSRST-2003 Patrick Bründler Florian Zahn CCSRST-2003

Transcription

1

2 Bechtle on Bechtle How We Reinvent Our Corporate Network Cisco Live Berlin 2017 CCSRST-2003 Patrick Bründler Florian Zahn CCSRST-2003

3 Agenda. 3

4 Agenda. 1. What is Bechtle? 2. What do we want to change? 3. What is our solution? 4. How are we going to deploy it? 5. What have we achieved so far? 6. Q and A 4

5 What is Bechtle? 5

6 Bechtle AG. Vendor-neutral, comprehensive portfolio for all aspects of IT infrastructure Over 30 years of experience Represented in 14 European countries About Employees Bechtle on Bechtle: How We Reinvent Our Corporate Network CCSRST

7 Sustainable Growth. All Sights Locked on Vision Vision % margin EBT in m 6,219 6,572 7,205 10,000 employees 4,405 2, employees 2,273 2,580 2,831 0,03 4, ,431 5bn in revenue revenue in m Bechtle on Bechtle: How We Reinvent Our Corporate Network CCSRST

8 Composing a Business Model. IT System House and Managed Services IT e-commerce Logistics & Service 8

9 Close, closer, closest to you. In Germany, Austria and Switzerland. Bechtle IT System Houses. On-site systems integrator Some 70 locations in Germany, Austria and Switzerland Employees in 2015: 5,766 Revenue in 2015: 1.89bn Bechtle on Bechtle: How We Reinvent Our Corporate Network CCSRST

10 The Entire IT World At Your Fingertips. Bechtle IT E-commerce. Direct sales Represented in 14 European countries Over 64,000 listed products, more than 21,000 customized shops (bios ) Employees in 2015: 1, in Germany 948 in other European countries Revenue in 2015: 942m Bechtle on Bechtle: How We Reinvent Our Corporate Network CCSRST

11 The Bechtle CIO Organization. The CIO-organization is the internal IT providing group wide services like: Cisco Collaboration (Voice and Video) Exchange Navision and SAP Citrix Mobile Device Management Internet Connectivity Basic Services (DNS/DHCP/NTP/...) Enterprise Network Network Security Remote Access BUSINESS V I E W 11

12 What do we want to change? 12

13 Bechtle Corporate Network Program: Status Quo. While decentralization is a driver for success, it is also a challenge for the IT: Each individual company uses different LAN-equipment (from different vendors) different WiFi equipment (and radio coverage quality!) different WiFi SSID SLAs impossible, because no end to end responsibility Hard to maintain and support intensive So we did start a series of interviews Analyze Design PoC Pilot Rollout Operate 13

14 Bechtle Corporate Network Program. IT-Simplicity / Standardization Scalability / Agility Automation Security Cost Reduction Aufklappen geht! (it just works..) Analyze Design PoC Pilot Rollout Operate 14

15 Bechtle Corporate Network Program Client Networking Enterprise Networking Management Systems Rollout Organization LAN WAN Network Management Site Survey... Wireless LAN Firewalling Firewall Management Rollout VPN Address Management Access Control 15

16 What is our Solution? 16

17 Design Overview. Class model for branch offices Blueprint per branch office class Design setup in building blocks Redundancy where needed Keep it simple Class Employees WAN Equipment LAN Hierarchy XL < 10,000 Redundant 3 Layer L < 500 Redundant 2 Layer M < 150 Single 2 Layer S < 50 Single 2 Layer Analyze Design PoC Pilot Rollout Operate 17

18 Solution Overview. 18

19 Management Systems. 19

20 Network Management. Our solution is composed of different products: WLAN Management Network management Cisco Prime Infrstructure with APIC-EM Firewall policy management IP address management / DHCP Access control Analyze Design PoC Pilot Rollout Operate 20

21 Network Management. 21

22 Out of Band Management. Out of Band Management for less than 60 euros Solution Raspberry Pi with USB to serial adapter Fedora in Linux management system (Spacewalk) Scripted basic management interface Accessible via corporate network and Internet Direct attached to dedicated DMZ on firewall FW managed over AUX port of router and rollover cable Analyze Design PoC Pilot Rollout Operate 22

23 LAN. 23

24 LAN. Design WS-C2960X-48FPD-L Fiber or copper core module SYST STAT MAST STACK SPEED RPS 2 Access layer module MGMT MGMT LAN BASE 1G UPLINK CONSOLE PoE+ Catalyst 2960-X Series 740W CONSOLE 49 SYST STAT MAST STACK SPEED RPS LAN BASE 1G UPLINK CONSOLE PoE+ 50 SFP Catalyst 2960-X Series 740W CONSOLE SFP WS-C XS-S UID MODE STAT D UPLX SPE ED STAC K SYS T A CTV XPS S-PWR Catalyst 3850 XS 10G SFP+ CONSOLE C3850-NM-4-10G NETWORK MODULE 1 UID MODE STAT D UPLX SPE ED STAC K SYS T A CTV XPS S-PWR G1 TE1 G2 TE2 G3 TE3 G4 TE4 Catalyst 3850 XS 10G SFP+ CONSOLE C3850-NM-4-10G NETWORK MODULE G1 TE1 G2 TE2 G3 TE3 G4 TE4 SYST STAT MAST STACK SPEED RPS 2 MGMT STAT DUPLX SPEED STACK SYST ACTV XPS S-PWR Catalyst PoE+ STAT STACK SPEED SPEED STACK ACTV XPS S-PWR 12X 13X PoE LAN BASE 1G UPLINK PoE STAT STACK SPEED RPS LAN BASE 1G UPLINK CONSOLE PoE SFP Catalyst 2960-X Series 740W 49 SYST MAST MGMT 24X 50 SFP Catalyst 2960-X Series 740W Analyze 12X 13X 24X Design MGMT PoC CONSOLE 49 SYST STAT MAST STACK Catalyst PoE+ CONSOLE 01X Bechtle on Bechtle: How We Reinvent Our Corporate Network 13 Catalyst 2960-X Series 740W CONSOLE 2 01X DUPLX SYST RPS CONSOLE 1 STAT 12 PoE+ CONSOLE MODE MODE SYST MAST 2 MGMT PoE 11 CONSOLE 1 WS-C P-S LAN BASE 1G UPLINK CONSOLE 1 SPEED RPS LAN BASE 1G UPLINK CONSOLE PoE+ CONSOLE Pilot CCSRST SFP Catalyst 2960-X Series 740W 49 Rollout 50 Operate SFP

25 LAN. Patching strategy Full pre-cabling in access cabinets Analyze Design PoC Pilot Rollout Operate 25

26 WLAN. 26

27 WLAN. The same SSIDs on every site SSID Authentication Authorization Access BCN-Corporate Machine Cert VLAN per AD Group Internal Network BCN-Voice Service User Voice VLAN Voice Network BCN-Internet Portal Guest VLAN Internet Access Analyze Design PoC Pilot Rollout Operate 27

28 WLAN. FlexConnect infrastructure For class S, M and L sites Two WLC 5520 N+1 redundancy over two DCs Centralized infrastructure For class XL sites Two WLC 5520 as HA pair on site Access points Series 2700 With internal and external antennas Analyze Design PoC Pilot Rollout Operate 28

29 WAN Cisco iwan. 29

30 WAN Cisco iwan. Requirements: Secure, encrypted communication High performance Redundant connection with automatic failover Easy to deploy and maintain Direct site-to-site communication (video and voice) Multiple MPLS providers + Internet Analyze Design PoC Pilot Rollout Operate 30

31 WAN Cisco iwan. Intelligent WAN Solution Components AVC MPLS Private Cloud ISR-AX 3G/4G-LTE ASR1000-AX Virtual Private Cloud Branch WAAS Akamai PfRv3 Internet Public Cloud Management & Orchestration Transport Independence Intelligent Path Control Application Optimization Secure Connectivity 4 IPSec WAN Overlay 4 Consistent Operational Model 4 Optimal application routing 4 Efficient use of bandwidth 4 Performance monitoring 4 Optimization and Caching 4 NG Strong Encryption 4 Threat Defense DMVPN Performance Routing AVC, WAAS, Akamai AES-256 Analyze Design PoC Pilot Rollout Operate 31

32 WAN Cisco iwan. Branch router: ISR4K AX Application Experience Bundle Performance meets our bandwidth requirements (25-90 MBit/s symmetrical) Allows virtualized applications like ISR-WAAS in the same box a single device per branch SSD / flash / memory addons need to be installed License included in AX-technology package Dataplane performance not affected Two devices in our blueprints Cisco 4331AX-Bundle for S- and M-size branches Includes ISR-WAAS license for 750 connections Dual Cisco 4431AX-Bundle for L-size branches Includes ISR-WAAS license for 1300 connections Analyze Design PoC Pilot Rollout Operate 32

33 WAN Cisco iwan. Branch design Hybrid connection MPLS Internet ISR 4431 or ISR 4441 Integrated WAAS WAN accelerator as ISR-WAAS embedded in ISR ASA-firewall is gateway between WAN and branch network (L3 switch) Analyze Design PoC Pilot Rollout Operate 33

34 WAN Cisco iwan. Hub router for the data center: ASR1001X-AES-AX Application Experience Bundle 2.5 Gbps to 20 Gbps bandwidth Dual power supply vwaas for 50,000 connections available as addon runs as VM on ESX (or different hypervisor) Analyze Design PoC Pilot Rollout Operate 34

35 WAN Cisco iwan. Virtual combination of multiple providers to one To connect the branch offices currently 3 different MPLS providers are in use Direct site to site tunnels between branches require connectivity between them. This is achieved by using two ASR1001-routers to route between the MPLSnetworks. Providers are told to use the HSRP-address of R10 and R11 as gateway As R10 and R11 are the existing WAN-routers Migration Branch by Branch Analyze Design PoC Pilot Rollout Operate 35

36 WAN Cisco iwan. WAAS reduces bandwidth requirements and virtually increases bandwidth by accelerating Microsoft Exchange Intranet traffic (Sharepoint) Filetransfer Citrix Capable of accelerating SSL-encrypted traffic Certificates of secure services must be uploaded into central WAAS Traffic reduction by factor Analyze Design PoC Pilot Rollout Operate 36

37 Firewalling. 37

38 Firewalling. Standardized IP-Networks per User group: S-Size and M-Size Branch: /18 L-Size Branch: /16 Standardized user networks Ua: Employees with fully managed client 10.x.32.0/23 10.x.96.0/23 10.x.160.0/23 10.x.224.0/23 filter all with ASA-rule Ub: Employees with unmanaged client 10.x.35.0/24 10.x.99.0/24 10.x.163.0/24 10.x.227.0/24 filter all with ASA-rule Uc: non-employees with restricted access Standardized service networks: Se services: Enterprise services These services can be accessed exactly the same way, independent from where the users uses them 10.x.4.0/22 10.x.68.0/22 10.x.132.0/22 10.x.200.0/22 Sg services: Special security requirements, detailled filtering applied Analyze Design PoC Pilot Rollout Operate 38

39 Firewalling. Firewall in front of each branch or data center No outgoing ACL only inbound traffic filtering Incoming ACL is applied via firewall policy management system Common ACL rules shared by every branch for access to central IT services Voice/video (SIP/MGCP/RTP), Jabber Intranet access Proxy... Individual ACL rules for access to services provided by the branch for the group Intranet-Servers provided by branch Customer project services Systems for customer support... Analyze Design PoC Pilot Rollout Operate 39

40 Firewalling. ASA5508-X for S-size branches Sizing throughput 180 Mbps 8x 1GE ASA5516-X for M- and L-size branches Sizing throughput 300 Mbps 8x 1GE Analyze Design PoC Pilot Rollout Operate 40

41 How are we going to deploy it? 41

42 Proof of Concept and Pilot. Design review Internal / Cisco Systems Proof of Concept 3 PoC branch offices in Neckarsulm, Rotkreuz and Freiburg Testing Testing Testing... Blackout / brownout behaviour Hardware failure Usability fests Pilot Installation central infrastructure Rollout of actual solution to production sites Two IT system houses One new Bechtle direct office Analyze Design PoC Pilot Rollout Operate 42

43 Rollout. Site Survey Site survey documentation Deviation report Prepairing rollout Actual design per site Preparing device configuration Switches and router on Prime Access points on WLC ASA firewall with scripted template Raspberry Pi SD card clones Analyze Design PoC Pilot Rollout Operate 43

44 Rollout. Bechtle Installation Unit 24h burn-in test Automated deployment of configuration Ship equipment to site Installation on site Rollout teams Field support Two weeks of support by project team Then: Service handover to operation team Analyze Design PoC Pilot Rollout Operate 44

45 What have we achieved so far? 45

46 Technical Outcome. WAN connectivity WAN connections are all encrypted using AES-256 Faster blackout and brownout detection Fast PfR response to MPLS or Internet failure Increased performance Combination of MPLS and Internet bandwidth Optimization using WAAS Analyze Design PoC Pilot Rollout Operate 46

47 Technical Outcome. Automation/Industrialization Standardized blueprints Zero touch deployment Branches need no configuration on hub site Out of Band management for nearly every situation (plan C) Simplified and faster firewall changes Full cabinet patching dramatically relieves field support Analyze Design PoC Pilot Rollout Operate 47

48 Maximum Flexibility. Bechtle-in-a-Box Flexible connectivity solution complete branch network in a 5-unit 19 flight case Connectivity via Internet Box includes PoE Switch C2960X-48FPS-L ISR 4321 with ISR-WAAS ASA5508-firewall for internet connectivity LTE-Module in ISR for wireless connectivity with pre-installed SIM Wireless Access Point Phone to call for installation assistance Attach the power cable and you have a connection Analyze Design PoC Pilot Rollout Operate 48

49 Business Outcome. IT-Simplicity / Standardization Scalability / Agility Automation Security Cost reduction Aufklappen geht! (it just works..) Analyze Design PoC Pilot Rollout Operate 49

50 Complete Your Online Session Evaluation Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online CCSRST Cisco and/or its affiliates. All rights reserved. Cisco Public 50

51 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Lunch & Learn Meet the Engineer 1:1 meetings Related sessions CCSRST Cisco and/or its affiliates. All rights reserved. Cisco Public 51

52 Q & A Patrick Bründler patrick.bruendler@bechtle.com Florian Zahn florian.zahn@bechtle.com

53 Thank You

54