Designing Remote Connectivity Part 02 — Transcript

Full transcript

1. 0:05designing the enterprise
2. 0:07one
3. 0:10using one technologies numerous one
4. 0:13technologies exists
5. 0:15today and new technologies are
6. 0:17constantly merging
7. 0:19the most appropriate one selection
8. 0:21usually results in high efficiency and
9. 0:23leads to
10. 0:24customer satisfaction the network
11. 0:26designer
12. 0:27must be aware of all the possible one
13. 0:30design choices
14. 0:31while taking into account customer
15. 0:33requirements
16. 0:34this section describes the use of
17. 0:37various one technologies
18. 0:39including remote access vpns
19. 0:43one backup and the internet as a backup
20. 0:45one
21. 0:48let's start with the traditional one
22. 0:50technologies
23. 0:52so traditional one technologies includes
24. 0:54the following
25. 0:55you've got the list lines point-to-point
26. 0:58connections
27. 0:59indefinitely reserved for transmissions
28. 1:02rather than used only when transmission
29. 1:05is required
30. 1:07so you also have the circuit switch
31. 1:09networks
32. 1:11a type of network that for the duration
33. 1:13of the connection
34. 1:14obtains and or dedicates a physical path
35. 1:19for a single connection between two
36. 1:21network endpoints
37. 1:23and you've got the packet switched and
38. 1:26cell
39. 1:27switched networks a carrier creates
40. 1:30permanent virtual circuits or pvcs
41. 1:33or switched virtual circuits or svcs
42. 1:36that delivers packets of data
43. 1:39among customer sites
44. 1:43now for the one topologies we have this
45. 1:46star or also known as the hub and spoke
46. 1:49topology
47. 1:51so the benefits network simplicity
48. 1:54low number of circuits the only drawback
49. 1:57is sub-optimal traffic flow
50. 1:59there is no redundancy here so if the
51. 2:02hub goes down well all the spokes
52. 2:06are disconnected the next apology
53. 2:09is a full mesh topology so benefits
54. 2:14any to any connectivity high level of
55. 2:17redundancy
56. 2:19drawbacks configuration complexity and
57. 2:22of course the number of circuits
58. 2:25and you also have the partially mesh
59. 2:27topology
60. 2:29a compromise between the star and a
61. 2:32fully meshed
62. 2:36designing the remote access network so
63. 2:40the objective is to provide a unified
64. 2:43solution for remote access
65. 2:45grant the connection seamlessly as if
66. 2:48in the company headquarters application
67. 2:52requirements includes
68. 2:53low to medium volume data file transfer
69. 2:56and interactive
70. 2:57traffic for teleworkers and traveling
71. 3:00workers
72. 3:01voice services for teleworkers
73. 3:04connectivity options ip access through
74. 3:07an on demand
75. 3:09or always on connection so technologies
76. 3:12includes dial up the old dial up dsl
77. 3:16cable wireless broadband and others
78. 3:22overview of a virtual private networks
79. 3:24or vpn
80. 3:26so a vpn is a connectivity deployed on a
81. 3:29shared infrastructure
82. 3:31with the same policies security and
83. 3:34performance as a private network but
84. 3:36typically with lower total cost of
85. 3:38ownership
86. 3:40and we are using the public network like
87. 3:42the internet
88. 3:44to provide connectivity among sites
89. 3:49so connectivity option first is the
90. 3:52overlay vpn
91. 3:55so vpn connectivity options like the
92. 3:58overlay
93. 4:00vpdn or the virtual private dial-up
94. 4:02networks and peer-to-peer vpns
95. 4:04now let's focus on the overlay vpn here
96. 4:08with overlay vpns the provider's
97. 4:11infrastructure provides
98. 4:13virtual point-to-point links between
99. 4:16customer sites
100. 4:18overlay vpns are implemented with a
101. 4:20number of technologies
102. 4:22including the traditional layer 1 and
103. 4:24layer 2 technologies
104. 4:27okay so overlaid with modern layer 3 ip
105. 4:31based solutions such as the generic
106. 4:34routing encapsulation green
107. 4:36and ipsec so you can check the
108. 4:39supplementary videos
109. 4:40to learn more about vpns 3 and ipsec
110. 4:45so from the layer 3 perspective
111. 4:48the provider network is invisible
112. 4:52the customer routers are linked with
113. 4:54emulated point-to-point links
114. 4:57so the routing protocol runs directly
115. 4:59between routers that establish
116. 5:01routing adjacencies in exchange routing
117. 5:04information
118. 5:06so the provider is not aware of customer
119. 5:09routing
120. 5:10and does not have any information about
121. 5:12customer routes
122. 5:14so the provider's only responsibility is
123. 5:17the point-to-point data transport
124. 5:18between the customer sites
125. 5:22so although they are well known and easy
126. 5:25to implement
127. 5:26overlay vpns are more difficult to
128. 5:28operate and have higher maintenance
129. 5:30costs
130. 5:31for the following reasons first
131. 5:35every individual purple circuit must be
132. 5:37provisioned
133. 5:39optimum routing between customer sites
134. 5:41requires a full mesh
135. 5:43of vertical circuits between sites
136. 5:46bandwidth must be provisioned on a
137. 5:49side-to-side
138. 5:50basis so this figure here
139. 5:53illustrates an overlay vpn the router on
140. 5:57the left
141. 5:58in the enterprise edge module has one
142. 6:01physical connection
143. 6:02to the service provider with two virtual
144. 6:04circuits provision
145. 6:06you've got the virtual circuit one and
146. 6:08then the virtual circuit two here
147. 6:11now vc1 provides connectivity to the
148. 6:13router
149. 6:15on the top right okay
150. 6:18whereas vc2 or the virtual circuit 2
151. 6:21here
152. 6:22provides connectivity to the branch
153. 6:23office router
154. 6:25to the bottom right
155. 6:29next would be the virtual private dial
156. 6:31up network
157. 6:32or the vpdns
158. 6:36vpdns enable an enterprise to configure
159. 6:38secure
160. 6:39networks that rely on an isp for
161. 6:42connectivity
162. 6:44with vpdns the customers
163. 6:48use a provider's dial-in
164. 6:51or other type of connectivity
165. 6:52infrastructure for their private
166. 6:54connections
167. 6:56a vpdn can be used with any available
168. 6:59access technology
169. 7:02ubiqt is important meaning that bpdns
170. 7:06should work with any technology
171. 7:08including modem
172. 7:10isdn xdsl or cable connections
173. 7:15so the isp agrees to forward the
174. 7:19company's traffic
175. 7:20from the isps pop to a company run
176. 7:25home gateway so network configuration
177. 7:28and security remain in the client's
178. 7:30control
179. 7:32so the service providers or sp supplies
180. 7:34a virtual tunnel
181. 7:36between the company's sites using a
182. 7:39layer to forwarding
183. 7:41or point-to-point tunneling or ietf
184. 7:43layer to tunneling protocol l2tp tunnels
185. 7:47now this figure here illustrates a vpdn
186. 7:52in this figure the isp terminates
187. 7:56the dial up connection at the l2tp
188. 7:59access concentrator
189. 8:01or the lac and forwards
190. 8:04traffic through dynamically established
191. 8:06tunnels
192. 8:07to a remote access server called l2tp
193. 8:11network server or the lns
194. 8:15all right now a vpdn provides potential
195. 8:19operations
196. 8:20and infrastructure costs or cost savings
197. 8:24because a company can outsource its
198. 8:26dial-up equipment
199. 8:28thereby avoiding the cost of being in
200. 8:31the remote access server
201. 8:32business
202. 8:36so the next one would be the
203. 8:37peer-to-peer vpn
204. 8:40in a peer-to-peer vpn the provider
205. 8:43actively participates in
206. 8:45customer routing traditional
207. 8:47peer-to-peer vpns are implemented with
208. 8:50packet filters or shared providers edge
209. 8:52or pe
210. 8:53routers or with dedicated pre-customer
211. 8:56pre-routers
212. 8:58so in addition to high maintenance cost
213. 9:01for the packet filter approach
214. 9:03or equipment costs for the dedicated per
215. 9:05customer peer router approach
216. 9:08both methods require the customer to
217. 9:10accept the provider assigned address
218. 9:13space
219. 9:14or to use public ip addresses in the
220. 9:17private
221. 9:17customer network so
222. 9:20modern mpls vpns
223. 9:24provide all the benefits of peer-to-peer
224. 9:27vpns and alleviate most of the
225. 9:30peer-to-peer vpn drawbacks such as the
226. 9:33need for common customer addresses
227. 9:36so overlapping addresses which are
228. 9:39usually the result of companies using
229. 9:41private addressing
230. 9:43are one of the major obstacles to
231. 9:45successful peer-to-peer
232. 9:48vpn implementations so mpls of vpns
233. 9:52solved this problem by giving each vpn
234. 9:54its own routing and for wiring table in
235. 9:56the router
236. 9:58thus effectively creating a virtual
237. 10:01routers
238. 10:02for each of the customers
239. 10:06now what are the benefits of the virtual
240. 10:08private networks or vpns
241. 10:11let's talk about flexibility
242. 10:14so vpns offer flexibility because side
243. 10:17to side and remote access connections
244. 10:19can be
245. 10:20set up quickly and over the existing
246. 10:23infrastructure to extend the network
247. 10:25to remote users so
248. 10:30extra net connectivity for business
249. 10:31partner is also a possibility
250. 10:34okay and a variety of security policies
251. 10:37can be provisioned in a vpn thereby
252. 10:39enabling flexible interior connection
253. 10:42of different security domains so you can
254. 10:45set up and restructure networks
255. 10:47quickly next would be the network cost
256. 10:51so lower network communication cost so
257. 10:54lower cost
258. 10:55is a primary reason for migrating from
259. 10:58the traditional connectivity option
260. 11:00to a vpn connection so reduce dial up
261. 11:03and dedicated bandwidth infrastructure
262. 11:05and service provider costs
263. 11:08make vpns attractive
264. 11:11so customers can reuse existing links
265. 11:14and take advantage of the statistical
266. 11:16packet multiplexing features
267. 11:19next would be scalability so vpns
268. 11:23allow an organization to leverage and
269. 11:25extend the classic
270. 11:26one to more remote users and external
271. 11:29users
272. 11:30vpns offer scalability over large
273. 11:34areas because iptransport is universally
274. 11:37available
275. 11:39this arrangement reduces the number of
276. 11:41physical connections and simplifies
277. 11:43the underlying structure of the
278. 11:46customers
279. 11:47one
280. 11:50one backup technologies so let's take
281. 11:54the one backup strategies here
282. 11:57so this section describes various backup
283. 12:00options
284. 12:00for providing alternative path
285. 12:04for remote access so one links are
286. 12:07relatively unavailable
287. 12:09okay or unreliable compared to land
288. 12:12links
289. 12:13and often are much lower than the lands
290. 12:17to which they connect so this
291. 12:20combination of uncertain reliability
292. 12:22lacks
293. 12:22speed and high importance makes
294. 12:26one links good candidates for redundancy
295. 12:29to achieve high availability
296. 12:31so branch offices should experience
297. 12:34minimum downtime
298. 12:36in case of primary link failure a backup
299. 12:39connection
300. 12:40can be established either by a dial up
301. 12:44or by using permanent connections so the
302. 12:47main
303. 12:47one backup options are as follows so
304. 12:50you've got the
305. 12:52dial up backup routing
306. 12:56you've got the permanent secondary
307. 12:58wireless
308. 12:59or the the permanent secondary one
309. 13:01length
310. 13:02okay the shadow pvc and ipsec tunnel
311. 13:06across the internet
312. 13:08so for every connectivity of the remote
313. 13:11offices
314. 13:12to your headquarters so there should be
315. 13:15a corresponding backup
316. 13:20let's have our first example here
317. 13:22permanent secondary one link
318. 13:25so deploying an additional permanent one
319. 13:28link between
320. 13:28each remote office and the central
321. 13:32office
322. 13:33makes the network more fault tolerant
323. 13:36so this solution offers the following
324. 13:38two advantages
325. 13:39so first you've got to provide a backup
326. 13:42link
327. 13:44the backup link is used if a primary
328. 13:46link that connects
329. 13:47any remote office with the central
330. 13:49office fields
331. 13:52routers automatically route around field
332. 13:55one
333. 13:56by using the floating static routes and
334. 13:59routing protocols such as eigrp
335. 14:01and ospf if one of the link fails
336. 14:05the router recalculates and sends all
337. 14:07traffic to another link
338. 14:09allowing applications to proceed if a
339. 14:12one link
340. 14:13fails so thereby improving application
341. 14:16availability
342. 14:18so also you've got the increased
343. 14:21bandwidth
344. 14:22so both the primary and the secondary
345. 14:24links can be used simultaneously because
346. 14:27they are permanent so the routing
347. 14:30protocol automatically performs
348. 14:32load balancing between two parallel
349. 14:36links with equal costs or an equal cost
350. 14:40if eigrp is used
351. 14:42the resulting increased bandwidth
352. 14:44decreases the
353. 14:45response time so
354. 14:48in the figure the connections between
355. 14:51the enterprise
356. 14:52edge and the remote sites here
357. 14:55use a permanent primary and secondary
358. 14:58one links
359. 14:59for redundancy a routing protocol such
360. 15:03as eigrp
361. 15:04that supports load balancing over an
362. 15:06equal pass
363. 15:08on either a per packet or per
364. 15:10destination basis is used
365. 15:12to increase the utilization of the
366. 15:15backup link
367. 15:18next example is the shadow pvc
368. 15:22with a shadow pvcs as long as the
369. 15:25maximum load on the shadow pvc does not
370. 15:27exist
371. 15:28a certain rate such as 1 4 of the
372. 15:31primary speed
373. 15:32while the primary pvc is available
374. 15:35the service providers provides a
375. 15:38secondary pvc without any additional
376. 15:40charge
377. 15:42so if traffic limit on the shadow pvc is
378. 15:45exited
379. 15:46while the primary pvc is up the service
380. 15:49provider charges
381. 15:50for the excess load on the shadow pvc
382. 15:54now this figure here illustrates a
383. 15:56redundant connections between the remote
384. 15:58sites
385. 15:59and the enterprise edge using a seattle
386. 16:01pvc offered by the service provider
387. 16:05so because of the potential
388. 16:08for additional costs the routers must
389. 16:11avoid
390. 16:11sending any unnecessary data except
391. 16:14for example routing traffic over a
392. 16:17shadow
393. 16:20pvc
394. 16:22the internet as a one backup technology
395. 16:25so this section describes the internet
396. 16:27as an alternative option
397. 16:28for a field one connection this type of
398. 16:32connection is considered best
399. 16:34effort and does not guarantee any
400. 16:35bandwidth
401. 16:37so common uh methods for connecting
402. 16:40non-continuous private networks
403. 16:42over a public ip network includes the
404. 16:45following
405. 16:47so you've got the use of the ip routing
406. 16:49without constraints
407. 16:51you have the grid tunnels and the
408. 16:53hypersec tunnels
409. 16:55so if you want to learn more about vpns
410. 16:59you can go ahead and check the
411. 17:00supplementary videos on vpns
412. 17:05layer 3 tunneling layer 3 tunneling uses
413. 17:08a layer 3 protocol to transport
414. 17:11over additional or another layer 3
415. 17:14network
416. 17:15so typically layer 3 tunneling is used
417. 17:18either to connect
418. 17:20two non-contiguous parts of a non-ip
419. 17:23network
420. 17:24over an ip network or to connect two ip
421. 17:27networks
422. 17:27over a backbone ip network possibly
423. 17:30hiding the ip addressing details
424. 17:33of the two networks from the backbone ip
425. 17:36network
426. 17:37so following are the two layer three
427. 17:40tunneling methods
428. 17:41for connecting non-contiguous private
429. 17:44networks
430. 17:44over a public ip network so first is
431. 17:49with the use of glee so gree is a
432. 17:51protocol developed by cisco
433. 17:53that encapsulates a wide variety of
434. 17:56packet types
435. 17:57inside ip tunnels so gree is designed
436. 18:01for generic tunneling
437. 18:02of protocols in the cisco ios
438. 18:06grid tunnels ip over ip which can be
439. 18:10useful
440. 18:11when building a small scale ipvp and
441. 18:14network that does not require
442. 18:16substantial security so it is simple and
443. 18:19flexible for basic ipv vpns
444. 18:22packet payload is not encrypted this is
445. 18:24an unsecure
446. 18:26vpn protocol and provisioning of panels
447. 18:28is not very scalable
448. 18:31so the next option is the use of ipsec
449. 18:34ipsec is both a tunnel encapsulation
450. 18:37protocol
451. 18:38and a security protocol so ipsec
452. 18:41provides security for transmission of
453. 18:43sensitive information over
454. 18:44unprotected networks such as the
455. 18:46internet
456. 18:47by encrypting the tunnel's data
457. 18:50so ipsec acts as the network layer in
458. 18:53tunneling or transport mode and protects
459. 18:56and authenticates ip packets between
460. 18:58participating ipsec
461. 19:00devices so again when we say ipsec
462. 19:05packet payload can be encrypted hypersec
463. 19:07receiver can authenticate source
464. 19:09of packets and it uses the ike and pki
465. 19:18enterprise one architecture
466. 19:19considerations
467. 19:22so support for network growth
468. 19:25enterprises that anticipate significant
469. 19:28growth
470. 19:29should choose a technology that allows
471. 19:31the network to grow
472. 19:32with their business so one technologist
473. 19:36with high support for network growth
474. 19:38make it possible to add new branches or
475. 19:41remote offices
476. 19:42with minimal configurations at existing
477. 19:45sites
478. 19:46thus minimizing the cost and its staff
479. 19:50requirements
480. 19:51for such charges so the next one would
481. 19:54be
482. 19:55appropriate availability so businesses
483. 19:59heavily affected by even the smallest
484. 20:02disruption in network communications
485. 20:05should consider high availability and
486. 20:07important characteristics when choosing
487. 20:09a connectivity technology
488. 20:11highly available technologies provide
489. 20:14inherent redundancy where no single
490. 20:16point of failure
491. 20:18exists in the network
492. 20:21next would be operational expenses
493. 20:24some one technologies result in a higher
494. 20:27cost
495. 20:28than others a private line technology
496. 20:32such as the old frame relay or atm for
497. 20:34example typically results in a higher
498. 20:37carrier fees
499. 20:38than a technology such as ipsec ipvpn
500. 20:42which takes advantage of the public
501. 20:44internet to help reduce costs
502. 20:48so the next one would be operational
503. 20:50complexity
504. 20:52so the metropolitan area network
505. 20:56and the wide area network technologies
506. 20:58have varying levels
507. 21:00of inherent technical complexity so the
508. 21:03level of technical expertise
509. 21:05required within the enterprise also
510. 21:08varies
511. 21:09so in most cases businesses can upgrade
512. 21:12their man or one
513. 21:14and take advantage of the expertise
514. 21:17of the existing i.t staff requiring
515. 21:19minimal training
516. 21:21so next would be voice and video support
517. 21:26so man and one technology support
518. 21:28equality of service which helps
519. 21:30enable advanced applications such as
520. 21:32voice
521. 21:33and video over the network next should
522. 21:36be effort and cost
523. 21:38to implement okay to migrate from
524. 21:41private connectivity
525. 21:43so when an enterprise is migrating from
526. 21:45private connectivity to another
527. 21:47technology
528. 21:49it is important to evaluate the short
529. 21:52and long term costs
530. 21:53and benefits for this migration last
531. 21:58would be
532. 21:59the network segmentation support
533. 22:03okay network segmentation means
534. 22:05supporting a single network that is
535. 22:07logically segmented one advantage of
536. 22:10network segmentation is that
537. 22:12it reduces the expenditures associated
538. 22:15with equipment and maintenance
539. 22:17network administration and network
540. 22:20carrier
541. 22:21charges as compared to separate physical
542. 22:24networks
543. 22:27cisco enterprise man and one
544. 22:29architecture
545. 22:31so what are the technologies here
546. 22:34the cisco enterprise management
547. 22:35architecture employs a number of
548. 22:37man and one technologies engineered and
549. 22:40optimized
550. 22:41to enter operate as a contiguous system
551. 22:46providing the integrated qos
552. 22:50network security reliability and
553. 22:52manageability required
554. 22:54to support a variety of advanced
555. 22:56business applications and services
556. 22:59so these technologies include a number
557. 23:01of secure
558. 23:02alternatives to traditional private one
559. 23:06connectivity and help increase network
560. 23:08scalability
561. 23:09and reduce monthly carrier fees
562. 23:16now for the comparison the cisco
563. 23:18enterprise management architecture
564. 23:20includes
565. 23:21the following technologies as summarized
566. 23:23in this table here
567. 23:24so you've got the private one the isp
568. 23:27service
569. 23:27hypersite and remote access ipsec vpn
570. 23:31you've got the sp and pls and ipvpn
571. 23:34and you've got this self-deployed mpls
572. 23:39now for the private one private
573. 23:41connectivity takes advantage of the
574. 23:44existing
575. 23:45one technologies or other connections
576. 23:48to provide an additional level of
577. 23:50security when connecting sites
578. 23:52strong encryption like this
579. 23:563ds aes and others
580. 24:00can be added that ensures
581. 24:03strong security next would be isp
582. 24:06service
583. 24:07so cytoside and remote access ipsec vpn
584. 24:11these technologies take advantage of the
585. 24:13ubiquity of public and private networks
586. 24:16the use of strong encryption standards
587. 24:18like test 3ds aes and others
588. 24:21makes this one option more secure than
589. 24:24traditional private connectivity
590. 24:26and makes it compliant with many new
591. 24:28information security regulations imposed
592. 24:31on government and
593. 24:32industry groups such as healthcares and
594. 24:35finance okay so next would be the sp
595. 24:39mpls and
596. 24:41ipvpn a network based
597. 24:44ipvpn is similar in many ways to private
598. 24:47connectivity
599. 24:48but with added flexibility scalability
600. 24:52and
601. 24:52rich now for the self-deployed
602. 24:56mpls this is a network segmentation
603. 24:59technique
604. 25:00that allows enterprises to logically
605. 25:02segment the network
606. 25:04self-deployed mpls is typically reserved
607. 25:07for very large enterprises or an sp
608. 25:10willing to make a significant investment
609. 25:13in network equipment and training and
610. 25:16for those who have an i.t
611. 25:17staff that is comfortable with a high
612. 25:20degree of technical complexity
613. 25:26enterprise can use a combination of
614. 25:28these technologies to support their
615. 25:30remote connectivity requirements
616. 25:32so this figure here shows an example
617. 25:37uh implementation of a combination of
618. 25:39three technologies in healthcare
619. 25:41environment
620. 25:47selecting enterprise edge components so
621. 25:50after identifying the remote
622. 25:52connectivity requirements and
623. 25:54architecture
624. 25:55you are ready to select the individual
625. 25:58one components
626. 25:59so of course that includes hardware and
627. 26:01software
628. 26:03now hardware selection when selecting
629. 26:05hardware
630. 26:06use the vendor documentation to evaluate
631. 26:10the one hardware components the
632. 26:13selection process
633. 26:14typically considers the function and
634. 26:16features
635. 26:17of the particular devices including
636. 26:20their port densities
637. 26:22packet throughput expandability
638. 26:24capabilities
639. 26:26and readiness to provide redundant
640. 26:28connections
641. 26:30now for the software selection the next
642. 26:32step is to select the appropriate
643. 26:34software features
644. 26:36now when using cisco equipment the
645. 26:39software is the cisco ios
646. 26:41now when using enhanced good devices
647. 26:45so you have the same considerations
648. 26:51now as illustrated in the figure here
649. 26:54the cisco ios software has been
650. 26:56optimized for different markets
651. 26:58network roles and platforms just like
652. 27:01any other
653. 27:02brands so cisco ios software meets the
654. 27:05requirements of various markets
655. 27:08this includes the enterprise service
656. 27:09provider and commercial
657. 27:11and places in the network access score
658. 27:14and distribution
659. 27:15and the edge
660. 27:16[Music]
661. 27:18now let us summarize designing the
662. 27:20enterprise one
663. 27:22traditional one technologies include
664. 27:24list lines
665. 27:25circuit switched psdn and packet
666. 27:28switched
667. 27:29networks remote access networks connect
668. 27:32teleworkers and traveling employees
669. 27:35a vpn provides connectivity over a
670. 27:38shared infrastructure
671. 27:40with the same policies and performance
672. 27:43as a private network one backup
673. 27:46strategies are needed to provide
674. 27:49high availability between remote sites
675. 27:52the cisco enterprise one and man
676. 27:54architecture provides integrated qos
677. 27:57network security reliability and
678. 28:00manageability enterprise one design
679. 28:04includes selecting the appropriate
680. 28:06components including hardware
681. 28:08and software