Network security and reliable operation at every layer have been core topics for researchers and communication system designers from the very beginning. The wide-area network concept created by RAND Corporation, which laid the foundations for today’s Internet, was meant to describe a computer network that could continue to operate even after partial destruction. That idea was then translated from global scale into micro-scale solutions now deployed in millions of WAN, MAN and LAN networks worldwide. As is often the case, technologies originally developed for the military have gradually moved into civilian use. Some were adopted directly, such as TACACS+ and RADIUS authentication mechanisms; others inspired similar concepts like service decentralization and device redundancy.
Because the term network security is very broad, this article narrows the scope to three main topics:
1. secure user authentication,
2. ring protection in the aggregation layer,
3. redundancy in the network core.
1. SECURE USER AUTHENTICATION
Efficient handling of subscribers and delivered services is obviously fundamental to a network’s success, but secure user authentication is just as important. Beyond mechanisms that protect against attacks on ARP packets or DHCP services, it is crucial that user authentication itself is performed in a secure way. One of the best functions for this purpose is authentication using a RADIUS server according to the IEEE 802.1X standard. A key advantage of this solution is the elimination of unauthorized network access risk already at the access layer, along with support for various encryption methods. In addition, RADIUS authentication can be used in wired networks, wireless networks, and mixed environments.
2. RING PROTECTION IN THE AGGREGATION LAYER
Security in the aggregation and distribution layers, as well as at the network edge, is much more tightly coupled to topology and architecture.
In a typical star or tree topology we must rely on tools that provide linear protection, such as LACP (for physical link protection), ITU-T G.8031, or Port Backup for full protection. A significantly more resilient topology is a ring based on the G.8032 protocol, which combined with LACP link aggregation offers a high level of resilience to both physical link failures and node failures in the network, with switchover times below 50 ms. Importantly, these protocols allow heterogeneous link speeds, so with a very tight project budget the backup link can use more cost-effective equipment than the primary backbone. Ideally, ring protocols are available starting from the lowest switch models, which makes it easy to design ring connections in both new and existing networks.
The best approach is to use switches that can participate in multiple rings at the same time and use aggregated ports for ring connections.
The operating mechanism of ring protocols can successfully replace a spanning tree in the network, while offering better path convergence times (below 50 ms). The topology uses a root node and transit nodes. First, the root node of the chain is defined, along with its primary and secondary ports. This is a critical point in the ring, because here we define which ring path will be the inactive (backup) link. Next, we define the transit nodes of the ring, maintaining the correct port order. Port order is important because of their roles: the primary port is used to send Hello packets, while the secondary port is used to receive them. The last element to configure is the timers: the hello timer and the fail timer. Once configured, when a device detects a failure (no Hello packet received within the time specified by the fail timer, usually greater than three times the hello timer), it sends a link down packet to the root node, which triggers unblocking of the secondary port on the root node and thus reroutes traffic in the network.
3. REDUNDANCY IN THE NETWORK CORE
Once the access and aggregation layers are configured, the last step is to configure the devices operating at the edge of our secure network. The proposed distributed system is interconnected using 10GE links. These can be any 10GE links: SR, LR, ER, ZR, or standard Twinax. Our recommended SFP+ transceivers for these links are proven optical transceivers with an excellent price-to-performance ratio, such as:
- SFP+ optical transceiver SR 10Gbs 850nm LC DDM MMF 300m (VSCEL+PIN), model LO-SP-10G-SR
- SFP+ optical transceiver LR 10Gbs 1310nm LC DDM SMF 10km (DFB+PIN), model LO-SP-10G-LR
- SFP+ optical transceiver ER 10Gbs 1550nm LC DDM SMF 40km (EML+PIN), model LO-SP-10G-ER
- SFP+ optical transceiver ZR 10Gbs 1550nm LC DDM SMF 80km, model LO-SP-10G-ZR
The flexibility of this solution lies in the ability to use switches either as independent units or to combine them into a single logical switch using the VSF function, effectively stacking them regardless of the physical distance between locations.
Such a configuration of devices operating in the network core makes it much easier to manage the entire infrastructure while decentralizing the main node. It also provides multiple options for protecting against partial system failures.
The network design proposed here is only one of many ways to build a reliable telecommunications system. The rich feature set of modern carrier-grade devices offers a wide range of options for ICT system architects.
Do not miss upcoming articles. Subscribe to our newsletter or follow us on:
