Solution Overview
Real-Time Applications Demand that Resilient Network Services Be Extended Consistently Across the Campus Network
OVERVIEW
Enterprises are using new business-enhancing real-time collaborative applications and communications tools such as IP telephony, IP video, and multimedia conferencing. To address the requirements these applications are placing on the network, the prescriptive Cisco Systems® network design extends consistent resilient services throughout the campus network, all the way from the core layer to the wiring closet. This approach helps ensure deterministic business continuity, predictable application performance, security within the network, and simplification of network deployment and operations. Cisco resilient services are key building blocks for the Service-Oriented Network Architecture (SONA). The Cisco SONA framework describes how enterprises can evolve to an Intelligent Information Network (IIN) to optimize applications, enhance business processes and resources, and enable IT to achieve greater business results.
THE REAL-TIME APPLICATION CHALLENGE
Existing networks have been designed for the client-server model (Figure 1). The client-server model is hierarchical, with clients making requests to a server-based application and data storage. Traffic patterns vary from less traffic at the edge to more dense traffic in the core caused by servers aggregated behind the core network. Current campus LANs have been built to support such applications and are:
• Hierarchical and server-centric-Traffic flows only from desktop to server and back.
• Non real time-Small delays are acceptable.
• Centralized-Data and application processing mainly occurs in the data center.
• Created for data only-Voice, text messaging, and video services are provided on independent specialized networks.
Figure 1. Client-Server Hierarchical Network Model
This model has called for the most valuable network services, such as security, quality of service (QoS), bandwidth management, and high availability, to be concentrated closer to the servers, whereas fewer services have been utilized at the desktop. Many enterprises have been more strategic in designing their core layer and rather tactical when designing their access layer, or wiring closet.
A new generation of applications is being deployed on IP networks: real-time communications applications. These applications (for example, IP telephony, instant messaging, and desktop videoconferencing) require permanent network access to deliver their value. These communications services have previously been delivered by dedicated separate real-time communications networks such as text messaging services (pagers), telephony services (private branch exchanges [PBXs]), and dedicated meeting room conferencing systems.
Cisco Unified Communications include:
• IP telephony-Helps single-site and multi-site enterprises use IP as a primary voice path.
• Cisco IP Contact Center software-Adds services such as intelligent contact management, real-time Web collaboration, and e-mail response management.
• IP audio- and videoconferencing-Maximize conference call flexibility by connecting people in different locations and time zones.
• IP Video Broadcasting-Provides an easy-to-manage, cost-effective network infrastructure for videoconferencing application deployment.
• Cisco Unified Communications software-Combines personal productivity management tools, such as unified messaging, rules-based call routing, and speech recognition, with IP telephony.
As these new collaborative and client-based applications get rolled out, they generate a new "any-to-any" type of traffic pattern. Users relying on real-time applications for their business now see permanent network access and application response time as essential to their business.
These users are also increasingly mobile and subject to catching viruses and other malware at home, hotspots, or customer sites. Making sure that security is enforced at the first point of network entry prevents malicious software from spreading internally behind the firewalls and intrusion detection systems (IDSs) when users return to the office. Concerns are no longer about just data but include all kinds of voice, video, and real-time data traffic.
A new network model is needed to support these any-to-any interactions (Figure 2). New LANs must be built to support such interaction-oriented applications in addition to traditional transactional applications and are therefore:
• Any-to-any, server-assisted, or serverless-Traffic flows between client devices, whereas servers, at most, provide control and authentication services.
• Real-time-Delays of any sort are unacceptable to real-time applications.
• Centralized and distributed-Data and application processing mainly occurs on the client side. Server assistance from the data center is typically control traffic.
• Created for multimedia-Voice, data, text messaging, and video services are all running on the same IP network.
Intelligent services such as security, QoS, traffic management, and high availability need to be extended to the access layer in the wiring closet. These new requirements make the availability of consistent network services business critical for all users of real-time applications.
Figure 2. Any-to-Any Resilient Services Network Model
As network managers look to provide consistent services end to end, the same principles applied in the core and distribution layers must be extended to the wiring closet. One such principle is the use of routing in the core and distribution to provide deterministic business continuity. Enterprises must now consider their access layer, or wiring closet, as strategic as their core or distribution layers. A possible system design enhancement is to extend routing to the wiring closet through the use of Routed Access. In order to successfully deliver resilient services that will enable real-time applications, network designers must consider the entire campus network as a strategic system.
Properly evaluating the capabilities of the wiring closet can save time in the long run when extending resilient services throughout the network. Cisco and its specialized partners can help by performing a discovery audit of the network and making design recommendations.
NEW NETWORK REQUIREMENTS FOR WIRING CLOSETS
Cisco has created architectures and design guides to help enterprises implement resilient network services. These services deployed in the wiring closet assure network readiness and predictable performance for real-time collaborative and multimedia applications:
• High availability-Helps ensure deterministic business operation resilience all the way to the network user.
• Self-defending network-Assures security within the network and increases protection against network security threats at the access layer.
• Systems design to reduce complexity and operating expenses-Provides lower total cost of ownership (TCO) by simplifying network deployment and operations and by using a consistent way of managing and troubleshooting throughout the network.
High Availability
High availability is not a standalone feature. It is, however, an approach to implementing a variety of interrelated features as tools that help ensure business resilience and maintain maximum end-to-end availability for services, clients, and sessions. Effective implementation of high availability requires careful network design while addressing security challenges.
High availability should be incorporated at many layers within the network. With a sound design, network stability is easy to achieve, troubleshooting is easier, and human error is reduced. The access layer provides the first level of access to the network. When Layer 3 routing protocols are used at this layer, a business can experience benefits such as load balancing, fast recovery, and scalability.
Networks designed for continuous operation (even if system or power failures occur) are known as high-availability systems. Well-designed, highly available systems feature redundant hardware, redundancy software features, and automatic procedures for reconfiguring network paths when failures occur. Highly available networks have fewer single points of failure on critical links or systems, and failover (switch to back up systems or alternate paths) must be transparent to users.
With real-time applications in mind, Cisco customers have reached what can be called "dial-tone levels of reliability" amounting to no more than 5 minutes of planned downtime in a year.
"Reliability is most important to us," says James Mullins, IT Coordinator for Emergency Medical Services Authority (EMSA), Oklahoma City. "We strive for at least `seven-nines' (99.99999 percent) uptime because we provide life-critical services. We chose Cisco Systems and the Cisco Catalyst® 4507R Switches for these reasons."
"The Cisco solution provides far better reliability than our previous network. At the same time, it has improved network performance 10 to 25 percent and has saved us a lot of money," says Madge Meyer, Executive VP, State Street Bank (Cisco Catalyst 6500 and 3750 Series Switches).
"The main benefits of our upgraded network are reliability and throughput. Our goal is to enable physicians and caregivers to access PACS [picture archiving and communication system] images anywhere in the health care system-at any time-within three seconds. One of the reasons we chose Cisco was because the Cisco Catalyst 6500 Series Switches are proven and dependable," says Troy Hottovy, Director of Technology and Security, Saint Luke's Hospital of Kansas City.
Self-Defending Network
With the increase in network security threats launched from the edge of the network, the wiring closet has now become the front line of defense to prevent attacks and help ensure the health of the entire network. Until very recently, the LAN was assumed to be private and therefore secure and contained. Consequently, the wiring closet layer of the network was designed to be a trusted area for network access. Network security in the wiring closet was often limited merely to physical security (for example, preventing someone from getting access to the switch) or turning off Ethernet ports when not in use. With the advent of increasingly sophisticated worms and viruses that spread in a matter of minutes, those policies need to change.
To protect against these "zero hour" attacks, which spread in a matter or seconds, the LAN switching infrastructure in the wiring closet plays a significant part in the overall security strategy of an enterprise. This new reality requires a renewed focus on security as an integrated part of the wiring closet switches. Cisco Catalyst switches offer innovative security features and tools, many of them integrated into the Cisco Catalyst software at no additional cost to help protect and mitigate against the most significant threats.
Cisco customers have used the self-defending network framework by deploying Cisco Catalyst switches in their wiring closets.
"To implement universitywide security services, we needed a consistent infrastructure across the institution running a centralized security policy that all of the departments and colleges could subscribe to," says Peter Bartz, Design Manager-Network and Telecom Support, University of Minnesota (Cisco Catalyst 6500 and 3750 Series).
"We chose Cisco for its market leadership. Its equipment capabilities were superior to what we had been experiencing, and we knew that the Cisco platform offered high levels of security," says Rich Johnson, CIO, Clarian Health Partners (Cisco Catalyst 4507R and Cisco Catalyst 3750 Series).
"Nlets, the international justice and public safety information-sharing network, is defined by the fact that it is always there. It is mission critical, it is life or death, and we need equipment we can rely on. That is why we chose Cisco," says Frank Minice, Director of Operations, Nlets. "We chose a Cisco network solution because of its security, resilience, and flexibility to add new members and services," says Steve Correll, Executive Director (Cisco Catalyst 4500 Series).
"It is nice not to have to be concerned about our network switches or routers failing or about new security vulnerabilities. We do not have to worry about that with Cisco-their products are just reliable," says Adam Feind, Director of Technology and Information Systems for the Midway Independent School District of Waco, Texas (Cisco Catalyst 6500 and 3550 Series).
Systems Design to Reduce Complexity and Operating Expenses
As demands on the network increase, there is a growing pressure to contain costs and improve staff capabilities. Options for reducing operating expenses (OpEx) include:
• Reduce network complexity
• Streamline maintenance tasks and staff training
• Scale for the future to protect today's investments
The best course of action is a plan that incorporates all three. Network managers face many operational challenges in supporting their networks. With the increased dependence on a single integrated network to support the business, there is a significant potential for network complexity to increase to a point that stretches the organization's ability to support the network.
Some of the primary areas that accelerate complexity, causing increased OpEx, include:
• Number of network services-As more and more services are delivered on a single network, operations become more and more complex. "No downtime," even during maintenance windows, is becoming a business network requirement.
• Number of network changes-The deployment of more services provides challenges in terms of managing the increased number of changes that will need to be performed on the network.
• Number of network devices-As more and more services are added to the network, the number of network devices to manage can increase. Without taking an integrated systems approach, network operations teams can be left with multiple overlay networks, which can each provide its own interoperability challenges.
Network managers need to constantly simplify network operations with comprehensive management applications, reduce network complexity and cost, and streamline simplify maintenance and training. When correctly designed, a campus network can enhance business efficiency and lower operational costs.
It is important to note that when evaluating costs associated with the network, looking only at the initial purchase price of the equipment does not provide a complete picture. Several other factors that affect cost are, in the long run, more critical than initial purchase price. These parameters that affect cost include the incremental labor costs to get different equipment to interoperate effectively, costs that can be calculated as a result of missed opportunities to make savings, or the cost of training staff on a new vendor's equipment.
Cisco takes a global systems approach, using resilient services within the network infrastructure to bind all aspects of the network, processes, and applications together. Cisco and its specialized partners also have a breadth of services that can be used to help ensure smooth deployment and ongoing operational management of the integrated solution.
Cisco integrated management tools use this intelligent networking capability to automate many of the tasks required for initial network deployment and ongoing maintenance. Automating these tasks eliminates human error from the management process and frees administrators to focus on more strategic responsibilities. Together, this systems approach to network management and the full suite of services provided by Cisco and its specialized partners can help ensure numerous important benefits:
• Simplification-Updates and upgrades can be centrally administered, reducing unnecessary downtime throughout the network.
• Integration-Network managers can control multiple services through a common management interface.
• Automation-Tasks can be scheduled for periods that are better suited to business needs and user satisfaction.
• Synchronization-It is easier to try to ensure that all network platforms are running consistent features, services, and software releases.
Cisco and its specialized partners have successfully provided comprehensive network design and relentless network support through CCIE® professionals and the Cisco Technical Assistance Center (TAC), both of which are recognized as the best in the industry.
"We suggested the Cisco Catalyst 3560 Series Switches to the group in charge of the RF system at our facilities. We wanted to easily configure, maintain, and monitor the network. We knew the Cisco product had the right capabilities and could scale while remaining easily manageable. It met all of our expectations," says Michael Mullen, Senior Technical Analyst, FedEx Ground.
"Routed Access eases our management burden, gives us more control over our security, lets us convert resources to a common Cisco IOS Software platform, and makes it much easier to implement new projects," says Darrin Gannaway, Senior Network Engineer, San Antonio Water System (Cisco Catalyst 4500 Series).
"We have used Resource Manager to correct two major network problems, and I estimate that using CiscoWorks tools saved us 64 hours of work," says Chad Smith, Senior Network Engineer, Alfa Mutual Life Insurance Company.
"By using the SWIM function in CiscoWorks RME to upgrade Cisco IOS Software, it now takes only 8 hours of regular time-thus saving us 92 hours of work every time a major software update comes out," says Bill Carte, CCIE-Sentinel Technologie, On-Site Senior Network Analyst, Illinois Department of Human Services.
"Manual configuration and software changes that used to take our network managers weeks can now be accomplished in just a day or two," says Mischa Deden, IT Project Manager, Schuitema. "Fault management could be an especially slow process. Our CiscoWorks solution enables us to manage our network both effectively and proactively-which we couldn't do with our previous network. And, because we can connect users to the applications they need at twice the speed on the end-to-end Cisco network, our customer experience has been very positive."
BUSINESS BENEFITS
The business world and information systems are moving from a model of transactions to a model of interactions. The ability to apply real-time voice, video, and data communications to solving business problems is making the difference between competitive enterprises.
By providing timely access to information and resources, Cisco Unified Communications solutions help ensure a simpler and more sophisticated communications experience. This not only makes interactions at the individual level more efficient, but also helps improve productivity over time as value-added applications and services are deployed throughout the network. In addition, moving from a dual network environment to a converged network with Unified Communications reduces IT maintenance expenses. For example, when Cray, Inc. moved to a converged network that supports voice, video, and data over a common infrastructure, it saved US$395,000 per year.
Resilient services extended to the wiring closet deliver the following business benefits
• Deterministic business continuity
• Security within the network
• Predictable application performance
• Simplification of network operations
Many customers are already benefiting from following Cisco prescriptive guidelines. Implementing Cisco resilient services all the way to the wiring closet has provided them with the foundation to support new real-time applications.
"The Cisco IP Communications solutions give us a lot of flexibility for reacting to today's changes and accommodating tomorrow's growth. Having voice and data information readily available to our physicians and clinicians has taken us a long way," says Jack Storey, Vice President and Chief Information Officer, Children's Healthcare of Atlanta (Cisco Catalyst 4507R and Cisco Catalyst 3550 Series).
"First we fixed our basic access issues and established a guaranteed bandwidth model for all of our desktop computers," says Mike Burke, Director of Daytona Beach Community College's Network Engineering and Services department. "After setting up a baseline model, we could start considering additional services that we could put over the network" (Cisco Catalyst 6500, 4500, and 3550 Series).
"Our Cisco foundation infrastructure is manageable and scalable. We'll no longer find ourselves in the position of receiving funding for a new application, only to realize that deploying the application requires a much more expensive infrastructure upgrade. We can add bandwidth incrementally, as needed," says Joe Russo, the Washington State Patrol's communications engineering manager (Cisco Catalyst 3750 Series).
CISCO TECHNOLOGY ACES
Cisco has a history of delivering technology aces. Cisco provides high availability at the device level (redundant elements), at the design level (best practices architectures), and at the protocol level (Enhanced Interior Gateway Routing Protocol [EIGRP]) to help ensure permanent service to real-time applications. Traffic management is another important set of technologies that Cisco offers to guarantee the appropriate performance for critical applications. The Cisco traffic management toolset includes technologies such as Network-Based Application Recognition (NBAR), Layer 2 through 4 Quality of Service (QoS), Cisco Express Forwarding (CEF), multicast, load balancing, and rate limiting, among others.
Routed Access and Network Admission Control (NAC) are two technologies that make a dramatic difference in resiliency, security, simplification of operations, and real-time application performance when implemented at the edge of the campus network.
Routed Access
What can the extension to the wiring closet of a well-known technology such as routing do for businesses?
Simplifying application deployment, decreasing network downtime, and maintaining application and network predictability have never been more critical for business success. By utilizing the intelligence and resiliency capabilities of Cisco routed protocols such as EIGRP, routing in the access layer or wiring closet delivers the mechanisms that enable a network to recover from failure in a deterministic way without having to fine tune multiple protocols or devices.
Lengthy network recovery times, complex configurations, and large numbers of complex troubleshooting tools can hamper or delay real-time application implementations. Increasing high network availability, reducing network downtime, and implementing dynamic traffic load balancing can greatly enhance the quality of real-time applications and make them easier to implement, manage, and support.
By using routing protocols or a Routed Access solution, network intelligence is now moved closer to the applications or users. The Routed Access solution utilizes routing protocols already used throughout the network. Routing protocols are used in the wiring closet or access as well as in the distribution and network core. Extending routing to the wiring closet allows the network to respond to outages with unprecedented recovery times, often less than 200 ms, to better utilize existing network links and ports.
By designing networks that utilize more deterministic recovery mechanisms, real-time applications can be used to their full potential. Faster recovery times and more predictable traffic flows and patterns result in more successful Unified Communications and multicast application implementations.
Routed Access simplifying reduces lengthy network recovery times, thereby simplifying configuration and troubleshooting. It uses simple and efficient IP load balancing and tightens up broadcast domains. By utilizing a Routed Access solution, network uptime increases, mean time to network repair is reduced, and provisioning downtime is decreased. These results directly affect user productivity and network administration costs. All of this translates back to profitability.
Network Admission Control (NAC)
Does the device attempting to access the network meet corporate security policy?
The pervasiveness of mobile computing has increased security threats. Mobile users are able to connect to the Internet or the office from home or public hotspots-and can easily and often unknowingly pick up a virus and carry it into the corporate environment, thereby infecting the network. Without an accurate way to assess the "health" of a device, even the most trustworthy user can inadvertently expose everyone else on the network to significant risks posed by either an infected device or one that is not properly protected against infection.
In response, Cisco has developed NAC, a comprehensive security solution that brings together leading antivirus, security, and management solutions to help ensure that all devices in a networked environment comply with security policy. NAC allows companies to analyze and control all devices coming into the network (such as PCs, laptops, servers, smartphones, and personal digital assistants [PDAs]). By helping ensure that every endpoint device complies with corporate security policy (that it is running the latest and most relevant security protections, for example), organizations can significantly reduce endpoint devices as a common source of infection or network compromise.
NAC uses the Cisco Catalyst switches to enforce security policy compliance on all devices seeking to access the LAN, thereby limiting damage from security threats such as viruses, worms, and spyware. Customers implementing NAC are able to permit LAN access to compliant and trusted endpoint devices and restrict access of noncompliant devices.
With NAC enabled in Cisco Catalyst switches, whenever an endpoint device attempts to make a network connection, the Cisco Catalyst switch automatically requests a security profile of the endpoint device. This profile information is then compared to network security policy on the Cisco secure access control server, and the level of device compliance to that policy determines how the Cisco Catalyst switch handles the request for admission. The switch can permit or deny access, or it can restrict access by redirecting the device to a network segment that limits exposure to potential vulnerabilities. It can also quarantine a noncompliant device by redirecting it to a remediation server, where it can be updated with components that will bring it into policy compliance.
By checking the "health" of a device before permitting access to the network, NAC allows customers to dramatically improve the security of the network by helping ensure that all network devices conform to security policy. By limiting the potential of end devices to introduce worms and viruses into the network, enterprises can significantly increase network resilience while reducing operating expenses related to identifying and repairing noncompliant or infected systems.
SUPPORTING PRODUCTS
Although some technologies such as NAC Version 2 are quite recent, Cisco has been delivering for years a portfolio of products that enable enterprises to build resilient services throughout their campus network, including the wiring closet. It is important to be able to identify the required features and platforms that enable these resilient services (Figure 3).
• Product profile criteria:
– Support for Routed Access (EIGRP, Open Shortest Path First [OSPF])
– Support for advanced high availability (internal or external redundant power supply, redundant supervisor module in chassis or master unit in a stack)
– Support for NACv2 framework and integrated security
– Support for Power over Ethernet (along with internal or external redundant power supply)
– Support for intelligent traffic management (Layers 2 through 4, QoS, multicast)
– Ease of deployment and operation despite the depth and strength of services
• Cisco Catalyst Switches offering Resilient Services
– Cisco Catalyst 6500-Industry leading innovation and services with unparalleled features, scalability and performance for the wiring closet
– Cisco Catalyst 4500-Premium wiring closet features with high availability and investment protection
– Cisco Catalyst 3750 and Cisco Catalyst 3560-New baseline for enterprise wiring closet services
– CiscoWorks LAN Management Solution (LMS)-Suite of powerful management tools that simplify the configuration, administration, monitoring and troubleshooting of Cisco networks
Figure 3. Cisco Products for Resilient Services in the Wiring Closet
INTELLIGENT INFORMATION NETWORK
Organizations today are seeking ways to improve business processes, agility, security, and productivity. To help achieve these goals, Cisco offers a technology vision as well as segment-specific architectures for building an infrastructure that will meet these needs today and tomorrow. This vision is the IIN, a strategy that addresses the evolving role of the network within businesses and directly addresses their desire to align IT resources with business priorities. The resulting network delivers active participation, process optimization, service delivery, and application responsiveness, which result in better IT awareness.
By adopting a systems-level approach that integrates services throughout the infrastructure, networks will evolve from interconnected boxes to high-function, highly integrated systems. As a result, intelligent networks will enable systemwide security, end-to-end performance controls, service-level resiliency, and systemwide management visibility.
WHY CISCO: A SYSTEMS APPROACH
Business and IT climates have changed significantly in the last few years. Although previous business success criteria are still relevant, far more comprehensive solutions are required from vendors today. In addition to providing leading products, services, and support, networking vendors must have a record of implementation excellence with those IT initiatives that are most crucial to a customer's business.
When asked which primary vendor they would choose if building a network from scratch, 94 percent of respondents named Cisco as their first choice.
What differentiate Cisco from most other vendors are the company's product and technology breadth, research and development excellence, willingness to partner, enterprise architecture experience and proven architectures, comprehensive lifecycle services, established global presence, and recognized leadership. Cisco combines a highly customer-driven approach to product development with a continuing emphasis on both hardware and software innovation and a strong focus on complete customer business solutions.
A properly implemented wiring closet solution can help establish a network that serves present and future needs. This means integrating switching, security, voice, mobility, and application services so that processes are more automated and intelligent. Cisco delivers this based on a strong history of innovation, leadership, and customer success. When resilient end-to-end services matter, a Cisco Catalyst solution forms the foundation for delivering this capability.
FOR MORE INFORMATION
For more information about Cisco resilient services extended to the wiring closet, visit http://www.cisco.com/go/resilientservices/ or contact your local account representative.
