Ict standards and Guidelines

3.4Digital Carrier System - T1

Also known as the Digital Carrier System (DS1), T1 connections provide 1.544Mbps of bandwidth. A T1 line is leased from the Telephone Company (OGERO) and directly links two sites. OGERO can also provide Fractional T1 service (DS0) in multiples of 64Kbps for users needing less than the full T1 bandwidth. T1 provides the highest performance for network-to-network connections because it does not rely on the Telephone Company's switched network. However, T1 is the most expensive type of service.

3.4.1T1 Requirements

The requirements for T1 are similar to Frame Relay. The Telephone Company must install service to both sites and a DSU/CSU and a T1 capable router must be installed. T1 costs include a one time installation fee + a flat monthly fee.

3.4.2When to Use T1

T1 lines should be used for critical, high bandwidth applications. T1 lines are best when the sites being connected are close together (otherwise the cost is prohibitive).

3.5E1

While T1 is an American standard, E1 is the European format for digital transmission. It carries signals at 2 Mbps (32 channels at 64Kbps, with 2 channels reserved for signaling and controlling). Similarly to T1, an E1 line can is leased from the Telephone Company. The Telephone Company can also provide Fractional E1 service in multiples of 64Kbps for users needing less than the full E1 bandwidth.

3.5.1E1 Requirements

The requirements for E1 are similar to T1. The Telephone Company must install service to both sites and a DSU/CSU and an E1 capable router must be installed. E1 costs include a one time installation fee + a flat monthly fee.

3.5.2When to Use E1

E1 lines should be used for critical, high bandwidth applications. E1 lines are best when the sites being connected are close together (otherwise the cost is prohibitive).

4.0WAN Devices and Equipment

This section describes Telecommunications devices necessary to establish WAN connections between two or more sites, based on the requirements presented for each WAN technology.

4.1Modems

Figure 4: Modem Characteristics

4.2ISDN Terminal Adapter

An ISDN terminal adapter is analogous to a modem for an analog phone line connection. Terminal adapters are normally the optimal choice for situations in which there will be one computer using the ISDN line. Terminal adapters connect to the computer as either an internal card or via the computer's serial port. Recommended technical features and characteristics are shown in table 2.

Figure 5: ISDN Terminal Adapter Technical Specifications

4.3ISDN Router

A router is normally the optimal choice for situations in which there are multiple computers that will be using the ISDN line for network connectivity. Routers connect to the computer using an Ethernet connection (LAN environment).

Figure 6: ISDN Router Technical Specifications

4.4Frame Relay Capable Router

Figure 7: Routers

4.5DSU and CSU Devices

A Data Service Unit/Channel Service Unit (DSU/CSU) is the ideal solution for high speed access to LAN/WAN applications. It connects to T1/E1 or fractional T1/E1 network services with data rates from Nx56/64 Kbps up to 2.0 Mbps. It delivers access to the high-bandwidth requirements of LAN internetworking, video conferencing, CAD/CAM, data and image applications. Providing high speed access, a DSU/CSU can be configured for point-to-point applications or point-to-multiple-endpoint applications using Fractional T1/E1 topologies. It is capable of accessing public network services such as frame relay, T1/E1 and fractional T1/E1, value-added networks and private backbone networks.

Figure 8: DSU/CSU Technical Specifications

4.6Firewalls

Figure 9: Firewalls

5.0Virtual Private Networks

With the advent of the Internet, the opportunity has arisen to provide temporary links across the public network between companies and sites. Instead of creating a true private network with all its attendant costs and management issues, one can make use of the Internet to provide a Virtual Private Network (VPN).

Rather than maintaining an expensive point-to-point leased line (a T1 or an E1 link), the Ministry or Agency can connect each office or Local Area Network to a local Internet Service Provider (ISP) and route data through the Internet, thereby using shared, low-cost public bandwidth as the communications backbone.
VPN's are not limited in the number of LAN’s or nodes that can be included in the virtual WAN. For a Ministry or an Agency that has numerous sites to link, this can result in significant savings when compared to maintaining a network of leased lines.
VPN is a technology that can be employed by Ministries or Agencies of any size traffic requirements. These requirements may impose bandwidths much less than 64 Kbps for the Wide Area Network and VPN’s can be set up to work at speeds slower than is possible with leased lines.
A VPN does not need to be a permanent link. Dial-on-demand virtual networks can be created using analog modems or ISDN for those sites that don’t require a full-time connection. When a user on the LAN needs to access the WAN, a modem or router automatically connects to a nearby ISP and starts sending data across the Internet.
VPN links can be set up with little effort and removed just as easily. In addition, client-to-server VPN’s can be created on demand between remote user PC’s and a firewall or VPN termination device at head office. This provides the means for roaming users to have access to corporate networks no matter where they may be located.
A VPN reduces the number of modems and telephone lines required centrally to support dial-in networking and dramatically decreases long distance charges since remote PC users would connect to their local ISP instead of dialing direct to head office.
With all this sensitive corporate data going around the public network, security becomes a primary concern. Unprotected data sent across the public Internet is susceptible to being viewed, copied or modified by unintended individuals or organizations. Data can be tampered with en route and valuable systems can be sabotaged.
Both ends of the tunnel must ensure beyond any measure of doubt that they are communicating with a valid host or client at the remote end of the link. Once the link has been established, data traveling within the tunnel must be encrypted to ensure that no one who may be eaves dropping on the conversation can gain access to the raw data.

The most important considerations for Internet security are:

• 
  Authentication: Verifying that the parties on each end of the link are who they claim to be
  

• 
  Privacy: Ensuring that transmitted content is not read or intercepted by unauthorized recipients
  

• 
  Integrity: Verifying that the transmitted data is received in an unchanged state
  

Doing business over the Internet, including transferring funds, obtaining and verifying credit information, selling and even delivering products, requires a reliable and effective security solution.

5.1Roadmap for Implementing a VPN Solution

The following sections describe the roadmap for implementing a VPN solution:

Figure 10: Roadmap to Implementing a VPN Solution

5.2Step 1: Determine Networking Connectivity + Access Requirements

First and foremost, the Ministry or Agency needs to determine what kind of WAN connections and network access requirement for remote users are needed. WAN connections fall into two general categories: Intranet connections and extranet connections. Intranet connects different locations within the same Ministry or Agency together. Extranet usually refers to the network connections between “business partners” of the Ministry or Agency.

Remote access users can also be classified into two categories:

• 
  Road Warriors: Road warriors typically move from location to location frequently.
  
• 
  Telecommuters: generally stay at one location for an extended period of time.
  

After determining the connectivity and access requirements, network security policy should be created (if it is not already in place) to facilitate network design. Sometimes, the policy could be simple, such as granting the same uniform access to every location and every remote access user. Often, the policies are more complex, involving different functions of different agency levels and the different needs of “business partners”.

5.3Step 2: Choose Product(s) or a Service Provider

As VPN involves many different technologies and there are even more different VPN products from various equipment vendors, choosing the right technology from the right vendor is often not easy. VPN products in general fall into four distinctive categories:

• 
  VPN gateway. Devices with special software and hardware to provide VPN capability. Various functions are optimized onto various software/hardware components.
  
• 
  Software only. Software are overlaid on PC or workstation platforms, the software performs all the VPN functions.
  
• 
  Firewall based. Additional functions are added to the firewall to enable VPN capability.
  
• 
  Router based. Additional functions are added to the router to enable VPN capability.
  

Hardware based encryption provides faster encryption speed. When the link speed reaches above T1 (1.5Mbps), hardware encryption is almost a necessity.

The various standards and protocols supported by the product are very important. In general, most VPN products should support IPSec, L2TP and PPTP. IPSec is the standard created by the Internet standard body: Internet Engineering Task Force (IETF) to provide security services in the IP based Internet. It is been widely adopted in the networking industry. ICSA (International Computer Security Association) provides IPSec compliant certification for equipment vendors.
The various types of authentication method supported by the products are also very important. RADIUS (Remote Authentication Dial In User Service) and PKI (Public Key Infrastructure) are two popular authentication standards. Directory server (e.g. LDAP) based authentication is also been implemented by various vendors.
For many Ministries or Agencies, it makes sense to outsource the VPN implementation to a service provider. A VPN service provider already has the right expertise in designing and implementing the VPN. By working closely with a service provider, the organization can be assured that its networking needs of adequately addressed. At the same time, it can focus on its core business and expertise, which often do not lie in the networking and security field.

5.4Step 3: Test It Out

After choosing the product or service provider, the next step is to try it out. Two or three sites and a small group of remote access users can be chosen to conduct a pilot service. The goal of the pilot is to ensure the VPN can be correctly configured to meet a subset of the network connectivity and remote access requirements determined in step 1.

It should also show that the performance of the network is adequate and the right authentication method can be managed. For example, in the case of using PKI for authentication, digital certificate can be appropriately issues and revoked.

5.5Step 4: Design and Implement the Network Design

After a successful pilot project, a production implementation can follow. A complete VPN design that meets all the network connectivity and remote access requirements determined in step 1 should be completed, either by the Ministry or Agency itself or working with the service provider. The implementation plan itself may be phased in.

In designing the VPN, an important aspect is the relative location of the VPN device with respect to the firewall already located at the corporate network perimeter. For example, the VPN device can be positioned in parallel to the firewall. In some cases, the VPN device can also perform the firewall function (and vice versa), thus combining the two devices into a single entity.
Implementing a VPN may mean reconfiguring other devices on the corporate network, such as the routers in the corporate network and the NAT (network address translation) server. In some cases, the VPN device can also perform NAT functions.
Deployment of VPN software onto remote access computers should be managed carefully. Unlike the VPN gateways situated on the corporate network, which is often installed by experienced network engineers, the VPN client software for remote access often needs to be installed by the end user themselves. Therefore, a convenient software delivery method (e.g. web download) and an easy to follow installation guide should be provided.

5.6Step 5: Monitor and Manage the VPN

Corporate networks require continued monitoring and management. The same holds true for VPNs. The VPN needs to be monitored and managed to ensure the continued correct operation of the network. It is also desirable to gather usage and performance statistics, so that appropriate network changes can be planned.

In today’s fast changing industry, the networking needs of a Ministry or Agency will also change. Because IP based VPN does not have dedicated circuits based physical infrastructure, making changes in the VPN simply amounts changing the configuration of the VPN devices. This offers companies flexibility to change at moment’s notice, a distinctive advantage compared to the slow telecommunications circuit provision process, which can usually take 30 days.
Similar to the implementation of the VPN, the Ministry or Agency can choose to perform the monitoring and management of the VPN themselves or outsource the tasks to a trusted service provider, making use of the infrastructure and expertise of the provider.

5.7Step 6: Upgrade and Migrate

Virtual Private Network technologies continue to evolve, just as the networking industry. VPN products continue to achieve higher performance, stronger security and easier management. In addition, different security models, such as providing security in the ISP’s POP (Point of Presence) are emerging. The Ministry or Agency should continue to upgrade its network infrastructure to adapt to the ever changing business needs and technologies.

6.0Appendix A – OGERO Rates

The current rates for OGERO’s Telecommunications Services are posted on OGERO’s website: www.ogero.gov.lb and should be reviewed regularly in case of updates.

Download 86.1 Kb.

Share with your friends: