UNM SCIENCE DMZ Sean Taylor Senior Network Engineer

Overview Why Research Specific Networks? Production Network/ScienceDMZ Design Basics ScienceDMZ Components Tools Used UNM CCIIE Grant/Researchers Requirements UNM Design

Possibilities??

Design Considerations 1. Type of R&E traffic – TCP –based, microburst traffic that can quickly consume entire available bandwidth a. Subject to TCP Global Synchronization 2. TCP traffic needs deep buffer on ports when congestion occurs. 3. No commercially available security devices can sit in- path with line-rate process speed Gbps backbone across continental US 5. The general rule of thumb is that you need 50ms of line- rate output queue buffer for a 10G port, so there should be around 60MB of buffer. UNM Infrastructure has 256MB or 153 MB depending on model.

Research Network: Science DMZ A network optimized for business is not designed or capable of supporting data intensive science.  Universities will always need to support security features that protect organizational financial and personnel data.  Solution: create separate data intensive science network, external to university enterprise network  Design formalized by ESnet, based on traditional network DMZ paradigm

Basic Science DMZ Science DMZ: (1) dedicated access to high-performance WAN, (2) high-performance switching infrastructure (large buffer memory), (3) dedicated data transfer nodes

ScienceDMZ Components DTNs (Data Transfer Nodes—Originator/Responder) High capacity servers capable of wire speed 10Gbps Transfer Globus GridFTP Application tuned for large data transfers Large Buffer capable network devices to smooth TCP drops Must have 60MB per port buffer space Must be Openflow capable PerfSONAR measurement nodes at each location Bro IDS (IDS versus IPS, to minimize deep packet inspection) Brocade SDN Controller Globus for Researchers Supporting Staff

Managing by Measurement Off campus / On campus data points Service tuning - Dedicated PerfSonars in DMZ Beyond UNM – Connectivity to other research institutions

Globus for the User Easy to use File Transfer Interface Existing Data Transfer Nodes at UNM Parallel transferring via GridFTP to utilize full 10G throughput

SDN for the DMZ Brocade SDN Controller Bro IDS Communication between these for event based responses automatically

How To Secure it? Use Bro to monitor it out of line IDS, not an IPS Requires full understanding of Bro libraries and expertise in TCP/IP stacks SDN Policies applied to DMZ Routers Flows describe TCP/IP traffic between two hosts. SDN controls these flows via Openflow 1.3 IPTables at the Data Transfer Nodes ACLs on Router interfaces and Unix files

CC*IIE Grant NSF Grant awarded to UNM Collaborative amongst researchers/IT Initial funding to build out the basic network Hope to apply for additional grants as available

UNM Design

Summary Why Research Specific Networks? Production Network/ScienceDMZ Design Basics ScienceDMZ Components Tools Used UNM Design

That’s So Cool! When can my department or myself join this network? This is a funding based network that requires listed Personal Investigators and funding for installation To be considered for inclusion into the round of grant funding contact Steve Perry and Elaine Rising at