Brookhaven Science Associates U.S. Department of Energy 1 Network Services BNL USATLAS Tier 1 / Tier 2 Meeting John Bigrow December 14, 2005

Brookhaven Science Associates U.S. Department of Energy 2 Network Services n BNL LHC Overview Preliminary Network and Security Architecture IP Address space allocations Performance Monitoring

Brookhaven Science Associates U.S. Department of Energy 3 n Network Security Limitations Current firewall Architecture –6 virtual 1 Gb/Sec EtherChannel to backplane –Rated total throughput of 5 Gb/Sec -EtherChannel Overhead Loss –Single 1 Gb/Sec flow / interface Network Services

Brookhaven Science Associates U.S. Department of Energy 4 n Network Security Limitations (Continued) Current Router Architecture –Single Access Control List (ACL) / interface -1 inbound and 1 outbound -Default behavior Implicit deny –A single ACL can become unwieldy in a complex WAN environment Network Services

Brookhaven Science Associates U.S. Department of Energy 5 n Network Security Limitations (Continued) Network Services …………. access-list 109 deny ip host any access-list 109 remark Block IPs per ticket 160,729 1 Month 12/8 access-list 109 deny ip host any access-list 109 deny ip host any access-list 109 deny ip host any access-list 109 deny ip host any access-list 109 remark ********************* Allow ************************* access-list 109 remark permit all before implicit deny access-list 109 permit ip any any

Brookhaven Science Associates U.S. Department of Energy 6 Network Services

Brookhaven Science Associates U.S. Department of Energy 7 n IP Address Allocation Tier 0 to Tier 1 (BNL - CERN) Requires routable IP Address space Direct BGP peering with CERN to / from BNL Limited route advertisements between T0 and T1 –For the LHC OPN Circuit BNL will use /24 Network Services

Brookhaven Science Associates U.S. Department of Energy 8 n IP Address Allocation Tier 1 to Tier X (BNL - Internet) Requires routable IP Address space Direct BGP peering with ES Net from BNL Full Internet route advertisements –ES Net CIDR IP Address Space –For the Internet circuit BNL will use /24 –3 additional class C networks available Network Services

Brookhaven Science Associates U.S. Department of Energy 9 n IP Address Allocation Tier 1 to Tier X (Continued) DNS Fully Qualified Domain Hostname Accessible ONLY from ES Net –No other path to get to BNL for LHC / Atlas Network Services

Brookhaven Science Associates U.S. Department of Energy 10 Network Services

Brookhaven Science Associates U.S. Department of Energy 11 n Future BNL LHC OPN Enhancements Dedicated Cisco Firewall Service Modules when available –Eliminate router ACL Functionality / Maintenance –Connection Logging –Each FWSM circuit will not impede the 10 Gb/Sec. –Stateful FWSM redundancy IDS / IPS when available Network Services

Brookhaven Science Associates U.S. Department of Energy 12 Network Services

Brookhaven Science Associates U.S. Department of Energy 13 Network Services n Mon browser-based IP service monitor n Internet-centric WAN based monitor application n Interrogates essential BNL network services

Brookhaven Science Associates U.S. Department of Energy 14

Brookhaven Science Associates U.S. Department of Energy 15 Network Services n MonaLisa Java based SNMP monitoring tool n External WAN based monitor n Tracks BNL EtherChannel OC-48 n Firewall Service Module n 10 Gb/Sec. Uplink to the BNL core

Brookhaven Science Associates U.S. Department of Energy 16 Network Services

Brookhaven Science Associates U.S. Department of Energy 17 Network Services

Brookhaven Science Associates U.S. Department of Energy 18 n Summary Tier 2 traffic dependant on Internet connectivity –Path to BNL via ES Net only –Initial router ACL based access to BNL –BNL provides DNS hostname for Internet resolution Network Services

Brookhaven Science Associates U.S. Department of Energy 19 Questions/Comments ??? Network Services

Brookhaven Science Associates U.S. Department of Energy 20 BNL Points of Contact n Scott Bradley, Manager of Network Services , n John Bigrow, Senior Network Architect , Network Services