1. A Strawman for Merging LHCOPN and LHCONE infrastructure LHCOPN + LHCONE Meeting Washington, DC, Jan. 31, 2013 W. E. Johnston and Chin Guok

2. 2 Network architecture and security models - today site border rtr ESnet site rtr security controls LHCOPN LHCONE ESnet core rtr T0-T1 LHCOPN circuits ESnet LHCONE VRF trusted LHCONE traffic general internet traffic untrusted LHCONE traffic Internet source-based policy routing for each address space with the default egress path being the general Internet for traffic that does not match the ACLs; VRF; etc Internet Internal site network physical circuits This model illustrates a Tier 1 site that is also being accessed directly by T2 sites The basic security model is to have some form of access control in each environment that vets incoming traffic and deals with non-compliant traffic in a reasonable way (e.g. sending it through site security controls before passing it to the LHCONE environment) ingest deep archive cache compute cluster LHCONE internal network OPN internal network trusted LHCOPN traffic LHCOPN circuit

3. 3 Network architecture and security models – future-I In essence, the idea for combining LHCOPN and LHCONE is to unify the physical circuit infrastructure and share it between the T0-T1 and T2 access using – a combination of VRFs providing best effort IP service to the T2s and – using virtual circuits to provide for T0-T1 traffic ESnet site rtr security controls ESnet core rtr ESnet LHCONE VRF general internet traffic untrusted LHCONE traffic Internet source-based policy routing for each address space with the default egress path being the general Internet for traffic that does not match the ACLs; VRF; etc Internet Internal site network multiple physical circuits treated as a single logical circuit LHCONE circuits LHCONE + LHCOPN site border rtr trusted LHCONE traffic ingest deep archive cache compute cluster LHCONE internal network OPN internal network trusted LHCOPN traffic LHCOPN is a virtual circuit that share the physical circuit with LHCONE traffic

4. 4 Issues for combining LHCOPN and LHCONE In future-I model the division of resources and the security model remain unchanged The infrastructure questions are: 1.Can the Experiments tolerate the T0-T1 traffic sharing bandwidth with the T2 traffic without any guarantees? If we look at the traffic to the US Tier 1s it looks like the T2 generated traffic is more or less steady state at a reasonable level, but occasionally there are periods of several days when the traffic peaks at levels that might interfere with unprotected T0-T1 traffic

5. 5 Issues for combining LHCOPN and LHCONE 2.If the LHCOPN path for any given site involves multiple 10G circuits, how is the offered load distributed across the multiple paths? Explicit circuit sharing by a higher-level application such as Lambda Station or TeraPaths –This would presumably work just as well using virtual circuits as physical circuits, with the sharing systems being provided with the bandwidth of each virtual circuit Router-based load balancing such as ECMP (equal cost, multi-path) load sharing –Would this work when the port is associated with a tagged VLAN (e.g. of a virtual circuit) rather than a physical interface? 3.If guarantees are required – that is, the virtual circuits need to provide guaranteed bandwidth – how well will the bandwidth guarantee mechanisms of the various VC implementations map onto converged circuits (e.g. LAG-ed Ethernet circuits)?

6. 6 Technical Considerations Bandwidth Virtualization – Are there underlying constrains in bundling (lagging) distinct resources to create a virtual link? Link Aggregation: –Can an aggregated link be virtualized at all levels (i.e. management/control/data plane) »e.g. how does a 15Gbps LSP over a 2x10G aggregated Ethernet behave? –Are flows still limited to individual physical links (e.g. 10G)? Multi-Lane –What is the skew tolerance allowed across a multi-lane data path (e.g. VCAT)? Bandwidth Elasticity – Are there mechanisms to dynamically reclaim unused bandwidth and reallocate to congested circuits? How dynamic (e.g. time scale) is this function supported by the underlying transport technology (e.g. LCAS)? Flow Isolation – Is there a mechanism in the underlying transport technology to provide logical isolation (e.g. QoS (different queues), SONET/SDH TDM)?