1. CIS460 – NETWORK ANALYSIS AND DESIGN
CHAPTER 5 –
Designing a Network Topology

2. Topology
a map of an internetwork that indicates segments, interconnection points and user communities
First step in logical design
Hierarchical network design
Scalable campus and enterprise networks
Layered, modular model

3. Hierarchical Network Design
Develop in discrete layers
Each has a specific functions
Typical hierarchical topology is:
core layer of high-end routers and switches that are optimized for availability and performance
Distribution layer of routers and switches that implement policy
Access layer that connects users via hubs, switches, and other devices

4. Why Use A Hierarchical Network Design
CPU adjacencies and increased workload with broadcast packets
Modular topology that limits the number of communicating routers
Minimize costs by buying appropriate internetworking devices for each layer
Keep design element simple and easy to understand
Facilitates design changes
Enables creating design elements that can be replicated
Today’s routing protocols were designed for hierarchical topologies

5. Flat Versus Hierarchical Topologies
Flat is adequate for very small networks
Flat is easy to design and implement and maintain

6. Flat WAN Topologies
A WAN for a small company can consist of a few sites connected in a loop. Each site has a WAN router that connects to two other adjacent sites via point-to-point links
Not recommended for networks with many sites.
Loop topology can mean many hops between routers
If routers on opposite sides of a loop exchange a lot of traffic use a hierarchical topology
Redundant routers or switches required for high availability

7. Mesh Versus Hierarchical-Mesh Topologies
Mesh topology helps meet availability requirements
Full-mesh topology every router or switch is connected to every other router or switch.
Provides complete redundancy and offers good performance because there is just a single-link delay between any two sites
Partial-mesh network has fewer connections. Reach another router or switch might require traversing intermediate links

8. Mesh Topology (Cont’d)
Disadvantages:
Expensive to deploy and maintain
Hard to optimize, troubleshoot, and upgrade
Lack of modularity
Difficult to upgrade just one part of the network
Scalability limits for groups of routers that broadcast routing updates or service advertisements
Limit adjacent routers that exchange routing tables and service advertisements
For small and medium-sized companies the hierarchical model is often implemented as a hub-and-spoke topology with little or no meshing

9. The Classic Three-Layer Hierarchical Model
Permits traffic aggregation and filtering at three successive routing or switching levels
Scalable to large international internetworks
Each layer has a specific role
Core layer provides optimal transport between sites
Distribution layer connects network services to the access layer and implements policies regarding security, traffic loading and routing
Access layer consists of routers at the edge of the campus networks. Provides switches or hubs for end-user access.

10. The Core Layer High-speed backbone of the internetwork
Should design with redundant components because it is critical for interconnectivity
Highly reliable and adaptable to changes
Use routing features that optimize packet throughput
Have a limited and consistent diameter to provide predictable performance and ease of troubleshooting
For connection to other enterprises via an extranet/internet should include one or more links to external networks.

11. The Distribution Layer
The demarcation point between the access and core layers of the network
Roles include controlling access to resources for security reasons and controlling network traffic that traverses the core for performance reasons
Often the layer that delineates broadcast domains
Allow core layer to connect diverse sites while maintaining high performance
Can redistribute between bandwidth-intensive access-layer routing protocols and optimized core routing protocols.
Can summarize routes from the access layer
Can provide address translation.

12. The Access Layer
Provides users on local segments access to the internetwork
Can include routers, switches, bridges and shared-media hubs
Switches are used to divide up bandwidth domains to meet the demands of applications that require a lot of bandwidth.
For small networks can provide access into the corporate internetwork using wide-area technologies such as ISDN, Frame relay, leased digital lines and analog model lines.

13. Guidelines for Hierarchical Network Design
Control diameter of hierarchical enterprise network topology
Most cases the three major layers are sufficient
Provides low and predictable latency
Should make troubleshooting and network documentation easier
Strict control at the access layer should be maintained

14. Guidelines for Hierarchical Network Design (Cont’d)
Avoid the design mistake of adding a chain (don’t add networks inappropriately)
Avail backdoors – a connection between devices in the same layer. It can be an extra router, bridge, or switch added to connect two networks
Design access layer first, then the distribution layer and finally the core layer.
More accurately plan capacity requirements for the distribution and core layers
Also recognize optimization techniques needed

15. Guidelines for Hierarchical Network Design (Cont’d)
Design using modular and hierarchical techniques and then plan the interconnection between layers based on analysis of traffic load, flow, and behavior

16. Redundant Network Design Topologies
Lets you meet network availability by duplicating network links and interconnectivity devices.
Eliminates the possibility of having a single point of failure
Cab be implemented in both campus and enterprise
Campus goals for users accessing local services
Enterprise goals for overall availability and performance
Analyze business and technical goals of customer

17. Backup Paths
Consists of routers and switches and individual backup links between routers and switches that duplicate devices and links on the primary path
Consider 2 aspects of backup path
How much capacity does it support
How quickly will the network begin using it
Common to have less capacity than a primary path
Different technologies
Expensive

18. Backup Paths (Cont’d) Manual versus automatic They must be tested
Manual reconfigure users will notice disruption and for mission critical systems not acceptable
Use redundant, partial-mesh network designs to speed automatic recovery time
They must be tested
Sometimes used for load balancing as well as backup

19. Load Balancing Primary goal of redundancy is to meet availability
Secondary goal is to improve performance by load balancing across parallel links
Must be planned and in some cases configured
In ISDN environments can facilitate by configuring channel aggregation
Channel aggregation means that a router can automatically bring up multiple ISDN B channel as bandwidth requirements increase

20. Load Balancing (Cont’d)
Most vendor implementations of IP routing protocols support load balancing across parallel links that have equal cost
Some base cost on the number of hops to a particular destination
Load balance over unequal bandwidth paths
Can be effected by advanced switching (forwarding) mechanisms implemented in routers
Often caches the path to remote destinations to allow faster forwarding of packets

21. Designing a Campus Network Design Topology
Should meet a customer’s goals for availability and performance by featuring small broadcast domains, redundant distribution-layer segments, mirrored servers, and multiple ways for a workstation to reach a router for off-net communications
Designed using a hierarchical model for good performance, maintainability and scalability.

22. Virtual LANs
Is an emulation of a standard LAN that allows data transfer to take place without the traditional physical restraints placed on a network.
Based on logical rather than physical connections and are very flexible
Communicate as if they were on the same network
Allows a large flat network to be divided into subnets to divide up broadcast domains
In the future fewer companies will implement large flat LANs and the need for VLANs will be less
Hard to manage and optimize. When dispersed across many physical networks traffic must flow to each of those networks

23. Redundant LAN Segments
In Campus LANs it is common to design redundant links between LAN switches
The spanning-tree algorithm is used to avoid packet loops.
Spanning-tree algorithm is good for loops but not necessarily for load balancing
When multiple bridges or switches exist in a spanning tree, one bridge becomes the root bridge. Traffic always travels toward the root bridge. Only one path to the root bridge is active, other paths are disabled.

24. Server Redundancy
File, Web, Dynamic Host Configuration Protocol (DHCP), name, database, configuration, and broadcast servers are all candidates for redundancy in campus design
When a LAN is migrated to DHCP servers the DHCP servers become critical. Use redundant DHCP servers.
DHCP servers can be at the access or distribution layer. In small networks often in the distribution layer. In larger in the access layer.
In large campus networks the DHCP server is often placed on a different network segments than the end systems that use it.

25. Server Redundancy (Cont’d)
Name servers are less critical than DHCP servers because users can reach services by address instead of name if the name server fails
If ATM is used it is a good idea to duplicate the ATM services used by clients running ATM LAN emulation (LANE) software
LAN Emulation Configuration Server (LECS)
LAN Emulation Server (LES)
Broadcast and Unknown Server (BUS)

26. Server Redundancy (Cont’d)
Where cost of downtime for file servers is a major concern mirrored file servers should be recommended
If complete redundancy is not feasible then duplexing of the file server hard drives is a good ideas
mirrored file servers allow the sharing of workload between servers

27. Workstation-to-Router Redundancy
Workstation-to-router communication is critical in most designs to reach remote services
Many ways to discover a router on the network depending on the protocol running and its implementation

28. AppleTalk Workstation-to-Router Communication
AppleTalk workstations remember the address of the router that sent the most recent RTMP packet
To minimize memory and processing requirements remembers the address of only one router

29. Novell NetWare Workstation--to-Router Communication
Broadcasts a find-network-number request to find a route to the destination
Routers on the workstation’s network respond
The workstation uses the first router that responds

30. IP Workstation-to-Router Communication
Implementations vary in how they implement workstation-to-router communication.
Some send an address resolution protocol (ARP) to find remote station
A router running proxy ARP responds to the ARP request with the router’s data-link-layer address
Advantage of proxy ARP is that a workstation does not have to be manually configured with the address of a router

31. IP Workstation-to-Router Communication (Cont’d)
Sometimes network administrators manually configure an IP workstation with a default router
A default router is the address of a router on the local segment that a workstation uses to reach remote services
A number of protocols are used to identify routers such as
Router Discovery Protocol (RDP) which uses
Internet control Message Protocol (ICMP)
ICMP router advertisement packet
ICMP router solicitation packet

32. Designing an Enterprise Network Design Topology
Should meet a customer’s goals for availability and performance by featuring redundant LAN and WAN segments in the intranet, and multiple paths to extranets and the Internet
Virtual Private Networking (VPN) can be used

33. Redundant WAN Segments
Because Wan links can be critical redundant (backup) WAN links are often included in the enterprise topology
Full-mesh topology provides complete redundancy
Full mesh is costly to implement, maintain, upgrade and troubleshoot

34. Circuit Diversity
Learn as much as possible about the actual physical circuit routing
Some carriers use the same facilities which means the backup path is susceptible to the same failure as the primary path
Circuit diversity refers to the optimum situation of circuits using different paths
It is becoming increasingly harder to guarantee circuit diversity because of mergers of carriers
Analyze your local cabling in addition to the carrier’s services

35. Multihoming the Internet Connection
Means to provide more than one connection for a systems to access and offer network services
Server is multihomed is it has more than one network layer address
Increasing used to refer to the practice of providing an enterprise network more than one entry into the Internet
Has the potential to become a transit network that provides interconnections for other networks
Means routers on the Internet learn they can reach other routers through the enterprise network

36. Virtual Private Networking
Enable a customer to use a public network to provide a secure connection among sites on the organization’s internetwork
Can also be used to connect an enterprise intranet to an extranet to reach outside parties
Gives the ability to connect geographically-dispersed offices via a service provider vice a private network
Company data can be encrypted for routing
Firewalls and TCP?/IP tunneling allow a customer to use a public network as a backbone for the enterprise network

37. Secure Network Design Topologies
Planning for Physical Security
Meeting Security Goals with Firewall Topologies

38. Planning for Physical Security
Install critical equipment in computer rooms that have protection
Logical design might have an impact on physical security
Planning should start to allow lead times to build or install security mechanisms

39. Meeting Security Goals with Firewall Topologies
A firewall is a system or combination of systems that enforces a boundary between two or more networks
Can be a router with access control lists (ACL)
Dedicated hardware box
Software running on a PC or UNIX system
Should be placed in the network topology so that all traffic from outside the protected network must pass through the firewall
Security policy specifies which traffic is authorized to pass through the firewall

40. Meeting Security Goals with Firewall Topologies (Cont’d)
Especially important at the boundary between the enterprise network and the Internet
Customers with the need to publish public data and protect private data the firewall topology can include a public LAN that hosts Web, FTP, DNS and SMTP servers
Larger customers should use a firewall in addition to a router between the Internet and the enterprise network

41. Meeting Security Goals with Firewall Topologies (Cont’d)
An alternative is to use two routers as the firewall and place the free-trade zone between them. This is the three-part firewall topology
The configuration on the routers might be complex, consisting of many access control list to control traffic in and out of the private network and the free trade zone.
Dedicated firewalls usually have a GUI that lets you specify a security policy an an intuitive fashion

42. Summary
Designing a network topology is the first step in the logical design
Three models for network topologies: hierarchical, redundant, and secure
Hierarchical lets you develop a network consisting of many interrelated components in a layered, modular fashion
Redundant lets you meet requirements for network availability by duplicating network components
Secure protects core routers, demarcation points, cabling, modems and other equipment. Adding firewalls protects against hackers.