Internet2 Advanced Network Services Today · Internet2 Advanced Network Services Today Dale...

Internet2 Advanced Network Services Today

Dale Finkelson, Jon-Paul Herron, Paul Howell, George Loftus, John Moore, Chris WilkinsonInternet2

© 2016 Internet2

[ 2 ]


• Network Services Overview (George Loftus)• International (Dale Finkelson)• Network Security (Paul Howell)• Network Operations (Jon-Paul Herron)• Network Architecture (Chris Wilkinson)• Research Support (John Moore)

© 2016 Internet2

[ 3 ]

The Challenge

© 2016 Internet2

47.4

80.3

104.

120.6

265.1

351.9

575.4 694.5 1168.1

R²=0.98706

0

500

1000

1500

2000

2500

3000

CY08

CY09

CY10

CY11

CY12

CY13

CY14

CY15

CY16

Internet2NetworkTotalPetaBytesCarriedPerYear(CalendarYear)

PetaBytesperyear Expon.(PetaBytesperyear)

[ 4 ]

Future-focused efforts to address this challenge

• Ecosystem-wide conversation about collaboration on solutions

• Examining current and emerging business models and services

• Two key principles in determining the future iteration of Internet2 infrastructure:

– Ecosystem-wide collaboration– Agility and experimentation

© 2016 Internet2

[ 5 ]

Collaboration, Agility, ExperimentationUsing pilots to learn quickly together

• Volumetric DDoS Mitigation Service Pilot (6-8 participants)

• Private Cloud (Azure, AWS, etc. )

• Cloud Exchange

• Research Support – Hybrid Cloud in support of research – Leveraging existing campus & regional successes

© 2016 Internet2

[ 6 ]

How we are addressing the challenges today Internet2 Advanced Network Services Today

• International (Dale Finkelson)• Network Security (Paul Howell)• Network Operations (Jon Paul Herron, Chris Wilkinson)• Network Architecture (Chris Wilkinson)• Research Support (John Moore)

© 2016 Internet2

[ 7 ]



© 2016 Internet2

[ 8 ]

Atlantic Region• The ANA (Advanced North Atlantic) project remains strong:

– Original 3 100G circuits• Washington DC – London

Internet2 and Canarie• New York – Paris

GEANT• Amsterdam – Montreal

Nordunet and Surfnet– Recent additions 100G

• New York – London

NEAAR a project at Indiana University funded by NSF

[ 9 ]

Atlantic Region

• The 4 listed circuits are all fully diverse.• There is also a cooperative agreement with Esnet to

mutually back up each others capacity.– Esnet currently has 340G of capacity.

• Since its inception there have been few or no instances where capacity is not available to the users.

[ 10 ]

Pacific Region• Internet2 and Singaren maintain a 100G connection from Los Angeles to Singapore.• Internet2 and CERNET maintain a 10G connection to China.• Overall Pacific connectivity is not as structured as the ANA.

– Lots of capacity.– Work will continue on joint backup and sharing options.

• It would be ideal to see the type of arrangements we have across the Atlantic evolve in the Pacific region.– Internet2 will continue to work with organizations like Singaren, Transpac, TEIN,

AARnet and others for this.

[ 11 ]

North America

• There is a dedicated 10G link to CUDI in Mexico from El Paso.

• Internet2 and Canarie in Canada are connected by 100G in several locations.

Partial list of International Peers• Asia-Pacific Area Network • Australian Academic and Research Network • CA*Net/CANARIE • Cenit (Venezuela)• CERNLight CERNLight• China Educational and Research Network • China Science and Technology Network • Corporacion Universitaria para el Desarrollo de Internet

(Mexico)• Egyptian National STI Network• GEANT-Delivery of Advanced Network Tech to Europe • GEMnet (Mongolia)• Japanese Gigabit Network • KDDI Corporation • King Abdulaziz City for Science and Technology • Korea Advanced Research Network • Korea Research Open Network 2 • National Knowledge Network (India)• National University of Singapore

• NORDUnet• NTT Communications Global IP Network • Qatar Foundation Network • Qatar National Research & Education Network • Rede Nacional de Ensino e Pesquisa (RNP)• SINET • SingAREN• SURFnet• Taiwan Advanced Research and Education Network • TEIN• The World Bank • UAE Research and Education Network • WIDE/NTTA • http://www.internet2.edu/products-

services/advanced-networking/global-services/international-peers/

[ 13 ]

Active Projects• Internet2 continues to work with the University of Guam on getting

them directly connected to Internet2.– Continue to coordinate efforts with the University of Hawaii and

AARnet and others.• Internet2 continues to play a leading role in the activities of the GNA.

– Please attend those sessions for more information.• Technical WG Session Wednesday 7:30 AM• The Global Network: Evolving from an Architecture to an Infrastructure

Wednesday 1:15

[ 14 ]



© 2016 Internet2

[ 15 ]

Network Security • Mission

– Protect the Internet2 network from attack

• Approach– Enable Internet2 leadership to proactively manage security risks that jeopardize the

Internet2 network– Working together with connectors/regionals and members to collectively protect the

National Research and Education Networks

• Team– Grover Browning, Nathan Miller, Karl Newell, Ryan Nobrega

[ 16 ]

Security Program Maturity

You are here

[ 17 ]

Key Improvements for This Year

• Strategy Developed for Attack Detection and Mitigation– DDoS Detection using Deepfield Defender– DDoS Mitigation

• Cloud Scrubbing

• BGP Flowspec• Real Time Black Hole

• Promote improved routing security within our community• Improved network analytics

– Moving from Netflow v5 to IPFIX– Updated version of Deepfield Cloud Intelligence

• Implementation of Secure Management Network• Continue to improve security operations capabilities

[ 18 ]

Security Operations• Security risk assessment performed annually• Security incident management procedure implemented and had an incident• Vulnerability scanning of routers completed• Quarterly review of our ACL’s/filters. Of the 75 prefixes in our management filters,

eliminated 52 prefixes, leaving 23 prefixes, most are /32’s• Annual review of router access led to 27 accounts removed• Annual badge review for physical access to co-location PoPs completed• New physical access procedure being implemented• Security awareness training for staff underway using Securing The Human• Visible Network now uses an authentication wall • Security analysis of syslog using splunk

[ 19 ]

xntpd[21521]: sendto(<Target IP>): No route to hostxntpd[21521]: too many recvbufs allocated (40)

NTP reflection DoS attack from a misconfigured router

[ 20 ]



© 2016 Internet2

[ 21 ]

You know what we do…

• Fix things in the network when they break• Maintenance• Answer questions and make changes people request • Monitoring, measurement, and other operational systems for the Internet2

Network• Projects for changes, new services, security enhancements, etc.

© 2016 Internet2

[ 22 ]

How much of it do we do?

• In a typical month:• 600 tickets, 9,000 ticket edit events• 180 calls inbound• 500 emails outbound, 10,000 inbound• 28 off-hours calls to Internet2 NOC engineers• 10 projects

© 2016 Internet2

[ 23 ]

Some random interesting bits

© 2016 Internet2Response Rate: 8%

[ 24 ]

Previous Focus Areas• Improvements to Change Management, Incident Management• Availability of Services• Projects

– Lean/Kanban– Network Re-architecture– New connections/services– Capacity– Security

© 2016 Internet2

[ 26 ]

Future Focus Areas

• Unified Teams• Targeted Notifications• More Service Awareness• Lean/Kanban round 2

© 2016 Internet2

[ 27 ]


• Network Services Overview (George Loftus)• International (Dale Finkelson)• Network Security (Paul Howell)• Network Operations (Jon Paul Herron)• Network Architecture (Chris Wilkinson)• Research Support (John Moore)

© 2016 Internet2

[ 28 ]

Meet Community Needs through a Strong Infrastructure Ecosystem

© 2016 Internet2

Testbeds&

Agility

Community

Layer 2&

Layer 3Platform

Software

OpticalPlatform

People

InfrastructurePortfolio

[ 29 ]

Meet Community Needs through Enabling Contribution and Collaboration

• Establish Unified Teams– Cross-Organization (Internet2 and Indiana University GlobalNOC)– Improve Collaboration / Communications

• Continue Implementation of Effective, Lightweight Processes– Change Management

– Prioritization– Project Management

• Augment Staffing and Training– Engineering– Project Management

© 2016 Internet2

Community

People


[ 30 ]

Meet Community Needs through Enabling Contribution and Collaboration

• Gather Requirements, Needs, Goals, and Impacts– NTAC– Community Leaders

© 2016 Internet2

Community

People


[ 31 ]

Meet Community Demandfor Backbone and Peer Network Growth

© 2016 Internet2

300G

300GNEWY1118TH

NEWY32AOA

HART2

BOST

ALBA

CLEV

PITTASHB

RALE

WASH

CHAR

PHIL

INDI

LOUI

CINC

STAR

EQCHCHIC

ATLA

300G

200G

200G

200G300G

300G

200G

200G

200G

Community

Layer 2&

Layer 3Platform

OpticalPlatform


[ 32 ]Testbeds&

Agility

Community

Layer 2&

Layer 3Platform

SoftwareInfrastructure

Portfolio

Meet Community Demandfor Network Stability & Enhancement of Experimental Activity

© 2016 Internet2

• MPLS Core Network– Layer 2– Layer 3

• OESS Development

• Security

• Optical Network Optimization & Study– 200G and 400G

• Testbed Support

[ 33 ]

Meet Community Demandfor the Network Stability & Enhancement of Experimental Activity

© 2016 Internet2

Testbeds&

Agility

Community

Layer 2&

Layer 3Platform

Software

OpticalPlatform

People


Q1 Q2 Q3 Q4

AUGJUL SEPJUNMAYAPRMARFEBJAN OCT NOV DEC

OESS Testing

OESS MPLS Enabled

OESS Feature Development

Community MigrationAL2S OF -> MPLS

Deploy FoundationMPLS

ImplementAL3S TR-CPS, LHCONE VRFs

Community MigrationAL3S -> MPLS

ImplementAL3S R&E VRF

AL1S Optimization / AuditPhase 1

AL1S OptimizationPhase 2

SDNTestbed

Enable Testbed ActivitiesLayer 1, Layer 2, Layer 3

DCI Testbed

[ 35 ]

Research Engagement• Convening national-level community-driven initiative to help support campus

cyberinfrastructure needs in a sustainable manner• Program development underway – guided by a stellar advisory group

– Reps from regionals, campuses, Open Science Grid, XSEDE, NSF Advisory Committee on CI, ACI-REF, Science Gateways Institute, ESNet, EDUCAUSE, etc.

• Topic areas under development– National Research Platform (partnering with Pacific Research Platform)– Campus research facilitation – follow on to “Broadening the Reach”– Big Data Grand Challenge – seeking to partner with big data initiatives– Tool integration – started discussion between perfSONAR and XDMOD


Dale Finkelson, Jon-Paul Herron, Paul Howell, George Loftus, John Moore, Chris WilkinsonInternet2

Subtitle (if any)

© 2016 Internet2

Internet2 Advanced Network Services Today · Internet2 Advanced Network Services Today Dale...

Documents

Transcript of Internet2 Advanced Network Services Today · Internet2 Advanced Network Services Today Dale...