LCH.Clearnet Ltd Network Connectivity Guide

Group Member Access

LCH.Clearnet Ltd Network Connectivity Guide

(BT Radianz)

Owner: Director, Commercial Services

Document Version Number: 1.0

Issue Date: 22 June 2009

COPYRIGHT

The copyright in this work is vested in LCH.Clearnet Limited. It must not be reproduced in whole or in part without the prior written consent of LCH.Clearnet Limited and then only on the condition that this notice is included in any such reproduction.

© 2009 LCH.Clearnet Limited, 33 Aldgate High Street, London, EC3N 1EA

LEGAL NOTICE

This Member Connectivity Guide (BT Radianz) does not constitute a contractual agreement between LCH.Clearnet Ltd, its clearing members or any other entities. The contents of the Member Connectivity Guide (BT Radianz) do not constitute a representation, warranty or undertaking of any kind to clearing members by LCH.Clearnet Ltd or BT Radianz. The contractual relationship relating to the provision of the BT Radianz network by LCH.Clearnet Ltd is governed entirely by the Network Services Agreement as executed by LCH.Clearnet Ltd and its clearing member(s) in advance of the provision of the BT Radianz network. No party shall have any remedy in respect of misrepresentation or untrue statement contained in this Member Connectivity Guide (BT Radianz).

LCH.Clearnet Ltd and Members Only

This document can be freely distributed within LCH.Clearnet Limited and Member organisations but should not be copied beyond these limits without the agreement of the information owner.

TRADEMARKS

All trademarks are duly acknowledged.

BT Radianz and RadianzNet are the registered trademarks of British Telecommunications plc.

© LCH.Clearnet Ltd LCH.Clearnet Ltd Network Connectivity Guide (BT Radianz)

LCH.Clearnet and Members Only i

Contents

1. Introduction________________________________________________________ 1

1.1 Background ----------------------------------------------------------------------------------------- 1

1.2 Purpose of the guide ----------------------------------------------------------------------------- 1

1.3 Contact information ------------------------------------------------------------------------------- 1

1.4 Abbreviations --------------------------------------------------------------------------------------- 2

1.5 Related documents ------------------------------------------------------------------------------- 2

2. Network overview ___________________________________________________ 3

2.1 Architecture ----------------------------------------------------------------------------------------- 3

2.2 Connectivity ----------------------------------------------------------------------------------------- 4

2.2.1 Resilience ...................................................................................................... 4

2.2.2 Network Security ........................................................................................... 4

2.2.3 Capacity ........................................................................................................ 4

2.2.4 Local Access Providers ................................................................................. 4

3. Network connection policies __________________________________________ 5

3.1 Common Member connectivity option -------------------------------------------------------- 5

3.2 BT Radianz connections ------------------------------------------------------------------------- 5

3.2.1 Bronze service connectivity ........................................................................... 6

3.2.2 Silver service connectivity .............................................................................. 7

3.2.3 Silver Split-Site service connectivity ............................................................... 8

3.2.4 Gold service connectivity ............................................................................... 9

3.2.5 Platinum service connectivity ....................................................................... 10

3.3 Member responsibilities ------------------------------------------------------------------------ 10

3.3.1 Network demarcation ................................................................................... 11

3.3.2 Connectivity problems ................................................................................. 11

3.4 Maintenance -------------------------------------------------------------------------------------- 11

3.5 Data Centre fail-over --------------------------------------------------------------------------- 11

3.5.1 LCH.Clearnet Ltd business continuity .......................................................... 11

3.5.2 Member business continuity ........................................................................ 11

3.6 Relocation of service --------------------------------------------------------------------------- 12

4. Continuity and Security _____________________________________________ 13

4.1 Continuity ------------------------------------------------------------------------------------------ 13

4.2 Security -------------------------------------------------------------------------------------------- 13

4.3 Physical security --------------------------------------------------------------------------------- 13

Appendix A. BT Radianz provisioning process ______________________________ 14

A.1 Contractual framework ------------------------------------------------------------------------- 14

A.2 Ordering ------------------------------------------------------------------------------------------- 14

A.3 Timeline ------------------------------------------------------------------------------------------- 15


LCH.Clearnet and Members Only ii

Figures Figure 1: General network architecture --------------------------------------------------------------------- 3

Figure 2: Bronze single minimum 2Mbps test access (Ltd) or minimum 4Mbps test access (Group) ------------------------------------------------------------------------------------------------------- 6

Figure 3: Silver resilient minimum 2Mbps single site (Ltd) or minimum 4Mbps single site (Group) ------------------------------------------------------------------------------------------------------- 7

Figure 4: Silver resilient minimum 2Mbps split sites (Ltd) or minimum 4Mbps split sites (Group) ------------------------------------------------------------------------------------------------------- 8

Figure 5: Gold resilient access on main site and single access on other site --------------------- 9

Figure 6: Platinum resilient access on dual sites ------------------------------------------------------- 10

Figure 7: Contractual framework outline ----------------------------------------------------------------- 14


Version 1.0 - 22 June 2009 LCH.Clearnet and Members Only 1 of 15

1. Introduction

1.1 Background

LCH.Clearnet Ltd is using BT Radianz as part of the Group Member Access (GMA) strategy to provide Members with network connectivity to its clearing applications. This guide explains the connectivity options available to LCH.Clearnet Ltd Members for connecting via BT Radianz.

1.2 Purpose of the guide

The intention of this guide is to provide LCH.Clearnet Ltd Members with a high-level technical overview of the options available for connecting to LCH.Clearnet Ltd’s clearing service via BT Radianz. This information will assist Members in their decision making process of how best to connect to LCH.Clearnet Ltd services.

Members are then invited to discuss their connectivity preferences further with both LCH.Clearnet Ltd and BT Radianz technical staff with the intention of reaching a preferred network topology decision.

The practical process of connection to BT Radianz will involve Member specific detailed technical discussions, including agreeing IP addressing details and identifying network demarcation points. This level of detail is not included in this high level guide.

Please note: BT Radianz only provides a path, which is dependent on the service tier selected, to the clearing applications. Consequently, this guide addresses connectivity to BT Radianz at network level only.

LCH.Clearnet Ltd will from time to time refine this document to reflect the ongoing development of the clearing services. Amended versions of this document will therefore be issued accordingly.

1.3 Contact information

For technical issues and other queries relating to the managed network service provided by BT Radianz for LCH.Clearnet Ltd, Members need to contact the Service Desk:

• telephone on +44 (0) 20 7426 7200

Or,

• e-mail [email protected]

mailto:[email protected]



1.4 Abbreviations

The following table defines the abbreviations used within this document.

Abbreviation Definition

BC Business Continuity

CE Customer Edge

GMA Group Member Access

HA High Availability

ISV Independent Software Vendors

MMTP Multimedia Multiplexing Transport Protocol

NAT Network Address Translation

NSRP NetScreen Redundancy Protocol

POP Point of Presence (of a network solution provider)

SPOF Single Point of Failure

TCP/IP Transmission Control Protocol/Internet Protocol

VPN Virtual Private Network

1.5 Related documents

This document is one of a set of documents, listed below:

• Managed Service Network Order Form

• Network Services Agreement



2. Network overview LCH.Clearnet Ltd has chosen BT Radianz as the network service provider for its clearing services.

BT Radianz owns and operates RadianzNet, an IP-based global financial extranet that provides highly reliable and scalable network services.

RadianzNet connects North America, Europe and Asia to provide a 24*7 “Follow the Sun” service.

2.1 Architecture

Figure 1 illustrates the general network architecture, using BT Radianz, between the Member and LCH.Clearnet Ltd.

LCH.Clearnet Clearing

Services

LCH.Clearnet Ltd

Primary Datacentre

BT RadianzNet

Group Member Access

POP

POP

Clearing Member Site

LCH.Clearnet Ltd

Secondary Datacentre

2–10Mbps resilient &

secured access

Resilient access

Resilient access

RadianzNet secured resilient managed connection

Managed

VPN routers

Managed

VPN routers

Managed

VPN routers

LCH.Clearnet Clearing

Services

Figure 1: General network architecture

The Group Member Access (GMA) managed service network solution provides a secure and resilient network which guarantees enhanced levels of performance over the legacy network it replaces.



2.2 Connectivity

2.2.1 Resilience

A GMA standard access is constructed using two diversely provided telecom circuits connecting the Member site to LCH.Clearnet Ltd. In the standard configuration one network path is active and the other passive.

Members can choose their network topology for standard connectivity. The following connectivity options are available:

• Silver – Single Member site connecting to RadianzNet via two diversely provided access circuits.

• Split-Site Silver1 – Dual Member sites, accessed via two circuits with one

circuit to each site.

• Gold - Dual Member sites, the Primary site accessed via two circuits, and the Secondary site via a single circuit.

• Platinum – Dual Member sites, each connected via dual diversely provided circuits.

• Bronze – Single circuit access.

For sites where dual circuit access is required this is always provided (where available) by two different Telecom Path Providers and connecting to physically separate POPs (network Points of Presence) on RadianzNet.

2.2.2 Network Security

Logical security is enforced by VPN Encryption Gateways located on Member premises. Each GMA network path has its own distinct VPN Encryption Gateway.

2.2.3 Capacity

Members can connect via RadianzNet to LCH.Clearnet Ltd services in a scalable manner in 2Mbps steps from 2Mbps to 10Mbps.

BT Radianz constantly monitors bandwidth utilisation at each RadianzNet POP to ensure threshold limits are not exceeded. BT Radianz provides bandwidth allocation on the last mile to guarantee service delivery to subscribers on RadianzNet.

2.2.4 Local Access Providers

In order to provide physical path separation BT Radianz utilise multiple telecom path providers for local loop access. For LCH.Clearnet Limited the prime suppliers for local access circuitry are COLT & Verizon Business, with a third alternative being BT

2.

1 Members must provide Layer 2 connectivity between their sites in order for this Silver option to function.

2 The precise choice of local access circuit suppliers will depend on geography and other factors.



3. Network connection policies This section describes LCH.Clearnet Ltd’s policies with respect to a BT Radianz network connection. BT Radianz connects Members to the clearing service through its IP-based RadianzNet network.

Policies will be updated when new applications, technologies and standards are agreed and implemented.

3.1 Common Member connectivity option

Members requiring to connect to both LCH.Clearnet Ltd and LCH.Clearnet SA clearing services through GMA will require, subject to confirmation, a minimum bandwidth network path of 4Mbps; 2Mbps for each service.

These network paths do not contend and are presented as unique physical ports on the VPN Terminating device, typically a Juniper Netscreen.

3.2 BT Radianz connections

BT Radianz will install, configure and monitor the network routers, switches and IPSec-based VPN devices at Member sites.

The network provides access to the clearing service of LCH.Clearnet Ltd and is based on Cisco Systems network infrastructure platforms, which include Cisco routers at Member sites and LCH.Clearnet Ltd, primary and secondary data centres.

A standard Member connection is two fibre leased-line circuits at a minimum speed of 2Mbps provided by diverse local loop Telecoms providers. The bandwidth is scalable from 2Mbps to 10Mbps in 2Mbps increments, dependent on users clearing activity profile. The minimum bandwidth requirements will be agreed between the parties concerned during further negotiations.

Member connection is provided through one of five tiers:



3.2.1 Bronze service connectivity

BT RadianzNet

Secured IP Network

2Mbps single access


POP1

Clearing Member LAN –

internal @IP

BT Radianz

CE Router

BT Radianz

Switch

BT Radianz

Netscreen

Test Clearing

Applications

LCH.Clearnet Ltd Clearing Services

BT RadianzNet

Secured IP Network

4Mbps single access


POP1


internal @IP

BT Radianz

CE Router

BT Radianz

Switch

BT Radianz

Netscreen

Test Clearing

Applications

LCH.Clearnet Ltd

Clearing Services

LCH.Clearnet SA

Clearing Services

Figure 2: Bronze single minimum 2Mbps test access (Ltd) or minimum 4Mbps

test access (Group)

Bronze Service key points:

• A single, non-resilient connection of between 2Mbps and 10Mbps to a single site.

• Typically used for connectivity to a Members’ 3rd site or to access an ISV.



3.2.2 Silver service connectivity

BT RadianzNet

Secured IP Network

2Mbps resilient access


POP1


internal @IP

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

Clearing

Applications


BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

POP2

BT Radianz

Primary

Netscreen

BT Radianz

Secondary

Netscreen

Untrust LAN

NSRP & HA

Primary Secondary

BT RadianzNet

Secured IP Network



POP1


internal @IP

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

Clearing

Applications

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

POP2

BT Radianz

Primary

VPN Gateway

BT Radianz

Secondary

VPN Gateway

Untrust LAN

NSRP & HA

Primary Secondary

LCH.Clearnet Ltd

Clearing Services

LCH.Clearnet SA

Clearing Services

Figure 3: Silver resilient minimum 2Mbps single site (Ltd) or minimum 4Mbps

single site (Group)

Silver Service key points:

• A single site, resilient connection of between 2Mbps and 10Mbps.

• Two access circuits typically provider by alternative Telco path providers.

• This tier option is a typical choice by Members without a separate BCP site.



3.2.3 Silver Split-Site service connectivity

BT RadianzNet

Secured IP Network



Primary Secondary

Clearing Member Site - A

Clearing

Applications

POP1

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

BT Radianz

Primary

Netscreen

Clearing Member Site - B

Clearing

Applications

POP2

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

BT Radianz

Secondary

Netscreen

BT RadianzNet

Secured IP Network

4Mbps resilient accessPrimary Secondary


Clearing

Applications

POP1

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

BT Radianz

Primary

VPN Gateway


Clearing

Applications

POP2

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

BT Radianz

Secondary

VPN Gateway

LCH.Clearnet Ltd

Clearing Services

LCH.Clearnet SA

Clearing Services

Figure 4: Silver resilient minimum 2Mbps split sites (Ltd) or minimum 4Mbps

split sites (Group)

Silver Service split-site key points:

• Single non-resilient connections of between 2Mbps and 10Mbps to each of two Member sites

• Circuits provided by alternate Telco path providers.

• Member sites connected at Member’s own Layer 2 network path.

• Typically this will be provided for Members who have already standardised on this delivery topology with BT Radianz.

Within this tier, there are two options available:

• Option 1 – resilient split site Layer 2 with Untrust shared LAN provided

• Option 2 - resilient split site Layer 2 with no Untrust shared LAN provided



3.2.4 Gold service connectivity

BT RadianzNet

Secured IP Network


POP1


internal @IP

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

Clearing

Applications

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

POP2

BT Radianz

Primary

VPN Gateway

BT Radianz

Secondary

VPN Gateway

Untrust LAN

NSRP & HA

Primary Secondary


BT Radianz

CE Router

BT Radianz

Switch

BT Radianz

VPN Gateway

Clearing

Applications


internal @IP

LCH.Clearnet Ltd

Clearing Services

LCH.Clearnet SA

Clearing Services

Figure 5: Gold resilient access on main site and single access on other site

Gold Service key points:

• Connection based on three circuits of between 2Mbps and 10Mbps on two different Member sites.

• On the Member’s primary site, resilient access is provided using two network paths from alternate local circuit providers. The secondary Member site is connected by a single network path.

• This tier option is a typical choice by Members requiring to connect to 2 sites.



3.2.5 Platinum service connectivity

BT RadianzNet

Secured IP Network



internal @IP

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

Clearing

Applications

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

BT Radianz

Primary

Netscreen

BT Radianz

Secondary

Netscreen

Untrust LAN

NSRP & HA

Primary Secondary



internal @IP

BT Radianz

Primary

CE Router

BT Radianz

Primary

Switch

Clearing

Applications

BT Radianz

Secondary

CE Router

BT Radianz

Secondary

Switch

BT Radianz

Primary

Netscreen

BT Radianz

Secondary

Netscreen

Untrust LAN

NSRP & HA

POP2POP1

LCH.Clearnet Ltd

Clearing Services

LCH.Clearnet SA

Clearing Services

Figure 6: Platinum resilient access on dual sites

Platinum Service key points:

• Connection provided to two Member sites using dual, resilient network paths of between 2Mbps and 10Mbps.

• Each site is connected by two physically separate network paths provided by alternate carriers.

3.3 Member responsibilities

Members responsibilities are detailed in the Network Services Agreement they have signed with LCH.Clearnet Ltd.

It is expected that the Member will provide all structured cabling between their equipment and the BT Radianz managed VPN routers.

Members are also expected to provide adequate space to house the equipment and the necessary power and other environmental provisions that are deemed necessary to effectively operate the equipment.

Members connecting via the Split-site Silver option will be required to confirm Layer 2 connectivity and that suitable failover arrangements are in place.



Any connection between the BT Radianz network equipment and the Member’s LAN must go via a firewall or router capable of performing Network Address Translation. The connection must be provided and managed by the Member. Network Address Translation (NAT) should take place according to LCH.Clearnet Ltd addressing standards.

3.3.1 Network demarcation

The BT Radianz network demarcation point on the Member site is the output port of the IPSec VPN Terminating device, typically an SSG20 or SSG140 Juniper Netscreen.

3.3.2 Connectivity problems

Any issues associated with the LCH.Clearnet Ltd service, whether application or technology related, should always be reported to the LCH.Clearnet Ltd Service Desk (see section 1.3 Contact information). The LCH.Clearnet Ltd Service Desk will make every effort to assist Members with all service related matters.

The LCH.Clearnet Ltd Service Desk will analyse the reported issue and determine whether the issue is application or technology related.

If this analysis indicates that the matter relates to the network service then LCH.Clearnet Ltd’s technical staff will formally raise the matter directly with the BT Radianz Global Service Centre for resolution and will cooperate with the RadianzNet technical staff to resolve the matter.

3.4 Maintenance

BT Radianz is responsible for maintaining all RadianzNet equipment on Member sites.

3.5 Data Centre fail-over

3.5.1 LCH.Clearnet Ltd business continuity

LCH.Clearnet Ltd hosts its clearing services from two geographically separated, purpose built data centre sites. Under normal operational conditions, all production services are provided from the primary data centre. In the event that it is not possible to deliver the service from the primary data centre, operations are switched to the secondary data centre. The failover between data centres is transparent to Members.

3.5.2 Member business continuity

LCH.Clearnet Ltd recognises that Members will have implemented varying capabilities for business continuity and recovery. To accommodate the diversity of requirements, there is the capability to connect Member BC site(s) to the network.



3.6 Relocation of service

Should a Member have the requirement to modify their connection arrangements with LCH.Clearnet they should contact the LCH.Clearnet Ltd Service Desk, supplying details of the new location and the site to be decommissioned. The LCH.Clearnet Ltd Service Desk will manage the network connectivity process on behalf of the Member and will provide the Member will the relevant documentation and will notify the relevant LCH.Clearnet Ltd Commercial Services contact.

Once the documentation has been signed and full details supplied, the forms should be returned to the LCH.Clearnet Ltd Service Desk for action.

Members can contact the LCH.Clearnet Ltd Service Desk for details of costs and lead times for relocation solutions.



4. Continuity and Security The new Member Network Connectivity solution is based on a trusted third party managed network service provided by BT Radianz.

4.1 Continuity

Excluding the Bronze Service tier option, all other network topologies provided are resilient. The LCH.Clearnet Ltd service is accessed via a managed service comprising;

• Resilient Site Equipment: Dual network equipment on Member site with active failover mechanisms operative.

• Dual Site Carrier Access: Resilient site access with no SPOF (Single Point of Failure) based on dual alternate carriers.

• Core Network: Secured and fully-meshed.

• Resilient Provider Service: LCH.Clearnet Ltd connect to RadianzNet via multiple network paths provided by alternate carriers. All data centre infrastructure is dual provisioned with automatic fail over.

4.2 Security

The security aspects (encryption and authentication) are provided by the new GMA network, with end-to-end VPN tunnelling based on IPSec protocol (the VPN gateway is fully managed by BT Radianz).

All data flows are secured by this VPN layer.

4.3 Physical security

The Member is responsible for the physical security of the BT Radianz equipment installed on their site and for ensuring that it is provided with a stable power supply.

The building within which the BT Radianz equipment is located must have an adequate level of physical and environmental security. The BT Radianz equipment itself should be located within a locked room with access controlled on a need-to-go basis.

The Member is expected to insure the BT Radianz equipment installed on their site; details are provided in the LCH.Clearnet Ltd Terms and Conditions of service.



Appendix A. BT Radianz provisioning process

A.1 Contractual framework

The diagram below shows the contractual arrangement between the three parties involved in the provisioning of the network services described in this document. In essence LCH.Clearnet Ltd has a contract in place with BT Radianz. A separate contract exists between each Member and LCH.Clearnet Ltd regarding the connectivity necessary to access LCH.Clearnet services.

Members / ISVs

LCH.Clearnet Ltd

BT Radianz

Agreement

=

Member Order Form

+

Network Service Agreement

1

2

Figure 7: Contractual framework outline

1. A Framework Services Contract (Master Services Agreement) is in place between BT Radianz and LCH.Clearnet giving the right to LCH.Clearnet Ltd to offer Members access to their clearing services over the BT Radianz network (RadianzNet).

2. An Order Form and Network Service Agreement is signed between the Member and LCH.Clearnet defining the provision of the Member network service necessary for accessing the LCH.Clearnet clearing applications.

Please note: LCH.Clearnet Ltd will bill Members.

A.2 Ordering

Members who want to order the network service must complete a Managed Network Service Order Form and return it to LCH.Clearnet Ltd.

Typically, BT Radianz will carry out the following activities:

1. Confirm the circuit termination details with the Member

2. Process and validate orders within BT Radianz

3. Perform site surveys at Members’ sites



4. Provision local access circuits as necessary

5. Confirm local access lead times and liaise with the Member

6. Confirm IP address details with Members and prepare router configurations

7. Install Member site equipment as necessary

8. Download router and VPN configurations

9. Perform technical acceptance testing with the Member

A.3 Timeline

The provisioning lead times of the new Member network service over BT Radianz is dependent on whether the Members is already connected to RadianzNet for access to other services or not.

For LCH.Clearnet services the network service level agreement (SLA) for network delivery is as follows:

1. For Members who are already connected to RadianzNet, and whose existing connectivity paths have sufficient capacity, the network delivery lead time is 39 working days.

2. For Members who are not already connected to RadianzNet the network delivery lead time is 69 working days.

LCH.Clearnet Ltd Network Connectivity Guide

Documents

Transcript of LCH.Clearnet Ltd Network Connectivity Guide