Develop Product Network Infrastructure for Warren Center for General MotorsWord文档格式.docx
《Develop Product Network Infrastructure for Warren Center for General MotorsWord文档格式.docx》由会员分享,可在线阅读,更多相关《Develop Product Network Infrastructure for Warren Center for General MotorsWord文档格式.docx(9页珍藏版)》请在冰豆网上搜索。
![Develop Product Network Infrastructure for Warren Center for General MotorsWord文档格式.docx](https://file1.bdocx.com/fileroot1/2022-12/30/434b4540-3052-46b4-bf07-b8e6cc73f0cb/434b4540-3052-46b4-bf07-b8e6cc73f0cb1.gif)
LyleBrown.CCIE#3794
KPMGConsulting,LLC
UnderthedirectionofCiscoSystems
TableofContents
ProjectInitiation1
Goalsstatement1
Objectives1
ExecutiveOverview1
Concept1
Architecture3
Design4
GapAnalysis5
Security6
NetworkManagement6
Templates7
AppendixA
StatementofWork
AppendixB
ConceptforDevelopProduct
AppendixC
NetworkArchitectureforDevelopProduct
AppendixD
NetworkDesignSamplesforDevelopProduct
AppendixE
GapAnalysis
AppendixF
SecurityArchitectureforDevelopProduct
AppendixG
NetworkManagementArchitectureforDevelopProduct
AppendixH
RevisedArchitectureTemplateTT-?
?
ProjectInitiation
Goalsstatement
Thegoalofthiseffortistodefinealocal,managedandsecureNetworkInfrastructureforDevelopProductontheWarrencampusthatsupportsGM’sstatedbusinessobjectivesandrequirements.
Objectives
Specificobjectivestobemetinachievingthestatedgoalareto:
-DevelopaconceptualframeworkforDevelopProductontheWarrencampustobeusedasanetworkblueprintdocumentthatlinksstatedrequirements,withthearchitectureforthenetworkinitiative.Theinitialconceptistobepresentedwithintwoweeksofprojectinitiation.
-Conductanddocumenta“gapanalysis”todescribedifferencesbetweenthecurrent(planned)statenetworkandtheconceptualnetwork.
-DevelopaNetworkTopology(Architecture)andcorrespondingDesignTemplates.Thiseffort,whilefocusedonthelocalenvironment,willincludetreatmentsfor
-connectivitytoGM’sotherdesigncenters
-connectivitytosuppliers
-connectivitytoGM’scorporatenetwork,and
-dialincapability.
-DetaildiscussionsregardingNetworkManagementandSecurityimplicationsoftheDesign.
TheoriginalStatementofWorkandamendmentsareincludedinAppendixA.
ExecutiveOverview
Concept
GMhasimplementedacoherentplantointegratetheWarrenTechnicalCentercampusenvironment.Thephysicalsiteconsistsofseverallargebuildingsonasquaremilecampus.TheexistingplanistoconsolidateservicesinasingleDataCenter.Thisiseffectivelya24x7computerroomwhereserversarelocated.ThiscenterwillservicethelocalenvironmentaswellasregionalGMMegaCentersites.ThecurrentconceptistoGeographicallydistributeendusersites.EachbuildingorremotesiteistreatedasadistinctLANenvironmentoperatingatLayer2(switching).TheseGeographicallydistributedsiteswillbeinterconnectedviaLayer3(routing).Connectivitytoexternalentities–Internet,partners,etc.–areallowedthroughtheGMWANenvironment.
Thisenvironmenttreatsallusersatagivenlocationthesame.Thereisnomechanisminplacetofavoroneuseroveranother.Alltrafficismixedandaccessisshared.DevelopProductshasasetofrequirementsthataredifferentfromthegeneralpopulationthusrequiringspecializedtreatment.
WhileDevelopProductsisaglobalenterpriseandconnectivitymustbeestablishedwiththatinmind,therearearelativelyfewsitesontheWarrencampuswithveryhighconcentrationsofDevelopProductusers.ThiswillbecomeevenmoresoasrenovationandconstructionoftheVECbuildingiscompleted.Itisanticipatedthatupto12,000engineerswilloccupythatbuilding.Theengineeringaspectoftheenvironmentcausesdatavolumestobeverylarge.TransferofdatabecomestheprimarydriverforDevelopProduct.Concurrentwithdatamovement,simplicityandreliabilitybecomeveryimportantaswell.
TheDevelopProductNetworkConceptwascreatedfromaverygeneralsetofrequirementsfromDevelopProduct.Essentiallytheinitialsetofrequirementsincluded
-reducethenumberofdevicesbetweenaDevelopProductclientandhisprimaryserver
-reducethenumberofroutinghopsbetweenanyDevelopProductclient,includingglobalclients,andaDevelopProductserver
-minimizetheeffectsofroutingbyminimizingthenumberofLayer3devicestraversedinaconversation
-provideatopologythatwilldeliver50IOPS(1.6Mbps)toeachDevelopProductuser
-allowinterconnectivityforDevelopProductusersandtherestoftheworld
-describeaHighlySecuredenvironmentforthe“crownjewels”(Portfolio)
-describeatopologyinsuchafashionthatcomponentfailurewilldisplacenomorethan500users.
ThreeFunctionalenvironmentswillbeconstructedtosupportdistinctsetsofusers.Thisdoesnotprecludeaccessamongthem.Serverswillbedistributedamongtheseenvironmentsbasedupondataresidentonthem.ThecurrentLANdistributionisGeographical.ACampusAreaNetwork(CAN)interlinksthevariousbuildingsusingrouting,Layer3.EachbuildinghousesasingleLANenvironmentthatcommunicateswithothersviatheCAN.
AllserversfortheregionalMegaCenterarehousedinasingleDataCenterontheWarrencampus.ThisparticularbuildingalsohousesthemajorityoftheDevelopProductusers.
TheconceptistotreatDevelopProductasalogicalbuilding.BecausethemajorityoftheuserswillbehousedinthesamebuildingasDataCenter,itispossibletomoveserversfromtheGeneralPurposeenvironmentdirectlyintotheDevelopProductenvironment.Thisisdonetohelpabbreviatethedistancebetweenclientandserver.Layer3servicesarecollapsedintoasinglelayertominimizeroutingimplications.
DistinctenvironmentsaretobedevelopedforthetwosetsofDevelopProductusers.OneenvironmentisHighlySecuredandwillbeplacedbehindfirewallfunctions.Itwillbeadistincttopologythatislinkedto,butseparatefrom,theGeneralPurposeenvironment.ThesecondsetofuserswillutilizeatopologythatisintegratedwiththeGeneralPurposeenvironment.Whileitisintegratedwiththeexistingenvironment,theselectionofthepathbetweenclientandserverwillcausesegregationoftraffic.Itiscalledlooselycoupled.
TheconceptfortheHighlySecurednetworkisthesameasthatfortheremainderofDevelopProductexceptthatitisphysicallyseparatedfromtheothertwoenvironments.However,initiallyserverswillbeplacedinthesameLayer2environmentasclientsfortheHighlySecuredenvironment.TheonlytopologicaldifferencebetweenthetwoistheconnectionintotheoverallGMenvironment.ThisconnectionwillbethroughasinglefirewalledandcloselymonitoredconnectionfortheHighlySecuredusers.
TheconceptallowsthetopologytospanmultiplebuildingsontheWarrencampus.ConnectivitycanbethroughtheuseofdedicatedfiberorutilizetheexistingCAN.SmallclustersofeitherHighlySecuredorlooselycoupledDevelopProductuserscanresideontheexistingnetworkandretainconnectivitytothedesiredenvironment.Inthecaseoflooselycoupledtherearenospecialconsiderationsthatmustbemade.Accessisallowedthroughnormalrouting.TheremustbespecialconsiderationsintheHighlySecuredenvironmentthough.Someformofauthenticationandauthorizationmustbeimplemented.ThiscanbeaccomplishedthroughtheuseofVPNtechnologyorsomeimplementationofusername/passwordtechnology.
WANconnectivityisnotspecificallyrequiredforeitherthelooselycoupledortheHighlySecuredenvironmentsatthistime.Theconceptdoesnotprecludethistypeofaccess.Remote,evenglobal,usersretainthecapabilitytoaccessbothenvironmentsthroughexistingtopology.
TheConceptdocumentdevelopedisincludedinAppendixB.
Architecture
TheArchitectureconstructedfortheDevelopProductenvironmentreliesontraditionaldefinitionsofLANs.BoththelooselycoupledandtheHighlySecuredenvironmentsaredefinedtobehierarchicalinnature.Eachwillpotentiallyconsistofthreelayers–Access,DistributionandCore.
TheAccesslayerwillconnectclientdevicestothenetwork.ItwillbeLayer2Ethernetswitch.Ontheclientsideitwillsupport10/100Mbpsconnectionsand1000Mbpsconnectionsonthenetworkside.ItwillsupportmultipleLayer2environments–VLANs–foruserattachment.Thisdevicewillsupportboththeaggregationoftrafficonaport,Trunking,andtheaggregationofports,Channeling.TrunkingandChannelingwillbeimplementedonthenetworkside.
TheCorelayerwillbeusedtoconnectclientswithservers.Thiswillbearouted,Layer3,connection.Thisdevicewillbeaswitchwithroutingcapabilities.Itmustbecapableofsupportingalargenumberof1000Mbpsconnections,TrunkingandChanneling.TheintentoftheConceptistoconnecteveryAccesslayerswitchtoeveryserverataCoredevice.ThepurposeofthisistoreducetherequiredroutingcomponenttoasingledeviceconnectingthetwoLayer2environments.
DistributionlayersareallowedintheArchitecturetosupportscalingissues.BecauseofportdensityconsiderationsonCoredevices,itmaynotbepossibletoconnectclientsand/orserversthroughdedicatedports.InthesecasesaDistributionlayercanbeinsertedoneithersideoftheCoretoaggregatetrafficandprovidealogicalconnectiontotheCore.ThesedevicesareLayer2andmustsupportalargenumberof1000Mbpsconnections,TrunkingandChanneling.
Therequirementsforredundancyandthroughputdictatetheuseofmultiplepathsfromclienttoserver.WithinthenetworkthisisresolvedbytheimplementationofCiscoISLTrunkingandChanneling.Throughtheimplementationofstringentplanning,everyAccessswitchcanbedesignedtohavemultiple,loadbalancedLayer2pathstotheCore.Likewise,throughstringentplanning,serverscanhaveLayer2terminationsattheCore.Thiswi