The Cisco Hierarchical Network model presented previously will not be abandoned in the remainder of this chapter. In fact, the legacy three-layer model must be mastered to understand the changes that led to the creation of the new and improved Cisco Enterprise Architecture model, which extends the three-layer Hierarchical Network model.
The Cisco Enterprise Architecture model leveraged the Hierarchical Network model, added new components, and made the network more modular. The key aspect regarding this model is modularity. This defines new models that have different functions in the network and facilitates the convenient building block approach when building an IIN. The modules included in the Cisco Enterprise Architecture model include the following:
- Enterprise Campus
- Enterprise Edge
- Enterprise WAN
- Enterprise Data Center
- Enterprise Branch
- Enterprise Teleworker
- Service Provider Edge
The purpose of using this model is to build modules that coordinate with the typical components of the IIN. The three-layer Hierarchical Network model is often fully included in the Enterprise Campus module, as shown in Figure 1.11 below:
Figure 1.11 – Cisco Enterprise Architecture Model Components
In addition to the Enterprise Campus, which includes the Access, Distribution, and Core Layers, there is also an Edge Distribution module that provides a connection between the Enterprise Campus module and other submodules (e.g., WAN, e-commerce, remote access, etc). Different networks will require different modules and submodules based on their particular role and function. The Service Provider Edge module provides external connectivity services to the Enterprise Edge module; however, it is not included in the figure above because it is not considered a part of the organization’s network.
The following sections will briefly describe each module, while the rest of this book will cover all of the technologies used in each of these building blocks.
Enterprise Campus Module
The Enterprise Campus module is often referred to as the LAN and it consists of the Core Layer, the Distribution Layer, and the Access Layer. Sometimes the Core and Distribution Layers collapse into a single layer. An important submodule of the Enterprise Campus module is the edge distribution submodule, which allows connectivity to the Enterprise Edge and Service Provider Edge modules. Modern networks contain a server farm or a data center block (depending on the size and complexity of the network environment) inside the Enterprise Campus module, as depicted in Figure 1.12 below:
Figure 1.12 – Enterprise Campus Module Components
The Campus Core, Distribution, and Access Layers form the Enterprise Campus infrastructure block. The Access Layer submodule consists of workstations, IP telephones, and Layer 2 Access Layer switches. The Distribution Layer submodule is the central location that connects all of the modules together and it includes a high degree of routing and switching operations, ACLs, QoS techniques and filtering, redundancy, load balancing, and multiple equal cost paths. The Core (backbone) Layer submodule provides high-speed connectivity and fast convergence between other submodules (e.g., the server farm and the Edge Distribution submodules), typically using high-end Layer 3 switches. The Core Layer module might also have some QoS or security techniques implemented but caution must be taken with these features to avoid significant overhead. Remember, traffic must be switched at wire speed in the Core Layer.
The Enterprise Campus module might also include the network management submodule that interfaces with all of the other modules and submodules in the network design. This is where SNMP management, logging, and monitoring and configuration management (using applications and tools like CiscoWorks or TACACS+/RADIUS services, which are part of a larger AAA solution) can be found. Another submodule in the Enterprise Campus module is the server farm or data center. A common technology implemented in the server farm submodule is the Storage Area Network (SAN). The server farm submodule includes the following components:
- Database services (Oracle, SQL)
- E-mail or other collaboration systems
- Application services
- File services
- DNS services
- Dynamic Host Configuration Protocol (DHCP) servers
- Other servers
Generally, the services mentioned above will reside on servers that are linked to different switches for full redundancy, load balancing, and load sharing. They might also be cross-linked with Enterprise Campus backbone switches to achieve high availability and high reliability.
The edge distribution submodule has redundant connections to the Core Layer submodule, the Enterprise Edge module, and other Enterprise Edge submodules that will be presented in the next section. This is composed of one or multiple Layer 3 switches that connect redundantly to the Core Layer, Cisco Access Layer servers, high-end routers, or firewall solutions. The Edge Distribution module is the aggregation point for all of the different links in the Enterprise modules, and the demarcation point between the Enterprise Campus and the Enterprise Edge, as shown in Figure 1.11 above.
Enterprise Campus design best practices can be summarized as follows:
- Choose modules that map to different buildings/floors with Distribution Layer and Access Layer functionality.
- Count the number of Access Layer switches to Distribution Layer switches. Implement two or more Distribution Layer switches for redundancy and availability, and have at least two uplinks from each Access Layer switch.
- Design the server farm submodule.
- Design the network management submodule
- Locate and implement the edge distribution submodule.
- Design the Enterprise Campus infrastructure, including the Campus backbone, and link all of the modules to the Campus backbone redundantly.
Enterprise Edge Module
The Enterprise Edge module (see Figure 1.13 below) might consist of particular submodules. Depending on the particular network, one or more of these submodules might be of interest:
- E-commerce
- Internet and DMZ
- Remote access and VPN
- Enterprise WAN
Figure 1.13 – Enterprise Edge Components
The following best practices should be taken into consideration when designing the Enterprise Edge module:
- Isolate permanent links to remote offices first.
- Count the number of connections from the corporate network to the Internet connectivity submodule.
- Design the remote access/VPN submodules.
- Create and implement the e-commerce submodule, if needed.
DMZ Submodule
One of the most interesting and often misunderstood concepts in the Enterprise Edge module is the Demilitarized Zone (DMZ). Figure 1.14 below and the text that follows briefly explain this concept:
Figure 1.14 – Example of a DMZ
Suppose a company has a router that also acts as a firewall and connects to the Internet (outside) through the Serial0/0 interface. The Internet is an untrusted, public network because it is impossible to control and it is capable of launching attacks against networks. The router has another interface, FastEthernet0/0, that connects to the company network (inside). The inside network is made up of workstations, servers, and other devices and they are considered a trusted network because the company owns it and has full control over it.
| Note: According to statistics, from a security perspective, the majority of network attacks come from inside the network, initiated by angry employees, curious employees, or users who are not very technically trained and initiate attacks by mistake. Despite this consideration, for security design purposes consider the inside network a trusted network. |
In addition to devices located on the Internet and inside the network, other resources might include:
- The company’s Web server
- The company’s e-mail server
- An FTP server so users can download information by accessing the company from the outside
- Network devices (firewalls, routers, etc.)
All of these devices and services can be organized on a separate interface (Serial0/1 in this example) that connects to a separate area called the DMZ. Notice that the DMZ is not on the inside of the network because people from the outside can access resources in this area. From a security standpoint, the DMZ is in the middle of the inside and the outside areas, as it is part of the company but it does not offer the security provided to inside devices. DMZ devices can be accessed either from inside users or from outside users, but the outside users still cannot connect to the inside network, which enforces the security policies regarding critical and confidential resources.
E-Commerce Submodule
The e-commerce submodule is used when electronic commerce is an important function in the organization. This submodule includes the following devices:
- Web servers
- Application servers
- Firewalls
- Intrusion Detection Systems (IDSs)
- Intrusion Prevention Systems (IPSs)
- Database servers
An IDS notifies administrators that there is some common security attack happening. For example, if it detects that someone is trying to get into the network with a “ping of death” attack, IDS will generate alarms that will notify administrators that this specific attack has been initiated in the network. IDSs do not prevent attacks, they just detect them. An IPS is more powerful than an IDS because in addition to the alarming functionality, it can also prevent attacks.
Internet Submodule
The Enterprise Edge module might have an Internet submodule because most companies today require Internet access. This submodule includes the following devices:
- Firewalls
- Internet routers
- FTP servers
- HTTP servers
- SMTP servers
- DNS servers
Regarding the firewall devices, Cisco implements this functionality in both routers running IOS and dedicated firewall appliances, like the modern Cisco ASA (Adaptive Security Appliance), which evolved from Cisco PIX firewalls.
The Internet submodule might have redundancy capabilities but this depends on two factors:
- The available budget for implementing redundancy
- How critical the Internet is for the organization
The importance of the Internet to the organization’s functionality will depend on the level of Internet connectivity that it has:
- Single router, single link
- Single router, dual links to one ISP
- Single router, dual links to two ISPs
- Dual routers, dual links to one ISP
- Dual routers, dual links to two ISPs
The scenario in which the organization has links to two Internet Service Providers (ISPs) is called a dual-homed scenario. This provides a high degree of redundancy because a link or an ISP can be lost without losing Internet connectivity. The most advanced and safe dual-homed redundancy is comprised of multiple routers with multiple links to multiple ISPs. This is the connectivity model that must be chosen if Internet access is critical to the organization’s functionality.
VPN/Remote Access Submodule
The remote access submodule can contain the following devices:
- Firewalls
- VPN concentrators
- Dial-in access concentrators
- IDSs/IPSs
An interesting aspect of the VPN concentrators is that they are no longer available as independent devices because their functionality has been integrated and enhanced in the sophisticated Cisco ASA security device. In addition to firewalls and VPN concentrators, this submodule also contains attack prevention systems, like IDS and IPS.
WAN Submodule
A WAN is typically part of a network, hence, the WAN submodule feature found in the Enterprise Edge module. This submodule connects to the Service Provider Edge module. A company’s WAN connections may consist of different types and use different technologies (these will be covered in the appropriate sections of this book), including:
- MPLS
- Metro Ethernet
- Leased lines
- SONET and SDH
- PPP
- Frame Relay
- ATM
- Cable
- DSL
- Wireless
Service Provider Edge Module
The Service Provider Edge module shown in Figure 1.15 below contains the actual connections to the ISPs and offers the following services:
- Internet connectivity (primary ISP, secondary ISP)
- WAN services (Frame Relay/ATM)
- PSTN services
Figure 1.15 – Service Provider Edge Module
In modern networks, the PSTN technology is often replaced with the VoIP approach. Some of the best practices that should be taken into consideration when designing the Service Provider Edge module are as follows:
- Try to get two ISPs for redundancy or at least two links to a single ISP.
- Select the mobile/remote/dial-up technology.
- For slow WAN links use Frame Relay or leased lines.
Remote Modules
Depending on how much remote access there is to the network, remote modules might include the following:
- Enterprise Branch
- Site-to-site VPNs
- Enterprise Data Center
- High-speed LAN
- Data Center management
- Enterprise Teleworker
- Remote access VPNs
The Enterprise Branch module typically creates site-to-site VPNs that connect branch offices to the headquarters. The Enterprise Data Center is where various network blocks access data. This module features high-speed LAN capabilities and sophisticated Data Center management software. Some companies have a large number of telecommuters (i.e., people that work from home). This would necessitate an Enterprise Teleworker module that features remote access VPN technologies.
The next chapter will analyze different solutions that a large Enterprise network can use to take advantage of emerging technologies like high availability, intelligent network services, security, voice transport, and content networking.