One of the main reasons for using the Internet is to conduct electronic commerce over large distances. The e-commerce submodule allows companies to support a wide variety of applications over the Internet, as well as Internet-related technologies.
E-commerce is a critical area for network design in modern network infrastructures because the failure of this submodule most often involves significant financial loss for the company. This is the network submodule that generates and sustains the sales process and it should be designed accordingly to avoid any outages.
The e-commerce submodule can be in the same location as the data center but it should be separated from the rest of the data center and designed with redundancy in mind. A reliable e-commerce submodule should include the following resources for the organization:
- Trained staff to handle the operating and maintenance processes
- Proper documentation and processes
- Optimal management tools
| Note: Many people tend to confuse the availability and reliability features in a submodule. Availability is whether a service can be used, while reliability is whether a service is working the way it should be working. An available e-commerce service does not necessarily imply a reliability service. |
One of the most important design aspects regarding the e-commerce submodule is that it must be connected to the Internet through at least two providers. From a security standpoint, the e-commerce submodule should be protected using multiple layers of firewalls (also known as a “firewall sandwich”) at different points in the network. This implies using firewalls between different layers.
The high degree of firewalling can be simplified using firewall virtualization (i.e., virtual contexts), which is a cost-effective solution for separating different layers. Another important technology present in e-commerce environments is server load balancing, which is used to distribute client requests across active servers. The most common Server Load Balancing (SLB) design models include the following:
- SLB router mode: Actively participates in the routed path.
- SLB bridge (inline) mode: Acts as a transparent bridge.
- SLB one-arm mode: Takes place in the same subnet as the servers.
- SLB two-arm mode: Takes place in a different subnet than the servers (this adds complexity to the configuration).
Technologies such as Policy Based Routing (PBR) or Network Address Translation (NAT) must be used when configuring one-arm mode or two-arm mode SLB.
The most common e-commerce topologies include the following:
- E-commerce base design
- E-commerce dual layer firewall design
- E-commerce SLB one-arm mode with dual layer firewall design
- E-commerce SLB one-arm mode with security contexts
A common topology for e-commerce design used to involve one firewall per ISP, with each edge path using NAT to translate inside addresses. When using this topology, a DNS should be used to achieve load balancing across the different ISP connections; the main issue with this is it does not offer a stateful failover to another path.
The modern topology of e-commerce design involves using firewalls that support stateful failover and translating addresses to a common external prefix. Cisco ASA devices can be used, as they support active/active failover by backing each other up, meaning they both can remain active at the same time.
The most sophisticated implementation for e-commerce involves using distributed data centers that allow e-commerce operations to be replicated across geographically distributed data centers. This topology protects against regional problems; in fact, one site can be taken completely offline and still have its e-commerce service available. The distributed data center design is a required topology in banking environments or in other organizations that must run critical services. Other features of this design include:
- Databases backing each other up in an active/active failover design
- The use of technologies (like Cisco Global Site Selector) that can detect and react to data center outages
After designing the e-commerce model and setting up SLB and security features, the submodule should be tuned by implementing several features:
- BGP traffic tuning, for entrance and exit optimization.
- Enhanced object tracking, featuring the ability to track a particular prefix/interface and then take an action based on that interface.
- Performance Routing (PfR), which used to be called Optimized Edge Routing (OER). This technology uses a Master Controller (MC) node that monitors several performance metrics (using IP SLA), which are corrected by managing and taking actions on Border Routers (BRs).
- Cisco Global Site Selector, which ensures the requests for information are routed to the available sites (data centers).
Another interesting technology is the Web Cache Communication Protocol (WCCP), which uses a Cisco Cache Engine to handle and distribute Web traffic (user requests) quickly. When a user requests a Web service (e.g., a page on a Web server), the router sends the requests to the Cache Engine, which will respond with a copy of the requested page, if it has the page stored locally. If the Cache Engine does not have the requested page stored, it will retrieve the page, store it, and then respond. Any future requests for that Web page will be responded to with the locally stored information.