Discovery Network Description and Proposed I2 Implementation 1 The - - PowerPoint PPT Presentation

▶

Mar 06, 2023 39 likes •191 views

Discovery Network Description and Proposed I2 Implementation 1 The Point Main users of I2 likely not permitted on FS network Russia project (Rackspace) Air quality forecasting (NWS / Direct Broadcast) Anything Cray Anything

SLIDE 1

Discovery Network

Description and Proposed I2 Implementation

SLIDE 2

The Point

Main users of I2 likely not permitted on FS

network

– Russia project (Rackspace) – Air quality forecasting (NWS / Direct Broadcast) – Anything Cray – Anything w/non-I2 external collaborators

So...connect I2 to something we can use.

SLIDE 3

What we need

Collect our “banished applications” under one

umbrella for easier management.

Retain ability to collaborate with external

parties.

SLIDE 4

Proposal

Create a space for Research
Connect I2 to that

SLIDE 5

Vision/Requirements

SLIDE 6

Requirements (Access)

Users on the FS Network can seamlessly access items on the Discovery Net-

work or on the web.

Users on the Discovery Network cannot access the FS Network.
The Discovery Network (DN) is divided into the "Public Discovery Network"

(WebDN) and the "Protected Discovery Network" (PDN)

Protected Discovery Network Access

–

Users on the PDN can seamlessly access items on Internet2 or the web.

–

The PDN is the "default" network assigned to unrecognized machines connected to the local physical network.

Public Discovery Network Access

–

WebDN accepts inbound traffic from the public internet.

SLIDE 7

Requirements (Services)

Users on the Discovery Network can authenticate using Forest Service Active

Directory or the External Users Active Directory.

Users on the Discovery Network have access to the printers in the building.
A well defined portion of the External Users Active directory is locally managed

(either directly or via tickets).

DNS and DHCP provide human readable, locally managed names to recognized

machines on the Discovery Network. The namespace should be something under fs.usda.gov.

DHCP may be locally configured (or requested to be configured) to allow specific

machines a static IP address.

Remote users (FS or external) can VPN in to the PDN.
Remote servers can VPN into the PDN or WebDN.
Separate, locally managed, firewalls must be set up between the public internet, PDN

and WebDN.

SLIDE 8

Requirements (Permission)

Activities and software on the Forest Service

network are forbidden unless specifically permitted.

Activities and software on the Discovery

Network are permitted unless specifically forbidden.

SLIDE 9

Observation

Firewall separating FS network from Discovery

network can be same as FS ↔ Public Internet

SLIDE 10

Local Scale Implementation

SLIDE 11

Analogies

NWS net = FS net
Cray Network = Discovery Network
DSL line = Internet2 (ish)

SLIDE 12

Local scale status

Cisco 3560 switch configured for traffic isolation

at level2

Need to configure firewall/router to connect the

pieces

– Intend to connect Cray net to DSL – Connection of NWS to Cray net is certain – NWS ↔ DSL requires a great deal of care, may

be skipped

SLIDE 13

Relationship to I2

CIO “scales up” my local implementation using

analogy

– multiple switches – remote administration/mgmt – method to request firewall changes (tickets?)

SLIDE 14

Desired Result

Collaboration ability retained
Provide environment for banished applications
CIO assumes responsibility for networks
Solution can be deployed elsewhere

SLIDE 15