Attachment B CEG Design Document 03SEP24.pdf

Commercial Ethernet

Gateways (CEG) Design Document

Version 3.6a

12 MAR 2024

Defense Information Systems Agency

IE5

6910 Cooper Ave Ft Meade, MD

Unclassified 12 March 2024 Version 3.6a

Revision History

Version Number

Date

Description of changes

1.0 1.1

1.2 1.3

1.4 1.5

1.6

1.7

1.8

21 Sept 2018 27 Sept 2018

1 Oct 2018 1 Oct 2018

2 Oct 2018 5 Feb 2019

26 Apr 2019

20 Jun 2019

18 Jul 2019

Original Draft Changed the Threshold MTU of NNI from 4472 to 4400.

Added section on E-Line Redundancy. Clarified access to JRSS for E-line and Layer-3 VPN. Also pointed out that customers connecting directly to CSP for Layer-3 VPN may have option of using TDM interfaces. Made many minor editorial changes Made many editorial changes and clarifications Updated document show classification as Unclassified.

Spelled out any undefined Acronyms and provided missing definitions. Crossed out some VLAN numbers from VLAN tables so document can released in RFI. Removed all encryptor vendor names.

Made many editorial changes Section 2.1: section added that not all CSPs can be expected to support both E-Lines and Layer-3 VPN on same NNI;

therefore separate NNIs for E-Lines and Layer-3 VPN is acceptable for this design.

Section 2.1.1: clarified that Customers submit CAPs.

Section 2.1.2: clarified that J-PE does strict route filter ingress on J-PE and that J-PE drops any default routes received from CSP.

Section 2.4: Customers are responsible for deploying Unclass Converged CE routers (Not the CSP) Figure 2-6: Clarified who owns/manages encryptors Added section 2-10 which clarifies CSP owned aggregation devices at off-campus locations Section 2.3.1 change objective MTU from 9100 to 9000.

Section 2.5. Throughout section clarified language that ‘frame’ applies to E-line service and ‘packet’ applies to Layer-3 VPN service Section 2.5.2: Further clarification that Round-trip delay shall be less than or equal to 10 milliseconds per 350 miles measured as the great circle distance between the “A” and “Z” locations.

Section 2.5.4 added which states that for E-Line service, the CSP will pass all Ether Types unchanged, end-to-end.

Section 2.5.5 added that states the vendor must test the circuit for 24 hours IAW ITU-T.Y.1564 (02/2016) Ethernet Service Activation Test Methodology Section 2.5.3: Frame loss for Assured #2: (Silver) changed to .05%

Version Number

Date

Description of changes

1.8.1

1.8.2

2.0

3.0 3.1

3.2

3.3

3.4

3.5

3.6

3.6a

25 Jul 2019

10 Aug 2019

8 Oct 2019

31 Mar 2020 02 June 2020

05 June 2020

21 Aug 2020

13 May 2022

5 Oct 2022

25 Jan 2024

12 Mar 2024

Updated performance requirements into tables

Removed FOUO markings

Introduction: Clarified that only E-lines are required in Phase I contracts Introduction: Defined the term EVC Section 2.10: Added sentence on min circuit size and aggregation.

NOTE: This is version is also referred to as Att B Region 1 fbov3 Updated Assured#1 Performance Frame loss (2.5.3) Updated text in 2.1.1 to explain Vendor EVC bundles.

Added figures 2-2 thru 2-6 to show all use cases for EVC bundles.

Updated section 2.9 (Redundancy) Added sentence in 2.1.1 to require 24 ports minimum on vendor edge (aggregation) device Removed all references to CSP vendors providing any Layer-3 services. CSPs are only be asked to provide E- Lines.

Clarified that EVC bundles are also known as C-Series trunks for DISA Provisioning. Provided additional clarification throughout document that vendor must push/pop VLANs on behalf of customer when KG-75s connect directly to CEG vendors device. Updated figures 2- 2 thru 2-6. Added new section: 2.11 Intra Region Point-to- Point VLANs between Customer sites (without touching DISN CEG Gateways) Updated Figure 2-12 to show Intra Region Point-to-Point VLANs between Customer sites (without touching DISN CEG Gateways). Also modified some text in section 2-11.

Section 2.5.1: Updated the Round-trip latency values based on lessons learned from implementing CEG.

Updated Section 2.5 to reference paragraph 2.5.2 vice 2.5.3

1 Introduction 2 Design Details

2.1 E-Lines from CSP:

2.1.1 E-Lines over NNI from CSP (These are just tail circuits separated by VLANs)

2.2 VLAN Assignments:

2.3 Maximum Transmission Unit (MTU)

2.3.1 MTU for Trunk NNI with CSP

2.3.2 MTU for Customer Circuits (Individual VLANs)

2.4 Converged CE Router using CSP service to access DISN

2.5 Performance Specifications for CSP

2.5.1 End-to-End Latency (Delay) Specification

2.5.2 End-to-End Frame/Packet loss, Availability, and Jitter Performance Requirements 11

2.5.3 Ether Types

2.5.4 Testing Duration

2.6 Interface Specifications for CSP

2.6.1 Interface Specification for NNI Trunk

2.6.2 Interface Specification for customer connection to CSP

2.7 Security

2.7.1 Control and Data Plane Security (applies to J-PE – N/A for CEG vendor)

2.8 Quality of Service (applies to J-PE – N/A for CEG vendor)

2.9 CEG Vendor Redundancy for E-Lines

2.9.1 Option 1: No Diversity (Default)

2.9.1 Gateway Virtual Diversity

2.9.2 Physical Diversity

2.10 CSP owned Vendor Edge (Aggregation) Device at Off-Campus Lease Locations

1 Introduction

The world is quickly transitioning away from Time Division Multiplexing (TDM) technologies and migrating to Ethernet. The DoD CIO office directed the entire DoD to optimize communications to Ethernet based services to reduce TELCOM costs. See DoD CIO memo Subject: Circuit Optimization, dated 5 May 2016 for details. At the same time, point-to-point commercial leases are typically taking us 6-9 months to procure. This is unacceptable.

DISA urgently needs an enterprise solution to efficiently aggregate Ethernet circuits from a Commercial Service Provider (CSP) to get away from the existing point-to-point model.

Virtualization using Virtual Local Area Network (VLAN) (802.1Q) between the DISN Joint Provider Edge (J-PE) router and the CSP PE routers over a high capacity link is the Commercial Ethernet Gateway (CEG) solution that this document will explain and provide the design details.

Virtualization of CEG solution provides many benefits to include:

• Reduce equipment costs (estimated 20:1 reduction in Ethernet ports on J-PE routers)

• Reduce number of tail leases (estimated 20:1 reduction of tail leases on DISN side)

• Provides a DISN on-ramp for Off-net customers to access DISN services via commercial

Ethernet services. This solution will significantly reduce the DISN provisioning timeline because the physical path is pre-built (only VLANs need to be added on J-PE). The DISN will not be required to install new circuit(s) or equipment.

See Figure 1-1 for a high-level overview of how Off-net customers can access DISN services from the CEG.

Note:

An EVC is defined by the Metro-Ethernet Forum (MEF) as an association between two or more user network interfaces that identifies a point-to-point or multipoint-to-multipoint path within the service provider network. An EVC is a conceptual service pipe within the service provider network. This document will focus on the point-to-point EVC which will also be referred to as an E-Line in this document. In this document, EVC and E-Line have the same meaning.

Off-net User

CEG

Figure 1-1 CEG High-Level Overview

2 Design Details

2.1 E-Lines from CSP:

The high capacity trunk between the DISN PE and the CSP PE is referred to as the Network-to- Network Interface (NNI). The only type of Ethernet service that will be extended from the CSP to the DISN J-PE router over the NNI is an E-Line. An E-Line (also referred to as Ethernet Private Line) is a service type for connecting exactly (2) Ethernet end-points with one another.

See Figure 2-1 for a high-level diagram of NNIs to CSPs.

DISN

Edge

Ethernet hand-offs use VLAN tags to separate services and/or locations SIPR

NIPR

DSN

DRSN

VPN

Services

Commercial Ethernet Services DISN Services

DISN PE

DISN PE

DISN PE

DISN PE

Commercial Service Provider

Network - A

Commercial Service Provider Network – B, C, D

E-Lines

Figure 2-1 Connecting to CSPs over NNIs

2.1.1 E-Lines over NNI from CSP (These are just tail circuits separated by VLANs) In most cases, the off-net customer just wants to get to a DISN service via an economical E-Line service from a CSP. As long as the CSP has one or more Ethernet NNIs with DISN J-PE routers, this is a viable option. Customers connecting to J-PE via E-Line in this way can access any of the DISN IP services, like Private IP, NIPR, SIPR (via SAM Architecture), Pseudowire, NFG, etc.. With E-lines from the CSP, the DISN is not implementing any protocols or exchanging routing with CSP. This is similar to any tail circuits we terminate today on DISN PE routers. It is configured the same as if it were an 802.1Q trunk to one of our customers. The CSP has the responsibility to aggregate VLANs for E-Lines. See Figure 2-2 for a high-level diagram of this option.

The E-Line option provides connection to the NIPRNet Virtual Routing and Forwarding (VRF) and requires Connection Approval Process (CAP) Approval. Customers submit CAPs to DISA..

DISA requires EVC Bundles from the vendor. An EVC bundle consists of 1 or more vendor EVCs sharing B/W. An EVC Bundle is also known as C-Series Trunk for DISA Provisioning.

For example, if a customer requests 1G to a CEG gateway, the customer can have 1 or more VLANs sharing the 1G B/W to the Gateway. The same concept applies to 10G customer requirements. EVC bundles always stay together and go to the same CEG gateway. If customer wants to connect to second CEG gateway, they need to pay for additional EVC bundle. Figure 2-2 shows the high level concept. Figures 2-3 thru 2-6 show the specific use cases that the CEG vendors must support. The Vendor Edge device must be configured with a minimum of 8 ports and comply with the interface specifications shown in Paragraph 2.6.

1G EVC

Mission Partner Facility Vendor CORE DISN CEG (Region X)

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G1G

MP 3

300M

1G EVC

10G

500M EVC

500M EVC

500M EVC

200M EVC

300M EVC

J-PE

100G+

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

CEG

Vendor

Aggregated VLANs

Aggregated VLANs

Customer VLANs

U-CE

S-CE

U-CE

U-CE

U-CE

U-CE

CEG

Vendor

U-CE

1 X

Edge

Vendor

1 X

Edge

Vendor

J-PE

CORE

Vendor

DISN

CORE

Vendor

1G EVC Bundle Customer has (3) E-lines (VLANs) running over one 1G EVC bundle from CEG vendor

NNI

NNI

Customer pays one cost for the 1G EVC bundle

C-Series Trunk

Figure 2-2 High Level Concept of EVC Bundles

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G1G

1G EVC

J-PE

100G+ JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

CEG

Vendor

Aggregated VLANs

CEG

Vendor

U-CE 1 X

Edge

Vendor

J-PE

DISN

Customer pushes/pops DISA assigned VLAN

VLAN 400

Customer has to create a C-Series Trunk in DSF (even for just 1 VLAN)

H-Series TrunkC-Series Trunk

Example only

1G VLAN 400

Figure 2-3 Single Circuit over EVC (Customer pushes/pops DISA assigned VLAN)

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G 1G

J-PE

100G+ JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

CEG

Vendor

Aggregated VLANs

CEG

Vendor

1 X

Edge

Vendor

J-PE

DISN

Vendor pushes/pops DISA assigned VLAN (Example 3500 for SAM)

S-CE

1G EVC

H-Series Trunk

Note 1

Note 1: HAIPE devices NOT capable of pushing/popping VLANs on black side of HAIPE. The CEG vendor MUST push/pop VLANs on behalf of customer when these devices connect directly to CEG vendor’s device

Example only

1G VLAN 3500C-Series Trunk

HAIPE

Figure 2-4 Single Circuit over EVC (Vendor pushes/pops DISA assigned VLAN)

Vendor CORE DISN CEG (Region X)

CEG 1

100G+

1G

500M EVC: VLAN 400

500M EVC: VLAN 3500

J-PE

100G+ JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

Aggregated VLANs

U-CE

S-CE

CORE

Vendor

DISN

Vendor pushes/pops DISA assigned VLAN (Example 3500 for SAM)

Customer pushes DISA assigned VLAN

Separate interfaces associated with same 1Gig EVC Bundle

C-Series Trunk

Mission Partner Facility

CEG

Vendor

H-Series Trunk

Example only

X

Edge

Vendor

Note 1: HAIPE devices NOT capable of pushing/popping VLANs on black side of HAIPE. The CEG vendor MUST push/pop VLANs on behalf of customer when these devices connect directly to CEG vendor’s device

Note 1

Figure 2-5 Two (2) Circuits over EVC Bundle (Separate Customer interfaces)

Vendor CORE DISN CEG (Region X)

CEG 1

100G+

CEG 2

100G+

500M VLAN 400

1G

J-PE

100G+ JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

Aggregated VLANs

S-CE

CEG

Vendor

J-PECORE

Vendor

DISN

One interface from customer

Mission Partner Facility

500M VLAN 3500

U-CE

Converged CE router

802.1Q Trunk

CEG

Vendor

500M EVC: VLAN 400

500M EVC: VLAN 3500

C-Series Trunk

H-Series Trunk

Example only

X

Edge

Vendor

Figure 2-6 Two (2) Circuits over EVC Bundle (Converged CE with one Customer interface)

2.2 VLAN Assignments:

The VLAN assignments on the NNI interface to the CSP are the same as they are for any customer interface. The customer must use the VLAN assigned by DISA; there shall be no translation by the CSP. If a customer cannot impose a VLAN, the CSP will be required to push the VLAN number assigned by DISA and shall have the capability to do so. Table 2-7 summarizes the VLAN standard. See DISA standard in separate document for details.

• Layer-3 Services: NIPR, SIPR, Private-IP, CsC, Etc… xxx-xxx: NIPRNet (Block#1) xxx-xxx : Private ISP xxx-xxx : NFG Remote Access L3 VPN xxx-xxx : Private-IP (Layer-3 VPN), CsC(Labeled Service) xxx-xxx : NIPRNet (Overflow Block#2) xxx-xxx :-Legacy SIPRNET SAM Access (RedSide/S-PE) xxx-xxx : -Legacy SIPRNET SAM Access(Blackside/J-PE/MSPP/ODXC)

• Layer-2 Services: Pseudowires and VPLS 500-599, and 3101-3499: For Layer 2 point-to-point pseudowires that are provided by

J-PE routers and DO NOT terminate on one of our Layer-3 services.

• xxx-xxx: Fast Ethernet Only

• xxx-xxx: 1G,10G,100G Only

Table 2-7 VLAN Assignments for NNIs on CEG Gateways

2.3 Maximum Transmission Unit (MTU)

2.3.1 MTU for Trunk NNI with CSP

The minimum MTU we can accept for the Trunk NNI is 4400. The objective MTU is 9000 since the DISN is moving to make this the standard for all leases.

a. Threshold MTU for Trunk NNI: 4400

b. Objective MTU for Trunk NNI: 9000

2.3.2 MTU for Customer Circuits (Individual VLANs)

In most cases, the MTU for customer access circuits is 1500 (1518 including Ethernet header).

NIPR, SIPR, Private ISP and NFG can never exceed 1500. The DISN currently has a few special Layer-3 VPNs that have requested an MTU of 4000. For customers with a 1500 byte MTU, the MTUs will be limited at the J-PE. The CEG service provider is still required to support a maximum 4400/9000 MTU for all E-Lines.

4400 is the physical (layer-2) MTU of the circuit itself. 4000 is the IP MTU, which tells our customers that the max IP packet they can send is 4000 + Layer-2 Overhead (typically 18 or 22)

2.4 Converged CE Router using CSP service to access DISN

It is generally very economical for the customer to access more than one service utilizing the same physical interface. A Converged CE Router is a customer router that has a forwarding path for both encrypted classified traffic and unclassified traffic which is kept separated using VRFs and VLANs. Figure 2-8 depicts this implementation. Notice, the VLANs separate the different service on the access link and the VRFs separate the service within the CE router. This method of separation has received blanket approval by the DISN Security Accreditation Working Group, as long as the classified data is Type I encrypted in addition to the VRF and VLAN separation.

This same architecture applies to Converged CE routers connected to E-Line service on the CSPs network. Customers are responsible for deploying Unclass Converged CE routers (Not the CSP) A separate E-line is needed for each VLAN leaving Converged CE router.

VLAN 2

VLAN 3

J-PE

Ethernet Link

SAM

NIPRUnclass Converged CE Router

VRF

VRF

NIPR xx.4x.x.x/30 xx.4x.x.x/30 xx.165.x.x/30

S-CE

Customer

HAIPE

VRF Lite x.165.x.x/30

H LH L

Figure 2-8 Converged CE router

2.5 Performance Specifications for CSP

Performance requirements consist of latency, frame/packet loss, availability and jitter.

Performance of the NNI The NNI will typically be a local fiber connection between the J-PE and a co-located commercial handoff node. The NNI needs to be completely error free. (i.e., zero packet loss). If the NNI connection is a trunk circuit to the commercial handoff node, the NNI shall, at a minimum, meet the Assured #1 requirements for frame/packet loss specified in paragraph 2.5.2.

2.5.1 End-to-End Latency (Delay) Specification

The End-to-End Round-trip (RT) delay must be within the specifications of the below table.

Distance Maximum RT Latency Requirement

0-350 Miles ≤ 25 ms RT 350-1050 Miles ≤ 50 ms RT 1050-2500 Miles ≤ 90 ms RT 2500 Miles and above ≤ 100 ms RT

2.5.2 End-to-End Frame/Packet loss, Availability, and Jitter Performance Requirements The following Table provides the Service Level Performance Requirements for CEG services.

Service Category

Service Level Performance Requirement

Assured #1

Frame/Packet loss NTE 0.00001% (1 out of 10 million frames/packets dropped) - NNI Gateway only

Availability NLT 99.9% (End-to-End) Jitter NTE 5ms

Assured #2

Frame/Packet loss NTE 0.05% (1 out of 2,000 frames/packets dropped) Availability NLT 99.75% end to end

Jitter NTE 15ms

Assured #3

Frame/Packet loss NTE 0.1% (1 out of 1,000 frames/packets dropped) Availability NLT 99.5% end to end

Jitter NTE 25ms

Since all requirements are not the same, this design provides for three different Service Categories which may or may not be available from all CSPs. Gateway connections and DISN trunks (J-PE to J-PEx) will need to use the Assured #1 category due to the services (i.e. circuit emulation) offered on the J-PE routers. If this performance level is not available for J-PEx trunks then OTU-2 leases will be used.

2.5.3 Ether Types

For E-Line service, the CSP will pass all Ether Types unchanged, end-to-end.

2.5.4 Testing Duration

The vendor must test the circuit for 24 hours IAW ITU-T.Y.1564 (02/2016) Ethernet Service Activation Test Methodology

2.6 Interface Specifications for CSP

2.6.1 Interface Specification for NNI Trunk

Service Type: Network to Network Interface (NNI) Physical Media Type: Fiber (Single mode) Interface Type: 1GE, 10GE, or 100GE Tagged/Untagged: Tagged (802.1Q) Special Note for Untagged Interfaces: Customer KG-175s (HAIPEs) do NOT support VLAN tagging of the black side. If a HAIPE connects directly to a CEG vendor’s port, the CEG vendor MUST push/pop VLANs tags on behalf of the HAIPE.

2.6.2 Interface Specification for customer connection to CSP

Service Type: Layer 2 E-line Type Media: Customer defined (i.e., Single mode, Multimode, copper (CAT5E or better)) Interface type/rate: Customer defined (i.e., Optical 10GE, 1GE, Fast Ethernet, 10/100) Tagged/Untagged: Both Types (Customer defined). Some CSPs may require customers to use 802.1Q tagging.

2.7 Security

2.7.1 Control and Data Plane Security (applies to J-PE – N/A for CEG vendor) All the security controls that we currently put on customer interfaces will still apply to the NNI interfaces. For example, for each VLAN on the NNI we still must apply Control Plane Policing and Data Plane ACL policies. Per-VLAN ingress policing and per-VLAN egress shaping will be applied to each VLAN to insure the availability of each VLAN.

The security mechanisms applied on the J-PE to the NNI are summarized below:

a. Control Plane Policing (Ingress J-PE)

b. Data Plane ACLs (Ingress J-PE)

c. QoS Controls (Ingress Policing per VLAN, Egress Shaping per VLAN)

d. Strict Route Filtering for Layer-3 VPN Peering with customers using CEG

2.8 Quality of Service (applies to J-PE – N/A for CEG vendor)

With multiple customers sharing the same physical interface, implementing QoS is very important to insure that one customer’s traffic cannot impact another customer. This will require a hardware implementation of per-VLAN QoS with shaping and queuing. The same DSCP plan and QoS profiles that apply to customer interfaces will be used for the NNI trunks connecting to CSPs.

2.9 CEG Vendor Redundancy for E-Lines

The three Diversity options for CEG E-Lines are No Diversity, Gateway Virtual Diversity, and Full Diversity.

2.9.1 Option 1: No Diversity (Default)

This is anticipated to be the most common option. In this option, all customer’s circuits connect to the same CEG vendor edge device and all their EVCs go to the same gateway. See Figure 2-9.

CEG Gateway 1

100G+

CEG Gateway 2

100G+ 1G

500M EVC

500M EVC

J-PE

100G+

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

CEG

Vendor

Aggregated VLANs

U-CE

U-CE

1 X

Edge

Vendor

CORE

Vendor

DISN

CORE

Vendor

Customer connects to (1) Vendor Edge Device. Their EVCs go to a single CEG Gateway

NNI

NNICEG

Vendor

J-PE

1 Gig EVC Bundle Customer has (2) E-lines (VLANs) running over one 1G EVC bundle from CEG vendor

Figure 2-9 Option 1: No CEG Vendor Diversity Option

2.9.1 Gateway Virtual Diversity

In this option, all customer’s circuits connect to the same CEG vendor edge device; however, their EVCs go to two different gateways. In this case, the customer needs to pay for an additional EVC bundle. See Figure 2-10.

CEG Gateway 1

100G+

CEG Gateway 2

100G+

500M

10G

500M EVC

500M EVC

500M EVC

500M EVC

J-PE

100G+

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CORE

Vendor

CEG

Vendor

Aggregated VLANs

U-CE

U-CE

U-CE

U-CE

1 X

Edge

Vendor

CORE

Vendor

DISN

CORE

Vendor

Customer has (2) E-lines (VLANs) running over one 1G EVC bundle from CEG vendor

NNI

NNI

1 Gig EVC Bundle

CEG

Vendor

J-PE

1 Gig EVC Bundle

Customer connects to (1) Vendor Edge Device. Their EVCs go to two CEG Gateways

Vendor Edge Device and circuit are a single point of failure

Figure 2-10 Gateway Virtual Diversity Option

2.9.2 Physical Diversity

In this option, the customer connects to two (2) CEG vendor edge devices and their EVCs go to two different gateways. In this case, the customer needs to pay for an additional EVC bundle.

This is the most expensive option because the vendor needs to install two (2) Vendor Edge Devices. See Figure 2-11.

Mission Partner Facility Vendor CORE DISN CEG (Region X)

CORE

Vendor

CEG Gateway 1

100G+

CEG Gateway 2

100G+

1G

1G

500M EVC

500M EVC

J-PE

100G+

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

100G+

CEG

Vendor

Aggregated VLANs

U-CE

U-CE

U-CE

1 X

Edge

Vendor

CORE

Vendor

DISN

CORE

Vendor

Customer has (2) E-lines (VLANs) running over one 1G EVC bundle from CEG vendor

NNI

NNICEG

Vendor

J-PE

1 Gig EVC Bundle

(2) Vendor Edge Devices and separate circuits reduce likelihood of a single point of failure

1 X

Edge

Vendor

CORE

Vendor

U-CE

500M

1 Gig EVC Bundle

Figure 2-11 Physical Diversity Option

2.10 CSP owned Vendor Edge (Aggregation) Device at Off-Campus Lease Locations

Since the CSP must put some type device at all the applicable off-campus locations, it makes sense for the CSP to aggregate all the Ethernet circuits from the multiple customers/circuits on that base. For this design, the CSP will aggregate all the circuits from the base routers/devices.

See Figure 2-12 for high level diagram of this concept. The Base, Post, Camp, or Station must allow the CSP to install a device to aggregate and manage their service. The minimum circuit size for on and off campus locations will be 1Gb. Over-subscription of the NNI is not allowed.

The J-PE can accept multiple 100 Gb connections so providers can aggregate up to 100Gb per interface.

Customer L3VPN Access

SIPR Access

NIPRNet Access

CEG

Commercial

Service Provider

(CSP) Cloud

CSP

Device

VLAN 2

Base “A”

CSP owns and operates device on base that aggregates all Ethernet Circuits from Base “A”

Off-Campus location:

Lease site with no J-PE

E-Lines to J-PE

Figure 2-12 CSP Vendor Edge (Aggregation) Device

2.11 Intra Region Point-to-Point VLANs between Customer sites (without touching DISN CEG Gateways)

One of the lessons learned after implementing VLANs on CEG, was that not all customer requirements need to touch the DISN. This new option allows for VLANs between (2) customer sites in same region that do not need to touch the DISN. All the specifications/SLA for VLANs between a customer site and the CEG Gateway apply equally to VLANs between (2) customer sites. For example, the following would still apply for customer-to-customer VLANs:

a. Frame loss, latency, and jitter specification

b. MTU specification

c. Vendor will support all Ether Types

d. Customers can combine multiple VLANs over a single C-Series Trunk to reduce costs

e. Customers can connect to multiple ports on the Vendor Edge Device, which can be combined over a single C-Series Trunk.

f. Vendor will support Untagged interfaces. For example, connections to HAIPE devices.

Vendor must push/pop VLANs on behalf of the HAIPE device.

The one thing that changes for this scenario is VLAN assignments. Although DISA assigns the VLAN number for all circuits that touch the CEG Gateway, these circuits do NOT touch the Gateway. Therefore, the vendor will assign the VLAN numbers to use for this special case.

See Figure 2-12 for an example of what Intra Region Point-to-Point VLANs between Customer sites looks like. The mission partner site#1 also has C-Series Trunk to the J-PE Gateway.

500M

500M 1G

500M EVC: VLAN 30

500M EVC: VLAN 60

CORE

Vendor

U-CE

S-CE CORE

VendorVLAN 30

Vendor pushes/pops Vendor assigned VLAN (VLAN #60 for this example)

Customer pushes DISA assigned

VLAN

C-Series Trunk Mission Partner Facility #1

Example only

X

Edge

Vendor

500M U-CE

S-CE

Customer pushes Vendor assigned VLAN

Mission Partner Facility #2

X

Edge

Vendor1G

Vendor pushes/pops Vendor assigned VLAN (VLAN #60 for this example)

CEG 1

100G+

J-PE

100G+

CORE

Vendor

Aggregated VLANs

CEG

Vendor

H-Series Trunk

DISN CEG (Region X)

U-CE

Figure 2-12 Intra Region Point-to-Point VLANs between Customer sites