Attachment B _ CEG Design Document.pdf

PDF 2 MB Posted Nov 18, 2020

Attached to: Commercial Ethernet Gateway (CEG) - Continental United States (CONUS) Regions 3-7
Solicitation number: CEGREGION3-7
Issued by: Defense Information Systems Agency

About this file

Written by GovTribe AI · Dec 30, 2023

This document contains a draft Performance Work Statement for a Commercial Ethernet Gateway contract opportunity in Continental United States Regions 3-7. The Defense Information Systems Agency is seeking vendor responses to provide Ethernet services including Ethernet Private Lines known as E-Lines from commercial service providers to Defense Information Systems Agency routers. Vendors must support bundling of E-Lines as Ethernet Virtual Circuits with a minimum of 24 customer ports on aggregation devices. Services will be categorized as Assured Level 1, 2, or 3 based on packet loss, availability, and jitter requirements outlined in the document. Vendors must also support physical and virtual redundancy options and minimum circuit sizes of 1 gigabit. The commercial service providers will be responsible for aggregating customer circuits at off-campus locations.

View the file

Other files

File	Type	Posted
Attachment C _ CEG Implementation Standards.pdf	PDF	Nov 18, 2020
Attachment E - CEG GFI and Contract Deliverable Timeline.pdf	PDF	Nov 18, 2020
Attachment F - CEG Region 3-7 Pricing Schedule.xlsx	XLSX spreadsheet	Nov 18, 2020
Attachment D - Notice of Completion Template.xlsx	XLSX spreadsheet	Nov 18, 2020
CEG Regions 3-7 PWS - DRAFT.pdf	PDF	Nov 18, 2020

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Commercial Ethernet Gateways (CEG) Design

Document Version 3.3

10 August 2019

Commercial Ethernet Gateways

(CEG) Design Document

Version 1.8.2

10 August 2019

Defense Information Systems Agency

IEA/IE5

6910 Cooper Ave Ft Meade, MD

Unclassified 21 Aug 2020 Version 3.3

Revision History

Version

Number

Date

Description of changes

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

21 Sept 2018

27 Sept 2018

1 Oct 2018

2 Oct 2018

5 Feb 2019

26 Apr 2019

20 Jun 2019

18 Jul 2019

Original Draft

Changed the Threshold MTU of NNI from 4472 to 4400.

Added section on E-Line Redundancy. Clarified access to

JRSS for E-line and Layer-3 VPN. Also pointed out that customers connecting directly to CSP for Layer-3 VPN may have option of using TDM interfaces. Made many minor editorial changes

Made many editorial changes and clarifications

Updated document show classification as Unclassified.

Spelled out any undefined Acronyms and provided missing definitions. Crossed out some VLAN numbers from VLAN tables so document can released in RFI. Removed all encryptor vendor names.

Made many editorial changes

Section 2.1: section added that not all CSPs can be expected to support both E-Lines and Layer-3 VPN on same NNI;

therefore separate NNIs for E-Lines and Layer-3 VPN is acceptable for this design.

Section 2.1.1: clarified that Customers submit CAPs.

Section 2.1.2: clarified that J-PE does strict route filter ingress on J-PE and that J-PE drops any default routes received from CSP.

Section 2.4: Customers are responsible for deploying

Unclass Converged CE routers (Not the CSP)

Figure 2-6: Clarified who owns/manages encryptors

Added section 2-10 which clarifies CSP owned aggregation devices at off-campus locations

Section 2.3.1 change objective MTU from 9100 to 9000.

Section 2.5. Throughout section clarified language that

‘frame’ applies to E-line service and ‘packet’ applies to

Layer-3 VPN service

Section 2.5.2: Further clarification that Round-trip delay shall be less than or equal to 10 milliseconds per 350 miles measured as the great circle distance between the “A” and

“Z” locations.

Section 2.5.4 added which states that for E-Line service, the

CSP will pass all Ether Types unchanged, end-to-end.

Section 2.5.5 added that states the vendor must test the circuit for 24 hours IAW ITU-T.Y.1564 (02/2016) Ethernet

Service Activation Test Methodology

Section 2.5.3: Frame loss for Assured #2: (Silver) changed to .05%

Version

Number

Date

Description of changes

1.8.1

1.8.2

2.0

3.0

3.1

3.2

3.3

3.3.1

25 Jul 2019

10 Aug 2019

8 Oct 2019

31 Mar 2020

02 June 2020

05 June 2020

21 Aug 2020

29 Sep 2020

Updated performance requirements into tables

Removed FOUO markings

Introduction: Clarified that only E-lines are required in

Phase I contracts

Introduction: Defined the term EVC

Section 2.10: Added sentence on min circuit size and aggregation.

NOTE: This is version is also referred to as Att B Region 1 fbov3

Updated Assured#1 Performance Frame loss (2.5.3)

Updated text in 2.1.1 to explain Vendor EVC bundles.

Added figures 2-2 thru 2-6 to show all use cases for EVC bundles.

Updated section 2.9 (Redundancy)

Added sentence in 2.1.1 to require 24 ports minimum on vendor edge (aggregation) device

Removed all references to CSP vendors providing any

Layer-3 services. CSPs are only be asked to provide E-

Lines.

Edited Section 2.2, VLAN Standard access.

1 Introduction

2 Design Details

2.1 E-Lines from CSP:

2.1.1 E-Lines over NNI from CSP (These are just tail circuits separated by VLANs)

2.2 VLAN Assignments:

2.3 Maximum Transmission Unit (MTU)

2.3.1 MTU for Trunk NNI with CSP

2.3.2 MTU for Customer Circuits (Individual VLANs)

2.4 Converged CE Router using CSP service to access DISN

2.5 Performance Specifications for CSP

2.5.1 End-to-End Latency (Delay) Specification

2.5.2 End-to-End Frame/Packet loss, Availability, and Jitter Performance Requirements 11

2.5.3 Ether Types

2.5.4 Testing Duration

2.6 Interface Specifications for CSP

2.6.1 Interface Specification for NNI Trunk

2.6.2 Interface Specification for customer connection to CSP

2.7 Security

2.7.1 Control and Data Plane Security (applies to J-PE – N/A for CEG vendor)

2.8 Quality of Service (applies to J-PE – N/A for CEG vendor)

2.9 CEG Vendor Redundancy for E-Lines

2.9.1 Option 1: No Diversity (Default)

2.9.1 Gateway Virtual Diversity

2.9.2 Physical Diversity

2.10 CSP owned Vendor Edge (Aggregation) Device at Off-Campus Lease Locations

1 Introduction

The world is quickly transitioning away from Time Division Multiplexing (TDM) technologies and migrating to Ethernet. The DoD CIO office directed the entire DoD to optimize communications to Ethernet based services to reduce TELCOM costs. See DoD CIO memo

Subject: Circuit Optimization, dated 5 May 2016 for details. At the same time, point-to-point commercial leases are typically taking us 6-9 months to procure. This is unacceptable.

DISA urgently needs an enterprise solution to efficiently aggregate Ethernet circuits from a

Commercial Service Provider (CSP) to get away from the existing point-to-point model.

Virtualization using Virtual Local Area Network (VLAN) (802.1Q) between the DISN Joint

Provider Edge (J-PE) router and the CSP PE routers over a high capacity link is the Commercial

Ethernet Gateway (CEG) solution that this document will explain and provide the design details.

Virtualization of CEG solution provides many benefits to include:

Reduce equipment costs (estimated 20:1 reduction in Ethernet ports on J-PE routers)

Reduce number of tail leases (estimated 20:1 reduction of tail leases on DISN side)

Provides a DISN on-ramp for Off-net customers to access DISN services via commercial

Ethernet services. This solution will significantly reduce the DISN provisioning timeline because the physical path is pre-built (only VLANs need to be added on J-PE). The

DISN will not be required to install new circuit(s) or equipment.

See Figure 1-1 for a high-level overview of how Off-net customers can access DISN services from the CEG.

Note:

An EVC is defined by the Metro-Ethernet Forum (MEF) as an association between two or more user network interfaces that identifies a point-to-point or multipoint-to-multipoint path within the service provider network. An EVC is a conceptual service pipe within the service provider network. This document will focus on the point-to-point EVC which will also be referred to as an E-Line in this document. In this document, EVC and E-Line have the same meaning.

Off-net User

CEG

Figure 1-1 CEG High-Level Overview

2 Design Details

2.1 E-Lines from CSP:

The high capacity trunk between the DISN PE and the CSP PE is referred to as the Network-to-

Network Interface (NNI). The only type of Ethernet service that will be extended from the CSP to the DISN J-PE router over the NNI is an E-Line. An E-Line (also referred to as Ethernet

Private Line) is a service type for connecting exactly (2) Ethernet end-points with one another.

See Figure 2-1 for a high-level diagram of NNIs to CSPs.

DISN

Edge

Ethernet hand-offs use VLAN tags to separate services and/or locations SIPR

NIPR

DSN

DRSN

VPN

Services

Commercial Ethernet Services DISN Services

DISN PE

Commercial

Service Provider

Network - A

Commercial

Service Provider

Network – B, C, D

E-Lines

Figure 2-1 Connecting to CSPs over NNIs

2.1.1 E-Lines over NNI from CSP (These are just tail circuits separated by VLANs)

In most cases, the off-net customer just wants to get to a DISN service via an economical E-Line service from a CSP. As long as the CSP has one or more Ethernet NNIs with DISN J-PE routers, this is a viable option. Customers connecting to J-PE via E-Line in this way can access any of the DISN IP services, like Private IP, NIPR, SIPR (via SAM Architecture), Pseudowire, NFG, etc.. With E-lines from the CSP, the DISN is not implementing any protocols or exchanging routing with CSP. This is similar to any tail circuits we terminate today on DISN PE routers. It is configured the same as if it were an 802.1Q trunk to one of our customers. The CSP has the responsibility to aggregate VLANs for E-Lines. See Figure 2-2 for a high-level diagram of this option.

The E-Line option provides connection to the NIPRNet Virtual Routing and Forwarding (VRF) and requires Connection Approval Process (CAP) Approval. Customers submit CAPs to DISA.

Connection to the JRSS is also possible using this method.

DISA requires EVC Bundles from the vendor. An EVC bundle consists of 1 or more vendor

EVCs sharing B/W. For example, if a customer requests 1G to a CEG gateway, the customer can have 1 or more VLANs sharing the 1G B/W to the Gateway. The same concept applies to

10G customer requirements. EVC bundles always stay together and go to the same CEG gateway. If customer wants to connect to second CEG gateway, they need to pay for additional

EVC bundle. Figure 2-2 shows the high level concept. Figures 2-3 thru 2-6 show the specific use cases that the CEG vendors must support. The Vendor Edge device must be configured with a minimum of 8 ports and comply with the interface specifications shown in Paragraph 2.6.

1G EVC

Mission Partner Facility Vendor CORE DISN CEG (Region X)

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G1G

MP 3

300M

1G EVC

10G

500M EVC

200M EVC

300M EVC

J-PE

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

CEG

Vendor

Aggregated

VLANs

Aggregated

VLANs

Customer

VLANs

U-CE

S-CE

U-CE

CEG

Vendor

U-CE

1 X

Edge

Vendor

1 X

Edge

Vendor

J-PE

CORE

Vendor

DISN

CORE

Vendor

1G EVC Bundle

Customer has (3) E-lines (VLANs) running over one 1G EVC bundle from CEG vendor

NNI

Customer pays one cost for the 1G EVC bundle

Figure 2-2 High Level Concept of EVC Bundles

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G1G

1G EVC

J-PE

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

CEG

Vendor

Aggregated

VLANs

CEG

Vendor

U-CE 1 X

Edge

Vendor

J-PE

DISN

Customer pushes DISA assigned VLAN

VLAN 400

Customer has to create a CEG MPLS Access Trunk in DSF (even for just 1 VLAN)

H-Series TrunkCEG MPLS

Access Trunk

Example only

1G VLAN 400

Figure 2-3 Single Circuit over EVC (Customer pushes DISA assigned VLAN)

CORE

Vendor

CEG 1

100G+

CEG 2

100G+

1G1G

J-PE

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

CEG

Vendor

Aggregated

VLANs

CEG

Vendor

1 X

Edge

Vendor

J-PE

DISN

Vendor pushes DISA assigned VLAN (Example 3500 for

SAM)

S-CE

1G EVC

H-Series Trunk

Note 1

Note 1: HAIPE devices NOT capable of doing VLANs on black side

Example only

1G VLAN 3500

CEG MPLS

Access Trunk

Customer has to create a CEG MPLS Access Trunk in DSF (even for just 1 VLAN)

Figure 2-4 Single Circuit over EVC (Vendor pushes DISA assigned VLAN)

Vendor CORE DISN CEG (Region X)

CEG 1

100G+

CEG 2

100G+

500M EVC: VLAN 400

500M EVC: VLAN 3500

J-PE

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

Aggregated

VLANs

U-CE

S-CE

CEG

Vendor

J-PECORE

Vendor

DISN

Vendor pushes DISA assigned VLAN (Example 3500 for SAM)

Customer pushes DISA assigned VLAN

Separate interfaces associated with same 1Gig EVC Bundle

1G EVC Bundle

Mission Partner Facility

CEG

Vendor

1 X

Edge

Vendor

H-Series Trunk

Example only

CEG MPLS

Access Trunk

Figure 2-5 Two (2) Circuits over EVC Bundle (Separate Customer interfaces)

Vendor CORE DISN CEG (Region X)

CEG 1

100G+

CEG 2

100G+

500M VLAN 400 1G

J-PE

100G+

JRSS

DSN

SIPR

DRSN

VPN

Service

100G+

CORE

Vendor

Aggregated

VLANs

S-CE

CEG

Vendor

J-PE

CORE

Vendor

DISN

One interface from customer

Mission Partner Facility

500M VLAN 3500

U-CE

Converged CE router

802.1Q Trunk

CEG

Vendor

1 X

Edge

Vendor

500M EVC: VLAN 400

500M EVC: VLAN 3500

1G EVC Bundle

H-Series Trunk

Example only

CEG MPLS

Access Trunk

Figure 2-6 Two (2) Circuits over EVC Bundle (Converged CE with one Customer interface)

2.2 VLAN Assignments:

The VLAN assignments on the NNI interface to the CSP are the same as they are for any customer interface. The customer must use the VLAN assigned by DISA; there shall be no translation by the CSP. If a customer cannot impose a VLAN, the CSP will be required to push the VLAN number assigned by DISA and shall have the capability to do so. Table 2-7 summarizes the DISA VLAN Standard which is a controlled unclassified document. While not necessary for the performance of the contract, the VLAN Standard will be provided to CSPs after contract award upon request.

Table 2-7 VLAN Assignments for NNIs on CEG Gateways

• Layer - 3 Services : NIPR, SIPR, Private - IP, CsC , Etc… x xx - xxx : NIPRNet (Block#1) xxx - xxx : Private ISP xxx - xxx : NFG Remote Access L3 VPN xxx - xxx : Private - IP (Layer - 3 VPN), CsC (Labeled Service ) xxx - xxx : NIPRNet (Overflow Block#2) xxx - xxx : - Legacy SIPRNET SAM Access ( RedSide /S - PE ) xxx - xxx : - Legacy SIPRNET SAM Access( Blackside /J - PE/MSPP/ODXC )

• Layer - 2 Services : Pseudowires and VPLS

500 - 599, and 3101 - 3499: For Layer 2 point - to - point pseudowires that are provided by J - PE routers and DO NOT terminate on one of our Layer - 3 services.

• xxx - xxx : Fast Ethernet Only

• xxx - xxx : 1G,10G,100G Only

2.3 Maximum Transmission Unit (MTU)

2.3.1 MTU for Trunk NNI with CSP

The minimum MTU we can accept for the Trunk NNI is 4400. The objective MTU is 9000 since the DISN is moving to make this the standard for all leases.

a. Threshold MTU for Trunk NNI: 4400

b. Objective MTU for Trunk NNI: 9000

2.3.2 MTU for Customer Circuits (Individual VLANs)

In most cases, the MTU for customer access circuits is 1500 (1518 including Ethernet header).

NIPR, SIPR, Private ISP and NFG can never exceed 1500. The DISN currently has a few special Layer-3 VPNs that have requested an MTU of 4000. For customers with a 1500 byte

MTU, the MTUs will be limited at the J-PE. The CEG service provider is still required to support a maximum 4400/9000 MTU for all E-Lines.

4400 is the physical (layer-2) MTU of the circuit itself. 4000 is the IP MTU, which tells our customers that the max IP packet they can send is 4000 + Layer-2 Overhead (typically 18 or 22)

2.4 Converged CE Router using CSP service to access DISN

It is generally very economical for the customer to access more than one service utilizing the same physical interface. A Converged CE Router is a customer router that has a forwarding path for both encrypted classified traffic and unclassified traffic which is kept separated using VRFs and VLANs. Figure 2-8 depicts this implementation. Notice, the VLANs separate the different service on the access link and the VRFs separate the service within the CE router. This method of separation has received blanket approval by the DISN Security Accreditation Working Group, as long as the classified data is Type I encrypted in addition to the VRF and VLAN separation.

This same architecture applies to Converged CE routers connected to E-Line service on the CSPs network. Customers are responsible for deploying Unclass Converged CE routers (Not the CSP)

A separate E-line is needed for each VLAN leaving Converged CE router.

VLAN 2

VLAN 3

J-PE

Ethernet Link

SAM

NIPRUnclass Converged CE Router

VRF

NIPR xx.4x.x.x/30 xx.4x.x.x/30 xx.165.x.x/30

S-CE

Customer

HAIPE

VRF Lite x.165.x.x/30

H LH L

Figure 2-8 Converged CE router

2.5 Performance Specifications for CSP

Performance requirements consist of latency, frame/packet loss, availability and jitter.

Performance of the NNI

The NNI will typically be a local fiber connection between the J-PE and a co-located commercial handoff node. The NNI needs to be completely error free. (i.e., zero packet loss). If the NNI connection is a trunk circuit to the commercial handoff node, the NNI shall, at a minimum, meet the Assured #1 requirements for frame/packet loss specified in paragraph 2.5.3.

2.5.1 End-to-End Latency (Delay) Specification

Round-trip delay shall be less than or equal to 10 milliseconds per 350 miles measured as the great circle distance between the “A” and “Z” locations. Maximum possible round-trip latency of any circuit is dependent on which theater the service resides. See latency numbers below specified in milliseconds:

Theater Maximum RT

Latency Requirement

Intra-CONUS ≤100 ms

Intra-EUR ≤100 ms

Intra-PAC ≤150 ms

Intra-SWA ≤100 ms

2.5.2 End-to-End Frame/Packet loss, Availability, and Jitter Performance Requirements

The following Table provides the Service Level Performance Requirements for CEG services.

Service