SECTION 409 HME and LAN.pdf

LHA 10

6 APRIL 2023

SECT. 409 SECT. 409 1

SECTION 409

HULL, MECHANICAL AND ELECTRICAL (HM&E)

LOCAL AREA NETWORK (LAN)

409a. Definitions 5 Access Control List (ACL).- A list of rules granting and denying permission of traffic to and from a device based on traffic’s parameters.

Address learning rate.- The maximum rate at which a switch can learn new Media Access Control (MAC) addresses without flooding or dropping frames.

Application layer.- Open Systems Interconnection (OSI) model layers 5-7. 10 Backbone.- A set of interconnected switches providing a primary communication channel for reliable movement of data between edge switches.

Backbone switch.- A switch assigned to a backbone.

Bandwidth.- The width of the spectral region that contains the upper and lower limits for a given communications channel. Determines the information capacity of 15 a given communication channel.

Bidirectional traffic.- Frames presented to a Device Under Test/System Under Test (DUT/SUT) such that every receiving interface also transmits.

Broadcast.- Type of network traffic in which a single source sends data to all destinations (for example, one-to-all). 20

Cable assembly.- See Sect. 408.

Cable trunking.- Using a single cable for multiple network connections.

Congestion control.- The combined methods within a DUT/SUT to reduce the probability of congestion or contention on interfaces. Methods include back pressure, forward pressure, and head of line blocking. 25

Device.- Any active electronic component dedicated that produces or consumes data.

Dual homed end user.- An end-user which has two active connections to the network. Reference herein to primary and secondary end user connections is an arbitrary designation. 30

Edge switch.- A switch that serves at the entry point for an end user or device into the network.

Edge switch access port.- A port on an edge switch allocated for end-user connectivity.

Edge switch uplink.- A network connection between an edge switch and backbone 35 switch.

End user.- Any HM&E component (such as, console, DAU) physically attached to and communicating via an edge switch.

Errored frames.- Frames which are over-sized, under-sized, misaligned or with an errored Frame Check Sequence. 40

Ethernet switch.- A switch which operates based on IEEE 802.3 Ethernet standard.

Growth.- The available capacity within the existing network to accommodate system installation or network expansion without the need for switch replacement in the existing network infrastructure.

Head of line blocking.- Frame loss or added delay observed on an uncongested 45 output interface whenever frames are received from an input interface which is also attempting to forward frames to a congested output interface.

In-band traffic/communication.- Communication that takes place through the same physical channels as data transmissions.

Latency.- For store and forward devices: The time interval starting when the 50 last bit of the input frame reaches the input port and ending when the first bit of the output frame is seen on the output port. For bit forwarding devices: The time interval starting when the end of the first bit of the input frame reaches the input port and ending when the start of the first bit of the output frame is seen on the output port.55

SECT. 409 SECT. 409 2

Layer 3 switch.- A switch which supports hardware-based data exchange between communication interfaces based on information contained in the OSI Layer 3 header.

Typically, this implies the IP header.

Local management.- Management of a device which requires direct physical connectivity. 5

Maintenance.- Anything related to the monitoring, configuration, troubleshooting repair or replacement of a device or group of devices.

Multicast.- Type of network traffic in which a single source sends data to multiple destinations (for example, one-to-many).

Multicast group capacity.- The maximum number of multicast groups a SUT/DUT can 10 support while maintaining the ability to forward multicast frames to all multicast groups registered to that SUT/DUT.

Multicast group join delay.- The time duration it takes a DUT to start forwarding multicast packets from the time a successful IGMP group membership report has been issued to the DUT. 15 Multicast group leave delay.- The time duration it takes a DUT to cease forwarding multicast packets after a corresponding IGMP "Leave Group" message has been successfully offered to the DUT.

Network.- A data transport system built from a set of devices configured in a topology with the boundary at the connection from edge switches to the end user. 20 Network connection.- A communication interface between an edge switch and end user, edge switch and backbone switch, or two backbone switches including all intermediate cabling and cable components.

Network drop.- A network connection provided by the network not dedicated to a specific end user at the time of design. 25 Network Intrusion Detection System (NIDS).– A cybersecurity situational awareness system, to be provided and installed by the Government at a future date, that interfaces with the HM&E LAN traffic monitoring circuit and is independent of the Network Management Station. A NIDS monitors a network by capturing and analyzing network packets and detecting events occurring in a computer system or 30 network and analyzing them for signs of possible incidents or attacks.

Network switch.- Common term referring to a backbone, edge or redundancy switch.

Open standard.- A standard whose specification is publicly available.

Out-of-band traffic/communication.- Communication that takes place though physical channels outside those used for data transmissions. 35 Port mirroring.- The ability of a switch to copy received and/or transmitted frames from in-band source ports to a single target port.

Redundancy switch.- A switch that provides redundant connection between an edge switch and the backbones. This capability may be integrated with the edge switch as a module. 40 Restart behavior.- Reinitialization of system causing data loss

Single homed end user.- An end user which has one active connection to the network.

Spare port.- Installed, unassigned communication interfaces dedicated for troubleshooting and/or temporary replacement of faulty active interfaces. 45

Surface ship hatchable.- Equipment that will fit through a 26 inch by 66 inch oval opening without the need for disassembly.

Switch.- A device which has the primary function to provide communication interfaces for other devices, and autonomously or through external control signaling, facilitates the movement of data between the communication interfaces. 50 Throughput.- The maximum rate at which none of the offered frames are dropped by the device.

Topology.- Physical layout pattern of devices, switches, end users, and their interconnections.

SECT. 409 SECT. 409 3

Unicast.- Type of network traffic in which a single source sends data to a single destination (for example, one-to-one).

Unidirectional traffic.- When all frames presented to the input interfaces of a DUT/SUT are addressed to output interfaces which do not themselves receive any frames. 5

409b. Details of system

Circuit HN - HM&E LAN system.- This system shall serve as the primary infrastructure for all intra and inter HM&E system communication as specified herein including the following HM&E systems: 10

a. Machinery Control System

b. Ship Control System

c. Damage Control Action Management System (DCAMS) Software)

Circuit 1HN – HM&E LAN Alarm system.- This system shall provide summary alarms 15 for network failures to the following:

a. the Network Management Station in the Central Control Station

b. an IC/SM alarm panel in Network and Electro-Magnetic Spectrum Operations Center

Circuit 2HN – HM&E LAN Time system.- This system shall provide time via the HM&E

LAN to all HM&E LAN and HM&E LAN attached end-user system components.

Circuit 3HN – HM&E LAN Traffic Monitoring system.- This system shall provide network traffic monitoring capability to the Network Intrusion Detection System.

409b1. Network design The network shall be a dual backbone, dual-tier distributed topology. A notional topology is shown in Figure 1.

All switches, both backbone and edge, shall be installed internal to the ship’s hull or superstructure in compartments which have no direct access to weather. 30 Backbones.- The network shall implement two independent backbones, with each backbone composed of two or more redundantly connected switches. Each switch shall be designated as a backbone switch. Each backbone shall be situated port and starboard, respectively. Each backbone shall be fault independent; thus damage incurred to one backbone shall have no impact on the other backbone. Two port 35 backbone switches shall be located in Node Room No. 1 and Node Room No. 3, respectively. Two starboard backbone switches shall be located in Node Room No. 2 and Node Room No. 4, respectively. Each backbone switch shall have a minimum of two fiber optic connections to the other backbone switches within its own backbone.

All backbone cable runs shall be routed in cableways on the same side of the ship 40 as the equipment they are connecting and shall have a minimum of two deck separation between node rooms to the maximum extent practicable. Backbone switch to backbone switch network connections shall be 10GBASE-LR connections.

Edge switches.- Edge switches shall provide end user access to the network.

Edge switches shall be installed as required to accommodate all end-user connection 45 and spare port requirements specified herein. They shall be installed based on survivability within close proximity to the end users they accommodate. Each edge switch shall provide one uplink to each backbone using fiber optic cable as specified herein. Each edge switch uplink shall connect to the closest (relative to forward/aft direction) backbone switch on one backbone and the next closest 50 (relative to forward/aft direction) on the other backbone. Edge switch to backbone switch uplinks shall use 1000BASE-LX over single-mode fiber optic cable. A redundancy switch may be used to provide the backbone uplinks for an edge switch.

SECT. 409 SECT. 409 4

Redundancy switches.- The redundancy switch may be in the same enclosure as the associated edge switch. If the redundancy switch is in a separate enclosure from the associated edge switch, the enclosure shall meet edge switch requirements. The redundancy switch to edge switch uplink shall use 1000BASE-LX over single-mode fiber optic cable. 5

End users.- End users shall connect to the network via an edge switch. Dual homed end users shall have their primary and secondary network connections routed to separate edge switches. Each end user’s primary network connection shall be routed to an edge switch located within the same fire zone unless otherwise specified herein. End user network connections shall use copper network cabling to 10 the maximum extent practicable as cable length limitations dictate.

Network drops.- Network drops shall be treated as single homed end user connections to the network. The network drop exposed connection point out to the end user shall be treated as the network connection. Network drops shall only be used for end user equipment that requires operator mobility between watch stations. 15

Switch identification.- Each switch shall be assigned a unique identification and labeled as such. Backbone switch identification shall be distinguishable from edge switch identification. If separate from the edge switch, redundancy switch identification shall use the edge switch identification with a postfix common to redundancy switches. 20

409b2. Network fault tolerance

Backbone.- In the event of any individual backbone component failure, no end user to end user communication loss shall be incurred.

In the event of any individual backbone connection failure, no more than one 25 second worth of data loss shall be incurred on the affected backbone network.

Edge switches.- In the event of an individual edge switch uplink failure, no end user to end user communication loss shall be incurred. Single edge switch failures shall only impact network connections connected to the failed edge switch.

Communication interface modules.- Single communication interface module failure 30 shall only impact network connections connected to the failed module.

Communication interfaces.- Single communication interface failure shall only impact the network connection connected to the failed interface.

409b3. Supported interface types 35

Network connections.- End user network connections shall use 10/100BASE-TX over twisted pair cable. In the event that a given end user network connection exceeds the maximum allowable cable length, this connection shall use 100BASE-FX over multi-mode fiber optic cable.

All network connections shall operate at full duplex. 40 No in-line media converters shall be used in any network connection.

Protocol compliance.- Table I lists the protocols that shall be used for each of the associated described functions. All protocols used over the network shall be open standard protocols.

End user communication schemes.- With the exception of those protocols listed in 45 Table I which require broadcast messaging, end user communication shall not use broadcast messaging. End user communication schemes shall be designed to maximize network utilization efficiency and account for any limitations of the equipment selected. All end user communication schemes, protocols and messaging up to and including the application layer shall be documented in Interface Design 50 Descriptions (IDDs).

End users shall support static IP Address, subnet mask, and default gateway assignment to any valid IPv4 host value. End users shall support IP unicast routing. End users utilizing copper network cabling shall support both auto-negotiation and manual configuration of their respective network connection’s speed 55 and duplex settings.

SECT. 409 SECT. 409 5

409b4. Network logical segmentation The network shall support logical segmentation of systems and groups of end users, as specified herein. Each logical segment shall be statically assigned a unique identifier. Each end user shall be assigned to its appropriate logical segment. The network shall support and control the propagation of all network 5 traffic types and protocols from one logical segment to another. Configuration of data movement between logical segments, when required, shall occur at the source edge switch. Operation of logical segmentation shall be transparent to the end user. The end user shall be unable to modify logical segmentation parameters within the network. Configuration of logical segments shall be in accordance with 10 Table II VLAN subnet designations. Systems handling data from multiple circuit designations shall be configured in accordance with the systems’ logical segmentation requirement.

Implementation specific requirements for IEEE 802/IP Virtual Local Area Networks (VLANs).- IEEE 802/IP based logical segmentation using Virtual Local Area Networks 15 (VLANs) shall support all the requirements of IEEE 802.1Q. ACLs shall be used to control the propagation of all network traffic types and protocols from one VLAN to another. IEEE 802.2 Sub-network Access Protocol (SNAP) may be used as an additional internal measure to further separate network traffic. Each VLAN shall be assigned a unique sub-network IP address. Network switch default VLANs shall be 20 used only for initial, in-band switch configuration.

Each end user shall be statically assigned a unique IP address within the IP sub-network assigned to its associated VLAN. Each network switch shall be statically assigned a unique IP within the IP sub-network assigned to its in-band management VLAN. Each end user directly connecting to the HM&E LAN shall have a 25 unique Media Access Control address.

409b5. Network management

A Network Management Station (NMS) shall be installed in the Central Control Station as part of the network, providing centralized network management of the 30 network. The NMS shall be a dedicated console. The NMS’s service position shall not hinder visibility of its display. All direct, in-band switch management shall be accomplished solely by the NMS. The NMS shall connect directly to backbone switches in each backbone. The NMS shall be inaccessible from the edge switches.

Logical segmentation.- The NMS and associated backup network switch interfaces 35 designated for NMS use shall be assigned to a logical segment unique from all other attached end users. This logical segment shall be dedicated for in-band network management, and associated alarm requirements. Network switches shall prohibit in-band network management on all other logical segments.

The network monitoring, management and control features shall use, at a minimum, 40 the following configuration items in the network configuration report specified in this section to implement operational configuration management of the network for the operator.

Network monitoring features.- The NMS shall provide, at a minimum, the following monitoring features: 45

a. A pictorial representation (such as, topological map) of all the network switches and their interconnections, each color coded to highlight any associated active alarms

b. Alarm summary of each network switch, time server and the NMS workstation itself 50

c. Monitoring and logging of each network switches’ network services, triggering an alarm upon loss of connectivity

SECT. 409 SECT. 409 6

d. Monitoring and logging of each network switches’ physical interfaces, triggering an alarm when any interface enters a operating state contrary to configuration

e. Monitoring and logging of each network switches’ power supply status, triggering an alarm upon input power or power supply component failure 5

f. Monitoring and logging of each network switches’ fan status (if applicable), triggering an alarm upon fan failure

g. Monitoring and logging of each network switches’ operational temperature, triggering an alarm upon an over temperature condition

h. Monitoring and graphically depicting network switch physical interface 10 usage, triggering an alarm when a dual-homed end-user actively uses a secondary HM&E LAN connection

i. Retrieval, logging, and viewing of latched network switch and time server alarms

j. Consuming, logging, and viewing of network switch and time server syslog 15 messages

k. Cybersecurity logging shall be in accordance with Sect. 402.

Circuit 1HN alarm requirements.- As part of the monitoring features, the permanently installed NMS shall provide outputs to drive the Circuit HN1 alarm 20 system. Circuit 1HN shall provide output to IC/SM alarm panels meeting the interface requirements of Sect. 436. The summary alarm output shall be based at a minimum on the logical or of the alarm summary of each network switch and the NMS workstation itself. In the case of any NMS hardware failure, the output shall default to the alarmed state. 25

Network management features.- The NMS shall provide, at a minimum, the following management features:

a. Importing new network switch and time server software and configuration files via CD/DVD media

b. Pushing of network switch software and configuration after switch 30 replacement

c. Moving active network switch port, along with its configuration, to a spare port

d. Acknowledging and/or clearing active network switch, time server and NMS alarms 35

e. Logging of cybersecurity data

f. Exporting of NMS logs to CD/DVD media

g. Pushing of time server software and configuration, via out-of-band interface, after time server replacement

h. Setting Coordinated Universal Time (UTC) time on time server via out-of-40 band interface

The DVD drive shall be used for software maintenance only and is not required to function through Mil. Spec. MIL-S-901D grade A shock and MIL-STD-167 vibration environments. 45 User groups.- The NMS shall provide the following user groups in addition to those specified in Sect. 402:

a. Operator: view-only and acknowledge network alarms

b. Network System Administrator: view network status, network management features, view and acknowledge network alarms, manage NMS user accounts, view 50 and download network alarms, and manage network log storage privileges

c. Network ISEA: all privileges assigned to Network System Administrators, terminal access, access the NMS operating system, and install software privileges. The Network ISEA shall also have those privileges assigned to the Cybersecurity Administrator in accordance with Sect. 402. 55

SECT. 409 SECT. 409 7

Every user group shall require authentication. Network system administrators and ISEAs shall require two-person authentication in accordance with Sect. 402.

NMS design requirements.– The NMS shall be provided with a minimum 20 inch viewable LCD or LED display. The NMS shall have a full size keyboard and trackball with two select pushbuttons. The NMS shall conform to NEMA 4 or IP65 enclosure 5 requirements.

The NMS shall be operable with flash gloves. If touchscreens are utilized, this requirement shall apply to the keyboard and trackball.

The NMS shall be designed for standing operation.

A ruggedized laptop shall be provided as a backup NMS. Additionally, the laptop 10 shall provide applications for local network switch and time server management.

The NMS, if using chassis with plugin cards, shall contain one or more spare card slots. The NMS shall be provided with power supplies and cooling capacity sufficient for the additional card slots at the maximum power consumption capability of the card slot. 15

409b6. Network security

The HM&E LAN cybersecurity requirements shall be in accordance with Sect. 402, except as modified in this section.

Security features shall not interfere with the performance of the network or end 20 users.

All network switches shall meet the security guidelines set forth in the Defense Information Systems Agency (DISA) Layer 2 Switch Security Technical Implementation Guidelines (STIG) and the DISA Infrastructure Layer 3 Switch STIG.

The NMS shall meet the security guidelines set forth in the pertinent operating 25 system DISA STIG.

409b7. Network switch requirements

All requirements specified in this and lower level subsections shall be applicable to both backbone and edge switches unless otherwise specified. 30

The network switches shall be COTS industrial-grade or Mil. Spec., network devices. Each network switch shall implement the network functional requirements specified herein as well as the following features:

a. Communication port rate limiting based on broadcast, multicast, and/or unicast traffic types 35

b. Multicast group filtering

c. A maximum frame size of 1528 bytes

d. Port mirroring

e. Copper Ethernet port auto-negotiation and manual configuration of speed and duplex settings. 40

Electrical power.- Power supplies shall comply with Sects. 403 and 430 and as specified herein. Network switches shall operate on type I, 115Vac, single-phase electrical power in accordance with MIL-STD-1399, Section 300. Each power supply module shall provide a visual indicator depicting its status. If a network switch 45 has redundant power supplies, failure of a single power supply shall have no impact on the associated network switch’s operation.

Communication interfaces.- Each communication interface shall provide a visual indicator depicting its overall status. For each edge switch there shall be 1 spare port for each edge switch to end user interface type. For each backbone 50 switch there shall be 1 spare port for edge switch uplinks. Spare port requirements shall be in addition to growth requirements.

Backbone switch specific.- Each backbone switch shall support a minimum of 25 percent growth after ship delivery with respect to edge switch to backbone switch interfaces. 55

SECT. 409 SECT. 409 8

Edge switch specific.- Each edge switch shall implement a modular chassis design. Communication interface, electrical power, and control and management functionality shall all be implemented on modules distinct from one another. Edge switch to backbone switch connection interfaces shall be contained on a module or redundancy switch separate from end user to edge switch connection interfaces. To 5 the greatest extent practicable without increasing the number of switches, end users of different systems shall be connected to separate communication interface modules. Each edge switch shall support a minimum of 25 percent growth after ship delivery with respect to end user to edge switch interfaces.

Port mirroring.- The network switch shall support wire-speed copying of data from 10 all in-band ports. A switch port configured as a port mirror output port (i.e.

target port) shall drop all frames received from the connected device.

Management interfaces.- Each network switch shall provide an out-of-band console interface for local switch management. The out-of-band console interface shall have physical security if external to enclosure physical security measures. Each 15 switch shall provide a dry contact relay for failsafe alarm indication. This relay shall be connected to Circuit HN1. At a minimum, the failsafe relay shall latch when the switch built-in test functionality detects a failure condition.

The failsafe relay shall automatically unlatch when the condition that caused it to latch is resolved. 20

Enclosure design and installation.- Each network switch shall be installed in an NEMA 4 or IP65 minimum rated, enclosure. Each network switch enclosure shall be surface ship hatchable. Each network switch enclosure shall not impede the visibility of any visual indicator implemented on the associated network switch.

Any required enclosure active cooling mechanisms shall be implemented via forced 25 internal air flow. Each network switch enclosure shall provide removable connector panel assemblies, one per network switch module, which provide the mating junction between external cables and their associated network switch port. For external cables connected to the network switch enclosure connector panel, the cybersecurity requirement that connections be within lockable enclosures specified in Sect. 402 30 shall not apply. These connector panels shall be located on the bottom of the enclosure. Panel connectors designated for power input shall prohibit direct contact with power sources and connection of non-power input cables to these connectors. Panel connectors designated for edge-switch uplinks to their respective backbones shall prohibit connecting one backbone’s uplink cable to the 35 other backbone’s designated port. Access to the network switch or other internal components shall be via the front of the enclosure. Each network switch enclosure shall be grounded via a Class C bond in accordance with MIL-STD-1310. Each network switch enclosure shall include labels on the front of the enclosure which include:

a. Unique network switch identification 40

b. Indication of multiple sources of power and their locations

c. Fiber optic warning labels (if applicable) in accordance with Mil. Spec.

MIL-I-24728.

409b8. Network cabling and components 45 At each edge switch, the backbone switch uplinks shall connect to the edge switch enclosure using heavy-duty connectors with different keying styles. The keying styles for these connections shall be consistent across all edge switches with respect to which backbone (port or starboard) the edge switch uplink connects.

Redundancy switches external to the edge switch enclosure shall use the edge switch 50 to backbone switch uplinks keying required above. A different keying style shall be used for the redundancy switch to edge switch connection.

Each edge switch’s uplink cable lengths, relative to one another, shall be determined based on redundancy protocol differential timing requirements.

SECT. 409 SECT. 409 9

With the exception of network drops, all copper network connections shall not exceed 320 feet including internal equipment cable lengths. Network drops shall have a network connection not exceeding 290 feet.

Copper network connections using cabling with an overall shield shall have the overall shield grounded at a single point at the associated network switch. At no 5 other point along the network connection shall the overall shield be grounded.

All copper network cable assemblies terminated with an RJ-45 connector shall be pinned-out in accordance with TIA/EIA-568-B.

All copper network cable assemblies shall use twisted pair cabling meeting a minimum of Category 5e standards. 10

Copper network cable assemblies shall use connectors which do not impede the connection’s maximum theoretical bandwidth. Copper network cable assemblies shall not use punch down style connectors. Copper network cable assemblies may be mated externally to an end user enclosure. They shall use a heavy-duty circular style connector. If such connectors are used, the Sect. 402 Cybersecurity requirement 15 that connections be within lockable enclosures shall not apply.

409b9. Circuit 2HN Network Time requirements

A stratum 1 time server shall be provided as part of the NMS console. The time server shall be connected to an edge switch within its fire zone. The time server 20 shall have an out-of-band connection to the NMS workstation for local management.

The time server drift rate shall not exceed 200 milliseconds per day. The time server shall be able to serve a minimum of 1024 time requests per second. The time server shall have a MTBF of at least 50,000 hours.

End users which display time, require time synchronization with other users, or 25 time stamp messages shall synch to the network time server upon startup and at least once every 4 hours thereafter.

409b10. Circuit 3HN Network Traffic Monitoring requirements The HM&E LAN shall provide the capability to retransmit Ethernet frames sourced 30 from each network switch to the Network Intrusion Detection System by way of switch port mirroring and a single cable from each switch. The method used for retransmission shall not impact the communications of any end user system.

Communication from any device to the Network Intrusion Detection System shall be unidirectional. Devices used to implement Circuit 3HN shall meet the test 35 requirements specified herein.

Cable or cable components used to implement Circuit 3HN shall meet the installation requirements specified herein. Dedicated fiber optic interconnection boxes, with patch panels, shall be installed in the Central Control Station (CCS) within the vicinity of the space reservation for the Network Intrusion Detection 40 System, and the Network and Electro-Magnetic Spectrum Operations Center. Fiber optic cables, as specified herein, shall be used to provide data to the Network Intrusion Detection System and be terminated to the fiber optic interconnection box in CCS. A fiber optic cable, as specified herein, shall be connected from the fiber optic interconnection box in CCS to the fiber optic interconnection box in 45 the Network and Electro-Magnetic Spectrum Operations Center.

SECT. 409 SECT. 409 10

409c. Installation requirements Cable and installation requirements are specified in Sects. 304, 408 and 430.

Cable trunking external to device enclosures is prohibited.

Network connections shall have no more than one cable assembly between each device enclosure, except as specified herein. 5 Each network connection cable assembly shall include markings at each end which indicate the assigned connection point (as displayed on or assigned to the connection point) for each cable assembly connector. Copper cables to the end user shall use the circuit designation for the end user for marking purposes. Fiber optic cables to end users shall use the circuit designation for the end user for 10 marking purposes.

Single-mode fiber optic cable assemblies running external to connected device enclosures shall use M85045/18‐02P cable. Multi-mode fiber optic cable assemblies running external to connected device enclosures shall use M85045/18‐01P cable.

All copper network cable assemblies shall have a minimum bend radius of 10 times 15 their overall cable diameter. Copper network cable assemblies running external to a device’s enclosure and penetrating a watertight barrier shall use M24643/59-04UO cable. Copper network cable assemblies running external to a device’s enclosure and not penetrating a watertight barrier shall use M24643/59-03UO cable.

Main fore and aft cable runs shall be located port and starboard and high and 20 low in the ship. The lower cableways can be through the machinery spaces and corresponding platform decks, while the upper cableways shall be under the main deck unless the termination point is above the main deck.

Each network switch and NMS shall be provided with two sources of power. The primary power input shall be from an external UPS unit in accordance with Sect. 25

314. The secondary power input shall be from Category I power in accordance with Sect. 320. There shall be an alarm on Circuit HN1 upon loss of primary power and the network switch is operating on secondary power input. Both sources shall be located within the same fire zone as the network switch. Edge switches located within a main machinery room shall not be powered from the same UPS unit. The 30 network switches and NMS may be powered from the MCS UPS units, as specified in Sect. 202. Transition from primary to secondary power source shall have no impact on its associated network switch operation.

Redundancy switches shall be installed in the same compartment as and no greater than 10 feet in proximity to the associated edge switch. Redundancy switches shall 35 be provided with the same sources of power as their associated edge switch.

The UPS units’ condition reporting as specified in Sect. 314 shall be displayed by the Machinery Control System in accordance with Sect. 202.

409c1. Network drop requirements 40

Network drops shall be provided for the Damage Control Action Management System (DCAMS) as specified in Sect. 664.

The network drops shall:

a. Have one 100BASE-TX receptacle exposed interface connections located behind a hinged cover. 45

b. Be IP66 enclosure rated, applying when the hinged cover is closed.

409d. First article testing

The following environmental and performance tests shall be performed on a network switch and enclosure and the NMS console installed in a typical service 50 position and configuration. During each test the network switch shall be operational unless otherwise explicitly stated, induced with constant frame rate network traffic (within two percent of each active interface’s maximum throughput) on each of its communication interface modules.

SECT. 409 11 SECT. 409

409d1. Environmental testing requirements Shock.- The network switch with enclosure, NMS console, and devices used to implement Circuit 3HN shall meet the grade A, type A requirements of Sect. 072.

During each shock event no more than 100 milliseconds worth of network traffic shall be lost. 5

Vibration.- The network switch with enclosure, NMS console, and devices used to implement Circuit 3HN shall meet the requirements of MIL-STD-167-1A. During the test’s entirety no network traffic shall be lost.

Electromagnetic Interference (EMI).- The network switch with enclosure, NMS console, and devices used to implement Circuit 3HN shall meet the requirements of 10 MIL-STD-461. During susceptibility tests no network traffic shall be lost.

Electrical power.- The network switch with enclosure, NMS console, and devices used to implement Circuit 3HN shall meet the type I, test requirements as specified in MIL-STD-1399, Section 300.

Operational temperature.- The network switch with enclosure and devices used to 15 implement Circuit 3HN shall operate continuously without mechanical or electrical damage and in accordance with the performance and functional requirements, in any compartment ambient temperature between the limits of 10.4 degrees F and 149 degrees F. This shall be verified in accordance with MIL-STD-810, Methods 502.5 and 501.5, Procedure II (Constant Temperature Exposure) respectively. 20

The NMS console shall operate continuously without mechanical or electrical damage and in accordance with the performance and functional requirements, in any compartment ambient temperature between the limits of 50 degrees F and 122 degrees F. This shall be verified in accordance with MIL-STD-810, Methods 502.5 and 501.5, Procedure II (Constant Temperature Exposure) respectively. 25

Humidity.- The equipment shall operate continuously without mechanical or electrical damage and in accordance with the performance and functional requirements, at a relative humidity up to 95 percent.

Non-operational temperature.- The network switch with enclosure, the NMS console, and devices used to implement Circuit 3HN shall have a maximum non-30 operating temperature of 158 degrees F. This shall be verified in accordance with MIL-STD-810, Method 501.5, Procedure I (Constant temperature exposure).

The network switch with enclosure and the NMS console shall have a minimum non-operating temperature of -40 degrees F. This shall be verified in accordance with MIL-STD-810, Method 502.5, Procedure I. 35

Airborne noise.- The network switch with enclosure, the NMS console, and devices used to implement Circuit 3HN shall be in accordance with Sect. 073.

409d2. Performance testing requirements

Network switch performance verification shall be accomplished both with and 40 without the enabling of port mirroring.

Throughput.- The network switch shall support a bidirectional wire-speed layer 2 switching throughput for unicast, multicast and broadcast traffic. Each backbone and edge switch shall support a bidirectional wire-speed layer 3 routing throughput for unicast and multicast traffic. Unicast throughput shall be verified in 45 accordance with RFC 2544. Multicast throughput shall be verified in accordance with RFC 3918. Broadcast throughput shall be verified in accordance with RFC 2889.

Wire-speed throughput is equal to bandwidth.

The network switch’s average latency shall not exceed 200 micro seconds during any of the required throughput verifications. 50

Reset.- The network switch’s restart behavior shall be verified in accordance with RFC 2544.

SECT. 409 12 SECT. 409

Congestion control.- The backbone and edge switch shall prevent head of line blocking. This shall be verified in accordance with RFC 2889.

Address caching capacity.- The backbone and edge switch shall have a minimum address caching capacity of 1024 addresses. This shall be verified in accordance with RFC 2889. 5

Address learning rate.- The backbone and edge switch shall have a minimum address learning rate of 1024 addresses per second. This shall be verified in accordance with RFC 2889.

Errored frames filtering.- The network switch shall not forward undersized Ethernet frames or frames containing CRC errors. This shall be verified in 10 accordance with RFC 2889.

Multicast group join/leave delay.- The backbone and edge switch’s multicast group join delay shall not exceed 500 milliseconds. The network switch’s multicast group leave delay shall not exceed three seconds. This shall be verified in accordance with RFC 3918. 15

Multicast group capacity.- The backbone and edge switch shall have a minimum multicast group capacity of 100 groups. This shall be verified in accordance with

RFC 3918.

409d3. Functional testing requirements 20

Tests shall be performed to verify that all functional requirements of this section have been met.

409e. Software and configuration management

The Contractor shall implement configuration management of the network software 25 and configuration data in accordance with IEEE Standard 12207.

All network configuration items and non-commercial switch and NMS software shall be delivered as they are filed under configuration management. Non-commercial software shall be delivered in both compiled and source form. All non-commercial development and configuration management tools required to modify the HM&E LAN 30 shall be delivered.

Configuration items shall include, but are not limited to, the following:

a. Network switch port assignments

b. Network VLAN and associated IP subnet assignments

c. Network host IP address assignments 35

d. Network switch software

e. Network switch configuration files

f. Network switch user accounts and associated passwords

g. NMS software

h. NMS configuration files 40

i. NMS user accounts and associated passwords.

409f. Technical documentation In addition to the drawings required in Sect. 085, the Contractor shall provide a block diagram and a bill of materials for the network. The block diagram shall 45 show where the equipment will be installed on the ship, identify physical connections among all the network switches and end users. The bill of materials shall list the manufacturer and model number for the network switches and the manufacturer and model number of all major equipment installed in the network switch enclosures.50

SECT. 409 13 SECT. 409

The Contractor shall prepare the following:

a. Configuration Management Plan

b. Test Plans, Procedures, Notifications and Reports

c. End user Network IDDs

d. Technical Manual in accordance with Sect. 086. 5

e. Network Configuration Report. The Network Configuration Report shall include the following:

1. network switch port assignments

2. network VLAN and associated IP subnet assignments

3. network hosts IP address assignments 10

4. network switch user accounts and associated passwords

5. NMS user accounts and associated passwords

f. Software Version Description for all developmental and modified COTS software. 15

g. Software Product Specification for all developmental and modified COTS software.

SECT. 409 14 SECT. 409

TABLE I.- HM&E LAN PROTOCOL COMPLIANCE

PROTOCOL PRIMARY FUNCTION COMPONENT

IMPLEMENTATION

DESCRIPTION

Ethernet

(IEEE 802.3-2012)

Physical data transmission and addressing

Backbone and edge switches, end users, NMS, time server

Base network protocol used as foundation for all higher layer network protocols and, hence, all communication among end-users and network devices

Virtual Local Area Networks (VLANs) over Ethernet

(IEEE 802.1Q-

2011)

Logical segmentation of network traffic

Backbone and edge switches, NMS

Ethernet frame extension which allows for logically segmenting network traffic into different broadcast domains

Link Layer Control (LLC) with Subnetwork Access Protocol (SNAP) extension

(IEEE 802.2-1998)

Layer 2 network protocol multiplexing

Backbone and edge switches, NMS

Provides Ethernet II frame alternative for non-IP payload encapsulation multiplexing

Parallel Redundancy Protocol (PRP)

(IEC 62439-3,

Clause 4 (Edition 2.0)

Network redundancy

Edge switches Network redundancy protocol responsible for achieving bumpless network fault recovery

Rapid Spanning Tree Protocol

(RSTP) (IEEE

802.1D-2004)

Backbone redundancy

Backbone switches Network redundancy protocol responsible for managing redundant backbone switch interconnections

Internet Protocol (IP) (RFCs 791, 894 and 2460)

Logical addressing and datagram encapsulation

Backbone and edge switches, end users, NMS, time server

Principal communication protocol for encapsulating datagrams over the network

Address Resolution Protocol (ARP)

(RFC 826)

Layer 2/3 address resolution

Backbone and edge switches, end users, NMS, time server

Provides ability to resolve IP address to Ethernet MAC address

Internet Control Message Protocol

(ICMP) (RFC 792)

Network diagnostics

Backbone and edge switches, end users, NMS, time server

Provides ability to determine network device and end-user reachability

SECT. 409 15 SECT. 409

TABLE I.- HM&E LAN PROTOCOL COMPLIANCE (Continued)

PROTOCOL PRIMARY FUNCTION COMPONENT

IMPLEMENTATION

DESCRIPTION

Internet Group Management Protocol (IGMP)

(RFC 2236)

IP multicast group management

Backbone and edge switches, end users, NMS

Allows network device to determine and manage end-user to IP multicast group associations

User Datagram Protocol (UDP)

(RFC 768)

Connectionless application transport

Backbone and edge switches, end users, NMS, time server

Provides connectionless transportation of application data.

Requires minimal overhead; however data delivery is not guaranteed unless provided by application

Transmission Control Protocol

(TCP) (RFC 793)

Connection-oriented application transport

Backbone and edge switches, end users, NMS, time server

Provides connection-oriented (such as, session based) transportation of application data.

Ensures ordered data delivery at the cost of additional overhead

Network Time Protocol (NTP)

(RFC 5905)

Clock synchronization

Backbone and edge switches, end users, NMS, time server

Interface for HM&E LAN component internal clock synchronization via the HM&E LAN

Simple Network Management Protocol (SNMP)

(RFC 3411-3418)

Network device status monitoring

Backbone and edge switches, NMS, time server

Interface for querying and receiving network device (backbone and edge switch) status via NMS

Secure Shell

(SSH) (RFC 4253)

Network device management

Backbone and edge switches, NMS, time server

Secure command line interface for executing network device (backbone and edge) switch management tasks via NMS

Secure File Transfer Protocol

(SFTP)

Network device file transfer

Backbone and edge switches, NMS, time server

Secure interface for transferring files between NMS and network devices (backbone and edge switches)

SECT. 409 16 SECT. 409

TABLE I.- HM&E LAN PROTOCOL COMPLIANCE (Continued)

PROTOCOL PRIMARY FUNCTION COMPONENT

IMPLEMENTATION

DESCRIPTION

Syslog

(RFC 5424)

Network device event monitoring

Backbone and edge switches, NMS, time server

Interface for consuming pertinent network device (backbone and edge switch) events via NMS

SECT. 409 17 SECT. 409

TABLE II. - HM&E LAN VLAN SUBNET COMMUNICATIONS

SOURCE DESTINATION COMMUNICATION PATH

HN (HM&E LAN) 2HN (HM&E LAN Time) Bidirectional ID (DCAMS) 2HN Bidirectional 1IE1(Electric Plant Starboard Control)

2HN Bidirectional

1IE1 1IE2 (Electric Plant Port Control)

Bidirectional

1IE1 2IE (Electric Plant HMI) Bidirectional 1IE1 1IM (MCS logging) One-way 1IE1 2IM (MCS HMI) One-way 1IE2 2HN Bidirectional 1IE1 1IP One-way 1IE1 2IP One-way 1IE1 5IM One-way 1IE2 2IE Bidirectional 1IE2 1IM One-way 1IE2 2IM One-way 1IE2 1IP One-way 1IE2 2IP One-way 1IE2 5IM One-way 2IE 2HN Bidirectional 2IE 1IM One-way 2IE 2IM One-way 1IM 2HN Bidirectional 1IM 2IM Bidirectional 2IM 2HN Bidirectional 2IM IS, see Sect. 438 Bidirectional 4IM (MCS On-board Training)

2HN Bidirectional

4IM 2IM Bidirectional 5IM (Auxiliaries) 2HN Bidirectional 5IM 1IM Bidirectional 5IM 2IM Bidirectional 6IM (Printers) 2IM Bidirectional 1IP (Propulsion Starboard Control)

2HN Bidirectional

1IP 1IM Bidirectional 1IP 2IM Bidirectional 1IP 2IP (Propulsion Port

Control) Bidirectional

1IP IS Bidirectional 2IP 2HN Bidirectional 2IP 1IM Bidirectional 2IP 2IM Bidirectional 2IP IS Bidirectional IS 2HN Bidirectional IS 1IM Bidirectional

NOTIONAL HM&E LAN TOPOLOGY

FIGURE 1

SECT. 409 18 SECT. 409

Network

Backbone : B

Backbone : A

BS-A1 BS-A[n]

BS-B1 BS-B[n]

Diagram Key Additional Optional Switches Continuation

Dual Homed End User Single Homed End User Backbone Connection Edge to Backbone A Connection Edge to Backbone B Connection User to Edge Connection

ES-1 ES-2 ES-3 ES-4 ES-5 ES-[m-4] ES-[m-3] ES-[m-2] ES-[m-1] ES-[m]RS M

RSM Redundancy Switch/Module

RS

M

RS

M

RS

M

RS

M

RS

M

RS

M

RS

M

RS

M

RS

M

NMS

FWD