Attachment_D_-_DHA_LAN_WLAN_Guides.pdf

Unclassified/For Official Use Only (FOUO)

Deputy Assistant Director Information Operations (DAD IO)/J-6 Directorate Office of the Chief Technology Officer (OCTO) Architecture, Advanced Concepts and Engineering (AACE) Division

Local Area Network (Local Area Network (LAN)-Wireless Local Area Network (WLAN) Modernization

Technical Requirements-Guidance LAN WLAN December 19, 2018 Version: 1.0 Unclassified/FOUO

Local Area Network (LAN)-Wireless Local Area Network (WLAN) Modernization Version 1.0

Technical Requirements-Guidance LAN WLAN

December 19, 2018 ii

Document History

DATE VERSION DESCRIPTION OF CHANGE PRODUCTION

STATUS

NAMES/NOTES

6/4/17 0.1D Initial draft Rough Kevin O’Hara, Local Area Network (LAN)/Wireless LAN (WLAN) Deployment Function, Deployment and Transition Branch (DTB), Architecture, Advanced Concepts and Engineering Division (AACE) Chuck Cortines CTR, LAN/WLAN Deployment, DTB, AACE

Marcus Jellerson CTR, Program Operations Branch

(POB), AACE

2/26/18 0.2D AACE author/coordinate for reviews/revise. Provide clean draft to external reviewers.

Internal Review Mike Leahy CTR, POB, AACE Gloria De Leon CTR, POB, AACE Rudy Blazicko, Network and Security Management Systems (NSMS) Program Manager, POB, AACE Duane Brown CTR, POB, AACE

5/1/18 0.3D AACE author/coordinate for reviews/revise. Provide clean draft to final reviewer.

External Review Jeff Collins, LAN/WLAN Sustainment, Network Operations Branch (NOB), Infrastructure and Operations (I&O) Phil Forister, LAN/WLAN Sustainment, NOB, I&O Jay Cuttino, Space and Naval Warfare Systems Command (SPAWAR) Mike Luvaul, SPAWAR Rob Barrow, United States Army Information Systems Engineering Command (USAISEC)

4/27/18 Internal Review Chuck Cortines CTR, LAN/WLAN Deployment, DTB, AACE

6/22/18 0.4D AACE author/coordinate for section chief and branch reviews/revise. Provide clean draft to editor.

Final Review Jay Ellis, Infrastructure Engineering, Engineering and Design Branch (EDB), AACE Kevin O’Hara, LAN/WLAN Deployment, DTB, AACE

8/17/18 Joshua Zamarripa, Branch Chief, Acting, EDB, AACE

Joe Tolentino Branch Chief, Acting, DTB, AACE NOTE: Deferred to Final Review and Signature

8/23/18 Format/edit. Technical Edit (Interim)

Erin Ljungdahl CTR, POB, AACE

9/17/18 Internal Review Jay Ellis, Infrastructure Engineering, Engineering and Design Branch (EDB), AACE Kevin O’Hara, LAN/WLAN Deployment, DTB, AACE

9/17/18 0.5D Format and edit. Provide to author to proofread.

Technical Edit Erin Ljungdahl CTR, POB, AACE

9/23/18 Peer Review Heather A. Parsons CTR, POB, AACE

10/19/18 0.6D Proofread edits, accept/revise.

Provide to editor.

Technical Edit Gloria De Leon CTR, POB, AACE Chuck Cortines CTR, LAN/WLAN Deployment, DTB, AACE

11/1/18 0.7D Quality control final draft. Quality Control Erin Ljungdahl CTR, POB, AACE

11/1/18 Gloria De Leon CTR, POB, AACE

12/19/18 1.0 Reversion as final, convert to PDF, route for signature.

Quality Control Erin Ljungdahl CTR, POB, AACE

12/19/18 Approve/digitally sign Approve/Sign Lauro A. Salais, Chief, Acting, PIE Section, EDB, AACE

December 19, 2018 iii

DATE VERSION DESCRIPTION OF CHANGE PRODUCTION

STATUS

NAMES/NOTES

12/19/18 Joshua M. Zamarripa, Branch Chief, Acting, EDB, AACE

12/19/18 Release Publish Erin Ljungdahl CTR, POB, AACE

December 19, 2018 iv

X

X

APPROVED BY:

LAURO A. SALAIS

Chief, Acting, Platforms and Infrastructure Engineering Section Engineering and Design Branch

APPROVED BY:

JOSHUA M. ZAMARRIPA

Branch Chief, Acting, Engineering and Design Branch Architecture, Advanced Concepts and Engineering Division

December 19, 2018 v

Table of Contents

1 Introduction

1.1 Purpose

1.2 Scope

1.3 Audience

1.4 Point of Contact

2 General Guidance and Project Standards

2.1 Mandatory Requirements and Guidelines

2.2 Recommended Requirements and Guidelines

2.3 Project Standards

3 LAN Modernization

3.1 LAN Requirements

3.2 LAN Cable Plant Survey and Design Guidance

3.2.1 Computer Room/Satellite Equipment Area/Telecommunications Rooms

3.2.2 Vertical Cable Plant

3.2.3 Horizontal Cable Plant

3.2.4 Cable Abatement/Removal

3.3 LAN Electronics Survey and Design Guidance

3.3.1 Core/Distribution Switches

3.3.2 Access/Edge Switches

3.3.3 UPS Validation

3.3.4 Authentication, Authorization and Accounting (AAA)

3.3.5 Base / Post Facilities Supporting Medical Personnel

4 Wireless LAN (WLAN) Modernization

4.1 WLAN Requirements

4.2 WLAN Survey and Design Guidance

4.2.1 WLAN Survey Scope

4.2.2 General WLAN Survey Guidance

4.2.3 General WLAN Design Guidance

4.2.4 Army, Navy, and Air Force MHS WLAN Design

4.2.5 Air Force BITI WLAN Design

5 LAN/WLAN Installation Guidelines

5.1 LAN Cable Installation Guidelines

5.1.1 Cable Installation Standards

5.1.2 Cable Certification Testing

5.2 LAN Electronics Installation Guidelines

5.3 WLAN Installation Guidelines

5.4 MHS Infrastructure Configuration Control Board (MI-CCB) Guidelines

Appendix A: References

December 19, 2018 vi

Appendix B: Document Restrictions, Destruction and Trademarks

Appendix C: SIP and CCR Digital Pictures

Appendix D: SIP and CCR Drawing Package

Appendix E: Network Configuration Files

Appendix F: Engineering Change Requests

Appendix G: Cable Certification Requirements

Appendix H: Network Configuration Requirements

Appendix I: WLAN Acceptance Test Requirements

Appendix J: Glossary

Index of Tables Table 1: LAN Requirements Table 2: Vertical Cable Plant Technical Requirements (Functional and Non-Functional) Table 3: Horizontal Cable Plant Technical Requirements Table 4: Core/Distribution Switch Technical Requirements Table 5: Access/Edge Switch Technical Requirements Table 6: Functional Requirements – WLAN Modernization Table 7: WLAN Technical Requirements Table 8: LAN Equipment Scripts (Brocade and Cisco) Table 9: LAN Equipment Scripts (Juniper) Table 10: WLAN Equipment Scripts (HPE/Aruba and Cisco)

Index of Figures Figure 1: Interconnect Drawing Legend Example Figure 2: LAN/WLAN Core Interconnectivity Diagram Example Figure 3: LAN Fiber Backbone Example Figure 4: LAN Core Switch Port Interconnection Example Figure 5: SEA Switch Uplink Example

December 19, 2018 1

Unclassified/FOUO

1 Introduction This document provides requirements, design guidance, installation standards, and examples that pertain to the Local Area Network (LAN) and Wireless LAN (WLAN) Modernization program within the Defense Health Agency (DHA). It also serves as the main reference for new LAN/WLAN installations and upgrades.

The sections contained herein provide detailed technical requirements and guidance to be followed during all project phases to include survey, design, installation, and closeout activities.

Exceptions to the requirements and guidelines set forth in this document shall be brought to the attention of the DHA LAN/WLAN Government Task Manager which can be reached at: DHA.LAN- WLAN.DepMgt@mail.mil.

NOTE: Any section/subsection of this document not applicable to this project is noted: Not applicable.

1.1 Purpose

This document identifies technical requirements for the LAN and WLAN infrastructure supporting Department of Defense (DoD) (military) medical treatment facilities (MTFs) and their associated satellite facilities—including those not located on military installations. This network infrastructure provides the required data transport capability to enable the Defense Healthcare Management System Modernization (DHMSM) and other clinical and nonclinical applications that are essential to DoD Healthcare.

1.2 Scope

This document identifies requirements and architecture guidance for LAN and WLAN systems within facilities that are owned, operated, or funded by DHA.

The DHA LAN/WLAN Modernization program uses this document to provide overarching guidance on all DHA LAN/WLAN modernization projects. The goal of the DHA LAN/WLAN Modernization program is to provide and/or modernize LAN and WLAN infrastructure at DoD MTFs and their associated satellite facilities (on-base/on-post outlying buildings and off-base/off-post remote buildings).

Regarding DoD building classifications, the real property category codes are defined in Unified Facilities Criteria (UFC) 2-000-05N. The first digit identifies the facility class. Category code 500-series buildings are classified as medical care facilities and will be controlled and maintained by the MTF facility management office.

LAN and WLAN infrastructure is required for medical, dental, and veterinary treatment facilities;

laboratories; education and training facilities; administrative facilities; and others under the purview of DHA. If the electronics are on the medical network and support the medical mission, LAN electronic upgrades will be performed in category code 500 buildings and non-category 500 buildings. LAN cable plant and/or WLAN upgrades only will be performed in non-category 500 buildings if needed to support the medical mission, if coordinated with the appropriate building owner [e.g., Department of Public Works (DPW), Base Civil Engineering (CE), etc.], and if approved by the DHA LAN/WLAN Modernization Government Task Manager.

1.3 Audience

This document is intended for DHA program directors, government task managers, technical project managers, network engineers, security engineers, LAN/WLAN deployment teams, LAN/WLAN operations and sustainment teams, contracting office representatives, MTF chief information officers, and MTF information management/information technology administrators. The technical requirements and

December 19, 2018 2 guidance presented in this document presumes Tier 2- and Tier 3-level knowledge of LAN/WLAN design, deployment, and operations.

1.4 Point of Contact

The point of contact for this project documentation and guidance is the Office of the Chief Technology Officer (OCTO), AACE Division, DAD IO/J-6 Directorate, DHA.

Distribution group email: DHA.LAN-WLAN.DepMgt@mail.mil mailto:DHA.LAN-WLAN.DepMgt@mail.mil

December 19, 2018 3

2 General Guidance and Project Standards This section provides general guidance and project standards for LAN/WLAN modernization.

2.1 Mandatory Requirements and Guidelines

Line items that utilize the words must, shall, or will are mandatory requirements and must be followed.

No deviation is permitted without prior approval from the DHA LAN/WLAN Modernization Government Task Manager.

2.2 Recommended Requirements and Guidelines

Line items that utilize the words could, should, or may are preferred or recommended guidelines. When conditions or circumstances prevent implementation of these recommendations, deviation may occur at the discretion of the Integrator Government Project Engineer or DHA LAN/WLAN Modernization Government Task Manager.

NOTE: Exceptions to requirements and guidelines set forth in this document shall be brought to the attention of the DHA LAN/WLAN Modernization Government Task Manager. Site-specific requirements and preferences also shall be considered for all identified and DHA-approved activities.

2.3 Project Standards

The DHA LAN/WLAN Modernization Technical Requirements and Guidance document is the principal guidance document for the DHA LAN/WLAN Modernization program and is used to control scope and implementation authority for all DHA LAN and WLAN upgrades at DoD MTFs.

Documentation, such as industry best practices, regulations, directives, and/or mandates, provide underlying guidance and support for this document, but do not supersede the direction provided in this document without first seeking clarification from the Integrator Government Project Engineer or DHA LAN/WLAN Modernization Government Task Manager.

NOTE: Due to the ever-changing nature of IT and IT documentation, undated references presume that the most current versions of references are used by document originators and intended users.

The DHA LAN/WLAN Modernization program will work to comply with the following Government and commercial standards organizations.

American National Standards Institute (ANSI) Building Industry Consulting Service International (BICSI) Committee on National Security Systems (CNSS) Defense Information Systems Agency (DISA) Department of Defense (DoD) Federal Information Processing Standards (FIPS) Institute of Electrical and Electronics Engineers (IEEE) International Organization for Standardization (ISO) National Electric Code (NEC) National Fire Protection Association (NFPA) National Institute of Standards and Technology (NIST) National Security Agency (NSA) Telecommunications Industry Association (TIA) Underwriters Laboratories (UL) Unified Facilities Criteria (UFC)

December 19, 2018 4

Unified Facilities Guide Specifications (UFGS)

The DHA LAN/WLAN network electronics infrastructure will comply and adhere to the following standards.

CNSS Advisory Memorandum TEMPEST/1-13 – Red/Black Installation Guidance DoD Instruction 8500.1 Information Assurance (IA) DoD Instruction 8500.2 IA Implementation DoD Internet Protocol (IP) version 6 (IPv6) Policy DISA Joint Interoperability Test Center (JITC) Approved Product List (APL) DISA Security Technical Implementation Guide (STIG) IEEE 802.1 – LAN/Metropolitan Area Network (MAN) Bridging and Management Standards IEEE 802.3 – Carrier Sense Multiple Access / Collision Detection (CSMA/CD) Standards IEEE 802.11 – Wireless Standards NIST FIPS 140-2 – Security Requirements for Cryptographic Modules

The DHA LAN/WLAN cable plant infrastructure will comply and adhere to the following standards.

ANSI/TIA-568-D – Telecommunications Cabling ANSI/TIA-569-D – Telecommunications Rooms and Pathways ANSI/TIA-606-C – Telecommunications Infrastructure Administration NFPA 70 – National Electric Code (NEC) NFPA 75 – Protection of IT Equipment NFPA 76 – Fire Protection of Telecommunications Facilities NFPA 99 – Standard for Health Care Facilities NFPA 101 – Life Safety Code TIA-607-C – Telecommunications Bonding and Grounding

The DHA LAN/WLAN program will work to follow the UFC standards when supporting health facility new construction / renovation projects.

UFC 1-200-01 – General Building Requirements UFC 2-000-05N – Facility Planning Criteria UFC 3-501-01 – Electrical Engineering UFC 3-580-01 – Design: Telecommunication Building Cabling Systems UFC 3-600-01 – Fire Protection Engineering for Facilities UFC 4-510-01 – Design: Military Medical Facilities UFGS 27-20-00 – Communications: Building Telecommunications Cabling System UFGS 33-82-00 – Utilities: Telecommunications Outside Plant (OSP)

NOTE: UFC/UFGS standards are prescribed by MIL-STD-3007F for all DoD agencies to provide planning, design, construction, sustainment, restoration, and modernization criteria for new construction and major facility renovations within the DoD. To date, UFC and UFGS have not been fully adopted by the DHA LAN/WLAN Modernization program because the program focuses on retrofit LAN/WLAN infrastructure within existing production facilities without the benefit of major construction projects that renovate and/or replace existing facilities with new facilities. The DHA LAN/WLAN Modernization program will comply with UFC/UFGS guidance to the extent possible, while minding cost driver constraints associated with retrofitting production facilities, which are subject to the approval of the DHA LAN/WLAN Modernization Government Task Manager. The DHA LAN/WLAN Modernization program will comply with the UFC and UFGS standards when supporting LAN/WLAN initial outfitting for military construction/sustainment, restoration, and modernization (MILCON/SRM) projects for renovated facilities and/or new facilities.

December 19, 2018 5

3 LAN Modernization This section provides requirements, cable plant survey and design guidance, and electronics survey and design guidance for LAN modernization.

3.1 LAN Requirements

The intent of DHA LAN Modernization projects is to survey all facilities that fall within the control of the MTF and evaluate them against DHA LAN standards for design and upgrade deployment activities.

Table 1: LAN Requirements

NUMBER REQUIREMENT

F-01 Minimum dual core switches shall be required for all MTFs. In general, small MTFs shall use small form factor stackable switches; whereas, large MTFs shall use chassis-based switches.

F-02 Core switch functions shall require Layer 2 and Layer 3 redundancy.

F-03 Minimum dual 10-Gigabit Ethernet (10GigE) trunks shall be required in full mesh between all core switches.

F-04 Minimum dual 10GigE backbone should be required from core switches to distribution switches, server farm switches, main hospital/clinic SEA/TR, larger outbuilding (super clinic) SEA/TR, and other high bandwidth SEA/TR when feasible.

F-05 One hundred percent (100%) GigE shall be required at the desk-10/100/1000BaseT ports.

F-06 All edge switches shall support 802.3at power over Ethernet plus (PoE+).

F-07 Thirty percent (30%) port growth shall be required for 10/100/1000BaseT ports. (+ or - 5%).

F-08 LAN electronics equipment configurations should comply with applicable DISA STIGs.

F-09 Project team should replace LAN electronic components declared to be end-of-support by manufacturer within 36 months of planned installation.

F-10 DHA will support multiple LAN original equipment manufacturers (OEMs) across the enterprise, but each site LAN solution shall be a single homogeneous OEM solution to support seamless interoperability and more efficient network management for the site.

NOTE: LAN electronics equipment should be a single OEM vendor by site, and WLAN electronics equipment should be a single OEM vendor by site; however, this does not imply LAN and WLAN electronics are the same OEM vendor.

3.2 LAN Cable Plant Survey and Design Guidance

The goal is to maximize reuse of existing cable plant components and focus on upgrading cable plant infrastructure and communication rooms where significant deficiencies exist. All cable plant upgrades will be tactical and measured based upon survey findings and requirements. There will be no full cable plant upgrades/replacements or efforts made solely for cosmetic cleanup.

3.2.1 Computer Room/Satellite Equipment Area/Telecommunications Rooms

3.2.1.1 Functional Area/Coverage Zones

The computer room (CMR) and satellite equipment area (SEA) communications rooms [also known as Telecommunications Rooms (TRs)]) will be surveyed in all buildings supporting the MTF healthcare delivery mission.

The functional areas supported by each CMR/SEA communications room will be documented in the Site Implementation Plan (SIP).

December 19, 2018 6

The horizontal coverage areas / zones supported by each CMR/SEA communications room will be documented on building floor plans in the SIP drawing package.

3.2.1.2 Physical Safety and Security

The LAN/WLAN Deployment Team will perform a physical inspection of the CMR/SEA/TR communications rooms against American National Standards Institute (ANSI) / Telecommunications Industry Association (TIA)-569-D and TIA-607-C standards with an emphasis on addressing physical safety and security in accordance with NFPA 70, or when directed by facility safety officer or local building code.

The LAN/WLAN Deployment Team will coordinate with the site and perform the following CMR/SEA upgrades to meet DHA safety and security standards.

1. Equipment Room or Cabinet Security: Secure network equipment in CMR/SEA/TR lockable rooms or in an enclosed lockable cabinet if in a common access area.

2. Equipment Rack and Cabinet Stability: Stabilize and bolt all racks and cabinets. Floor-mounted racks shall be secured with ladder rack.

3. Grounding and Bonding: Survey all CMR/SEA/TR communications rooms for proper grounding and bonding. Ensure that all CMR/SEA cabinets, equipment racks, ladder rack, cable trays, and/or backbone conduits are properly bonded to the CMR/SEA primary bonding busbar (PBB) or secondary bonding busbar (SBB) with minimum #6 American wire gage (AWG) size ground wire and are properly labeled. Ensure that each LAN/WLAN electronics component with a ground point [e.g., routers, switches, wireless controllers, terminal servers, and Uninterruptable Power Supply (UPS) equipment] is individually bonded to the nearest rack bonding busbar (RBB) in the same equipment rack with minimum #12 AWG size ground wire and is properly labeled. Grounding and bonding will meet requirements set forth in TIA-607-C or the most current standard. Ensure that there is compliance with NFPA 70 for grounding and bonding requirements. Provide a telecommunications bonding and grounding system in accordance with TIA-607-C, DoD MIL-STD-188-12B, and MIL- HDBK-419A Grounding, Bonding, and Shielding for Electronic Equipment and Facilities.

4. Firestopping: Survey all CMR/SEA/TR communications rooms for proper firestopping, taking into consideration any site specific criteria or requirements. Ensure that all network data system-related cable plant firewall penetrations within the CMR/SEAs are properly firestopped using UL-approved firestopping systems. New firestop penetrations will be labeled on both sides in accordance with ANSI/TIA-606-C. Also, firestop system installed and tested in accordance ASTM E 814 or UL 1479.

Existing firestop penetrations will not be considered deficient due to the lack of labels alone. Do not relabel an existing firewall penetration unless new cables are installed through or old cables abated from the penetration and/or the firewall penetration is repaired to bring it back into compliance. Cable plant firewall penetrations supporting other systems (telephone, fire alarm, security, nurse call, etc.)

will not be modified, but any deficiencies should be reported to the site facilities management office for their attention.

3.2.2 Vertical Cable Plant

3.2.2.1 Requirements

Table 2: Vertical Cable Plant Technical Requirements (Functional and Non-Functional)

NUMBER REQUIREMENT

NF-01 Performance: Backbone fiber will support 10GigE. Depending upon the quality of fiber and type of optics, backbone OM3 50 micron multimode fiber (MMF) will support 10GigE up to 200-to-300 meters (m) and backbone single mode fiber (SMF) will support 10GigE up to 10–to-40 kilometers (km).

December 19, 2018 7

NUMBER REQUIREMENT

NF-02 Density: All SEA/TR communications rooms with inside plant backbone connectivity will have a minimum of 12 strands of SMF.

NF-03 Density Enhancement: All new inside plant data backbone fiber shall be SMF unless there is a unique requirement or design benefit to match existing MMF. Add new SMF to SEAs if existing fiber infrastructure will not support 10GigE performance requirement to LAN core. Increase fiber strand counts in SEAs if there is a verifiable requirement for additional backbone connectivity and/or cross-connects. Where possible, SEA communications rooms with only outside plant backbone connectivity will have 12 strands of SMF.

NF-04 Standards: Backbone fiber shall be installed and certified per ANSI/TIA-568.3--D Optical Fiber Cabling and Components standards.

3.2.2.2 Survey and Design

Measured Upgrade: DHA supports measured upgrades of existing backbone fiber based upon performance and density assessments.

Performance Assessment: DHA will perform a physical and functional inspection of the existing fiber trunks. The physical inspection will check the condition of the existing vertical cable plant installation (cable terminations, pathways, cable support, support, labeling, etc.) against ANSI/TIA-568-3-D, 569-D and 606-C standards, and the functional inspection will test fiber strands planned for use against ANSI/TIA-568-3-D standards. Clean the inside plant fiber connectors and launch cable fiber connectors prior to testing.

Test 100% of the fiber, not in use, that is anticipated for use in the LAN upgrade design.

− MMF and SMF strands will be tested per attenuation test methods identified in ANSI/TIA-568-

3-D. Test existing MMF only if there is a unique requirement.

− Passed fiber strands identified for use in new LAN upgrade design should be labeled for future use.

− Any failed fiber will be marked and labeled as bad.

Include all test results in the SIP. The test results should be provided in the original test equipment native file format (e.g., Fluke LinkWare .flw file) and in a common readable file format (e.g., Adobe Acrobat .pdf file or Microsoft Word .docx file).

Density Assessment: DHA will assess backbone fiber density based upon Military Health System (MHS) application requirements and site-specific requirements to support mission needs.

Inside Plant Backbone: All SEA communications rooms with inside plant backbone connectivity will have a minimum of 12 strands of SMF. If new fiber trunks are needed, DHA will install SMF.

NOTE: The number of backbone fiber strands will be increased as needed if the SEA supports additional distribution requirements (e.g., fiber cross-connects for other SEAs) or large access requirements (e.g., multiple switch uplinks).

Outside Plant Backbone: Where possible, SEA communications rooms with only outside plant backbone connectivity will have 12 strands of SMF. The DHA generally does not install outside plant fiber and will defer to the local line communications agency for this requirement.

Repair Fiber: If possible during the install, bad fiber strands identified and marked during the survey will be cleaned/repaired. Any fiber strands that cannot be repaired will remain marked as bad.

New Fiber: New fiber trunks will be specified based upon assessment of current backbone fiber infrastructure and site requirements. In general, larger medical centers and hospital buildings will be prioritized for SMF backbone trunks to support 10GigE backbone connectivity over longer distances. The intent is to address inside plant backbone fiber infrastructure for buildings with multiple SEAs (collapsing to a CMR or distribution SEA) and not for buildings with a single SEA supported by outside plant connectivity.

December 19, 2018 8

New Fiber Cable: New fiber trunks shall be plenum-rated armored SMF with a minimum of 12 strands.

All new SMF will be terminated with SC connectors using fusion splicing methods.

NOTE: Small form factor LC connectors can be used for new construction, major renovations, or large cable plant replacements per UFC 3-580-01 to support smaller fiber cabinets and greater density.

3.2.3 Horizontal Cable Plant

3.2.3.1 Requirements

Table 3: Horizontal Cable Plant Technical Requirements

NUMBER REQUIREMENT

NF-04 Performance: Horizontal drops shall support GigE to the desk. Therefore, drops must meet Category 5e (Cat5e) or Category 6 (Cat6) performance standards. Reuse Cat5 and Cat5e drops that meet Cat5e performance standards and Cat6 drops that meet Cat6 performance standards.

NF-05 Coverage: Horizontal drops will be installed in functional areas as needed to support the MHS and MTF healthcare delivery mission.

NF-06 Standards: Horizontal drops will be installed and certified per ANSI/TIA-568-D standards. New horizontal drops will be Cat6.

3.2.3.2 Survey and Design

Measured Upgrade: DHA supports measured upgrades of existing horizontal drops based upon performance and coverage assessments.

Performance Assessment: DHA will perform a physical and functional inspection of the existing copper drops. The physical inspection will check the condition of the existing horizontal cable plant installation (cable terminations, pathways, cable support, labeling, etc. against ANSI/TIA-568-D, -569-D, and -606-C standards), and the functional inspection will perform random testing of approximately 10% of existing drops against ANSI/TIA-568-D standards.

1. Depending upon the condition and age of the horizontal cable plant and input from the site, the Integrator Government Project Engineer may increase the amount of random testing (especially for older Cat5 drops) and/or reduce the amount of random testing (especially for Cat5e and Cat6 drops).

2. In general, if functional testing is performed, 10% of all ≥Cat5 copper drop cables terminated in the patch panels will be randomly tested per the DHA outlined testing process. If 25% or greater fail, then 100% testing will be performed on all unused cable drops.

3. Test only unused cable drops. If cable drops are difficult to reach or difficult to find due to poor labeling, use minimal effort to find them. The onsite Integrator Government Project Engineer and/or survey team lead must determine the amount of time required to locate cables.

4. Cat5 and Cat5e drops will be tested to Cat5e performance standards per ANSI/TIA-568-D. Cat6 drops will be tested to Cat6 performance standards per ANSI/TIA-568-D.

5. Per ANSI/TIA-568-D, both Permanent Link and Channel testing methods can be used to perform the Cat5e or Cat6 tests. The DHA preference is to perform Channel tests on existing copper drops during the survey phase.

6. Include all test results in the SIP. The test results should be provided in the original test equipment native file format (e.g., Fluke LinkWare .flw file) and in a common readable file format (e.g., Adobe Acrobat .pdf file or Microsoft Word .docx file).

Coverage Assessment – DHA will assess horizontal drop coverage based upon MHS application requirements and site-specific requirements to support mission needs.

December 19, 2018 9

Unclassified/FOUO

1. Electronic Health Record (EHR) Systems – Drops will be provided as needed to support end users who provide patient care and who use the MHS EHR systems, such as Composite Health Care System, AHLTA, Essentris, or GENESIS.

2. Eliminate Small Switches/Hubs – Drops will be provided as needed to eliminate small switches or hubs installed at end user locations due to shortage of cable drops. These small switches and hubs generally are not manageable and violate DoD and Service IA policies.

3. Eliminate Long Patch Cords – Drops will be provided as needed to eliminate excessively long end-user patch cords that are strung up over walls, through ceiling spaces, and/or between rooms.

4. Site Requests – Specific site requests for new drops will be addressed to support new areas and/or renovated areas that support new mission requirements. These areas must be clearly identified by the site and approved by the DHA. Refer to the DHA Drop Placement.

5. Repair Drops – If failure rates exceed 25%, existing drops will be repaired. Drops that fail testing during the survey should be marked bad and will remain marked bad if they cannot be repaired after the upgrade.

6. Replace Drops – Existing drops will be replaced based upon both a negative physical inspection that does not recommend repairing the old horizontal cable plant and upon functional inspection results with failure rates that exceed 50%. Replacing some or all of the existing drops with new drops will be based upon an engineering judgment that is approved by the DHA.

7. New Drops – All new LAN drops will be triple drops and each drop location will be installed within six feet of existing electrical receptacles in a useable location (i.e., use common sense in terms of usable locations, but, for example, not by sinks, behind refrigerators, in restrooms, etc.). DHA may pull quad drops or larger drop configurations instead of triple drops when density criteria dictate. If there is a unique dispersion requirement, DHA also could pull a larger quantity of dual drops instead of triple drops; however, no single drops should be pulled.

8. New unshielded twisted pair (UTP) Cable – Plenum-rated Cat6 cable is required.

9. Patch Panels – The patch panel rating should match the copper cable rating (i.e., all copper cable drop components should have matching category ratings/specifications end-to-end). For example, do not terminate Cat6 cable to a Cat5 non-modular patch panel. Where possible, use existing modular patch panels and Cat6 modular jacks. This scenario will allow a mix of variously rated cables within the same patch panel. These Cat6 jacks will be a specific color to separate them from lower-rated cable in the patch panel. All newly purchased patch panels will be Cat6. The preference is to design with 24- or 48-port patch panels; the use of 96-port patch panels only will be considered for approval when there are space issues or site specific requests.

10. Cable Pathways/Penetrations – Where possible, reuse existing penetrations; however, do not use an existing penetration if the existing firestop system is not understood or cannot be brought up to code.

Report these situations to the Integrator Government Project Engineer and local site facilities office, and include these situations in the daily report.

See PDF Workbook, Attachment 1: DHA LAN Drop Guidelines in Appendix A References.

3.2.4 Cable Abatement/Removal

1. In general, cable abatement is a site facility responsibility. The DHA will not perform cable removal unless it is needed to support clearing pathway for new cable bundles. If cable removal is required in order to install new cable, then explain why cable abatement/removal is necessary.

2. Address how, when, and who is responsible for cable abatement.

3. Include cable removal plans in the SIP and indicate how it shall be done.

4. Indicate how many firestops shall need to be broken and resealed to remove the cable.

December 19, 2018 10

5. Determine and annotate how the cable shall be disposed. Coordinate with site and obtain concurrence of plan.

6. Identify known and possible abatement issues and obtain consensus from site on the plan to address issues such as painting, repairs, and firestopping.

3.3 LAN Electronics Survey and Design Guidance

DHA will perform a technical refresh of the network electronics to support current and projected connectivity, IA, and data sharing requirements for MHS application and site-specific requirements to support mission needs.

3.3.1 Core/Distribution Switches

3.3.1.1 Requirements

Table 4: Core/Distribution Switch Technical Requirements

NUMBER REQUIREMENT

NF-07 Architecture

1. Redundant core switches shall be required for all MTFs. See DHA Core Redundancy Guidance.

2. Minimum dual core switches shall be required for all MTFs. Use small form factor stackable switches for smaller MTFs and chassis-based switches for larger MTFs. The threshold between smaller and larger MTFs is subjective, but generally is based upon the number of uplinks [top-level architecture (TLAs), SEAs, servers, etc.] that are required for sufficient growth. DHA recommends that the chassis solution provide more than 36 paired uplinks to meet requirements.

3. Additional core switches and/or distribution switches may be specified as needed to support backbone connectivity for large medical campuses, large hospitals, and medical centers.

4. Diversely-located core switches for large medical campuses, large hospitals, and medical centers are recommended.

5. Server connectivity shall be provided by the core switch(es) and/or additional server farm switch(es) based upon server locations and as needed to maintain redundancy, minimize components, and optimize throughput.

6. Due to diversely-located core switches and to support redundant server connectivity, separate server farm switch(es) must be specified in server rooms without core switches and in server rooms with a single core switch..

7. If needed to separate large number of SEA/TR fiber uplinks and a large number of server fiber/copper connections to support effective cable management and maintenance functions, separate server farm switch(es) may be specified.

NF-08 Core Switches Performance

1. Layer 2 / Layer 3 Chassis Switches.

2. Layer 2 / Layer 3 Stackable Switches shall be allowed at smaller MTFs or Remote sites with a minimum of 2 stackable switches for redundancy.

3. Redundant Management Functions shall be provided on each chassis core switch or between stackable core switches.

4. Redundant Switch Fabrics shall be provided on each chassis core switch or between stackable core switches using bi-directional stacking cables or redundant trunks.

December 19, 2018 11

5. Redundant N+1 Power Supplies shall be provided on each chassis core switch and on each stackable core switch.

6. There shall be Minimum Dual 10GigE connectivity between all core switches (full mesh) with 10GigE or greater connections split between different cards on chassis-based core switches.

7. Minimum 10/100/1000BaseT on all copper line cards (if required).

8. The system shall provide a minimum of 4 spare 10GigE ports on each core switch to support growth (do not provide 10GigE optics).

NF-09 Distribution Switches Performance

1. Layer 2 Chassis Switches or Stackable Switches (include Layer 3 only if needed to support unique site requirements).

2. Minimum two (2) Stackable Switches at any Distribution location to support Redundancy.

3. Redundant Management Functions (on each chassis distribution switch or between stackable distribution switches).

4. Redundant Switch Fabrics (on each chassis distribution switch or between stackable distribution switches using bi-directional stacking cables or redundant trunks).

5. Redundant N+1 Power Supplies (on each chassis distribution switch and on each stackable distribution switch).

6. Redundant 10GigE uplinks to core switches with the uplink connections split between different 10GigE modules/line cards for diversity.

7. Provide minimum 4 spare 10GigE ports and/or 1GigE ports on each distribution switch to support growth (do not provide 10GigE or 1GigE optics).

NF-10 Server Farm Performance

1. Layer 2 Chassis Switches or Stackable Switches (include Layer 3 only if needed to support unique site requirements).

2. Redundant Management Functions (on each chassis server farm switch or between stackable server farm switches – exception for end-of-row or top-of-cabinet stackable server farm switches).

3. Redundant Switch Fabrics or Backplanes (on each chassis server farm switch or between stackable server farm switches using bi-directional stacking cables – exception for end-of-row or top-of-cabinet stackable server farm switches).

4. Redundant N+1 Power Supplies (on each chassis server farm switch and on each stackable server farm switch).

5. Redundant 10GigE uplinks to core switches with the uplink connections split between different 10GigE modules/line cards for diversity.

6. Minimum 10/100/1000BaseT on all copper line cards with up to 30% port growth allowance (+/- 5%).

NF-11 Standards (Core / Distribution / Server Farm)

1. Defense Information Systems Agency (DISA) Unified Capabilities (UC) Approved Product List (APL).

2. DISA Security Technical Implementation Guides (STIGs).

3. Internet Protocol version 6 (IPv6) capable.

December 19, 2018 12

4. IEEE 802.1D Spanning Tree and IEEE 802.1w Rapid Spanning Tree.

5. IEEE 802.1Q Virtual LAN (VLAN) Trunking.

6. IEEE 802.1X Port-Based Access Control.

7. Core – Layer 3 Interior Gateway Routing Protocols.

8. Distribution/Server Farm (if needed) – Layer 3 Interior Gateway Routing Protocols.

3.3.1.2 Survey and Design

1. Survey LAN core/distribution/server farm switches to determine if they meet DHA LAN core architecture standards. See attached DHA Core Redundancy Guidance document for further details on the DHA LAN core topologies and approved redundancy architectures.

2. Survey LAN core/distribution/server farm connections and document link speeds and interconnectivity to TLA equipment and SEA access/edge switches to validate the accuracy of the interconnect drawings. There will be no network disruption while validating the interconnect drawings. If available, use site resources to assist. Provide updates to the interconnect drawings in the SIP design package submittal.

3. Collect configuration files and settings on LAN core/distribution/server farm switches. A list of recommended command scripts for each LAN equipment vendor is provided in Appendix E Network Configuration Files. Prior to connecting and logging in to any network switches, coordinate with the MTF IM/IT systems staff and/or appropriate network management authority. If available, use site resources to assist.

4. Using physical interconnection notes and network configuration files, report on LAN logical network configuration in the SIP. Call attention to any architecture deficiencies or other configuration items that could cause a problem during the installation phase. On a case-by-case basis, identify solutions to major deficiencies in the SIP that must be included in the upgrade effort.

5. Gather and analyze network performance metrics. Prior to performing tests requiring network connection, coordinate with the MTF IM/IT systems staff and/or appropriate network management authority. If available, use site resources to assist. Collect and report findings in the SIP package on the following items.

Internet Protocol (IP) scheme and Virtual LAN (VLAN) structure.

DHCP settings and scopes.

Spanning tree settings to include Spanning Tree Protocol (STP), Rapid STP (RSTP), Per-VLAN, Portfast, etc.

Login authentication settings and port security settings.

Network configuration/performance concerns and recommendations.

6. Check LAN core/distribution/server farm switches to make sure end-of-life (EOL) components are not end-of-support (EOS) within 36 months of the planned installation date. When evaluating EOS dates, account for both end-of-software/IA-vulnerability support and end-of-hardware-support dates. Use the earlier of the two dates to determine the EOS date.

7. If any part of the MTF LAN core/distribution/server farm switch gear is found to be substandard or EOL/EOS, provide recommended upgrade solution in the design that is needed to meet MHS standards.

8. Ensure that each LAN/WLAN-related electronic component with a ground point (e.g., routers, switches, wireless controllers, terminal servers, UPS equipment, etc.) in each CMR/SEA

December 19, 2018 13

Unclassified/FOUO communications room is individually bonded to the nearest RBB in the same equipment rack with minimum #12 AWG size ground wire and is labeled properly.

See PDF Workbook, Attachment 2: DHA LAN Core Redundancies in Appendix A References.

3.3.2 Access/Edge Switches

3.3.2.1 Requirements

Table 5: Access/Edge Switch Technical Requirements

NUMBER REQUIREMENT

NF-12 Architecture

1. Stackable switches are the preferred solution for access/edge switches due to flexibility, scalability, and cost benefits.

2. If more cost-effective to upgrade versus replace with stackable switches, legacy chassis switches used as access/edge switches shall be supported.

3. If needed to support hitless software upgrades in critical care patient areas that need near 100% uptime, new chassis switches with redundant management and switch fabric modules may be used.

4. SEA/TR access/edge switches in main hospital/clinic building shall be dual-homed to separate MTF core switches using 10GigE uplinks.

5. SEA/TR access/edge switches in nearby outbuildings shall be dual-homed to separate MTF core switches using minimum 1GigE uplinks.

6. If justified for high-bandwidth applications and/or users and if approved by DHA, SEA/TR access/edge switch uplinks in outbuildings shall be upgraded to 10GigE.

7. To maximize performance and redundancy, SEA/TR access/edge switches in remote outbuildings shall utilize the most cost effective and best available connectivity back to the MTF core/distribution switches.

Migrate outbuilding connections off-line network electronics to support separating line and medical networks; evaluate designs based on a combination of medical and/or line (base/post) backbone fiber, strategically located medical distribution switches, single strand bi-directional wavelength-division multiplexing (WDM) optics, or any combination of the above connectivity components.

NF-13 Layer 2 Stackable Switches-Performance

1. There shall be a maximum of 5 stackable switches in any stack group unless fiber availability prevents creating more stack groups.

2. There shall be redundant management functions in each stack group of 2 or more stackable switches.

3. There shall be redundant switch backplane in each Stack Group of 2 or more stackable switches.

4. There shall be redundant N+N power supplies in each stackable switch to support a simpler vendor-independent solution and to provide more PoE power with smaller power supplies and reduce depth of PoE+ switches.

5. There shall be a minimum of two 10GigE and/or 1GigE uplinks that are dual homed to separate core switches with uplinks and split between different stackable switches if there are 2 or more in the stack.

6. There shall be a minimum of 10/100/1000BaseT on all copper ports with up to 30% port growth allowance (+/- 5%).

7. There shall be a minimum of 802.3at PoE+ on all copper ports.

December 19, 2018 14

8. Compact switches with 12 or fewer ports can be used in small user office areas or similar small form factor configurations if the compact switches are on the DISA UC APL and meet the same requirements as the larger 24-port and 48-port stackable switches with the exception of field replaceable power supplies or N+N redundant power supplies.

NF-14 Layer2 Chassis Switches-Performance

1. There shall be redundant management functions in each chassis-based switch.

2. There shall be redundant switch backplane in each chassis-based switch.

3. There shall be redundant N+1 power supplies in each chassis-based switch.

4. There shall be a minimum of two 10GigE and/or 1GigE uplinks that are dual homed to separate core switches with uplinks and split between different line cards in the access/edge chassis switch.

5. There shall be a minimum of 10/100/1000BaseT on all copper line cards with a 30% port growth allowance (+/- 5%).

6. There shall be a minimum of 802.3at PoE+ on all copper ports.

NF-15 Standards

1. DISA UC APL

2. DoD STIGs

3. IPv6 Capable

4. IEEE 802.1D Spanning Tree

5. IEEE 802.1w Rapid Spanning Tree

6. IEEE 802.1Q VLAN Trunking

7. IEEE 802.1X Port-Based Access Control

8. IEEE 802.3af PoE

9. IEEE 802.3at PoE+

3.3.2.2 Survey and Design

1. Survey all SEA access/edge switch uplink connections and speeds to validate the accuracy of the interconnect drawings. There will be no network disruption while validating the interconnect drawings.

Use site resources to assist, if available. Provide updates to the interconnect drawings in the SIP design package submittal.

2. Collect configuration files and settings on LAN access/edge switches. A list of recommended command scripts for each LAN equipment vendor is provided in Appendix E Network Configuration Files. Prior to connecting and logging into any network switch, coordinate with the MTF IM/IT systems staff and/or appropriate network management authority. If available, use site resources to assist.

3. If the site requests and it is confirmed by the survey team that a high bandwidth application is supported in a given area, consider upgrading the subject SEA access/edge switch uplink(s) to 10GigE. The upgrade still is subject to approval by DHA on a case-by-case basis.

4. Existing CMR/SEAs will be surveyed to allow up to 30% port growth, plus or minus 5%. At the time of the survey, the target should fall between 25% and 35%. For existing LAN – Link Light/Patch Cord Count/New Devices, use the following procedure to determine ports in use and calculate growth:

December 19, 2018 15

Count the link lights.

Count the patch cords.

Count the number of new APs/AMs being added to the network.

Count the number of devices on any work area switches/hubs being removed.

Count the number of new (not replacement) devices being added.

Use the following Port Count Calculation Formula.

y = (((link lights + patch cords) / 2) + (number of new APs + number of new AMs + number of devices on hubs + number of new devices))*1.3

5. Initial outfitting for new CMR/SEAs will be based upon information collected from the sponsor Health Facilities project office and/or associated MILCON/SRM drawings. The target should provide enough switch ports to support all end-user devices (EUDs), all new WLAN APs/AMs, and up to 30% port growth with a plus or minus growth margin of 5%. Use the following procedure to determine the number of ports for a new CMR/SEA LAN electronics initial outfitting.

EUD count provided by sponsor or 35% count of terminated horizontal cables.

Number of new APs/AMs being installed.

Use one of the following Port Count Calculation Formulas.

y = ((new EUD count) + (number of new APs + new AMs))*1.3 y = ((number of terminated horizontal cables * 0.35) + (new APs + new AMs))*1.3

6. Survey SEA access/edge switches to determine if they meet DHA LAN standards and are not EOS within 36 months of the planned installation date. When evaluating EOS dates, account for both end-of-software/IA-vulnerability support and end-of-hardware support dates. Use the earlier of the two dates to determine the EOS date.

7. If any MTF LAN access/edge switch is found to be substandard or EOL/EOS, provide recommended upgrade solution in the design needed to meet MHS standards.

8. All new access/edge switches will be IPv6 compliant, have 10/100/1000BaseT PoE+ ports, and be capable of GigE or 10GigE uplink ports.

9. In an effort to improve redundancy and diversity, redundant supervisor modules (RSMs) and redundant power supplies (RPSes) will be implemented for edge/access switches.

RSM capability will be required for edge/access switches that support more than 48 copper ports (i.e., two or more line cards and/or stackable switches).

Chassis switches should be configured with RSM (i.e., dual supervisors). If existing chassis switch is not capable of supporting a RSM failover capability, it will be replaced. If more cost-effective, the replacement solution should use stackable switches that support RSM failover.

Stackable switches that support stacking backplane technology will be used to support RSM failover.

RPS capability will be required for all edge/access switches.

Chassis switches should be configured with N+1 RPS. Where possible, the redundant supplies should be plugged into a different UPS and/or power circuit.

Stackable switches should be configured with N+N RPS capability. The RPS capability can be provided by either an internal RPS function (preferred) or an external RPS chassis function.

Where possible, the redundant supplies should be plugged into a different UPS and/or power circuit.

10. Ensure that each LAN/WLAN related electronics component with a ground point (e.g., routers, switches, wireless controllers, terminal servers, UPS equipment, etc.) in each CMR/SEA

December 19, 2018 16 communications room is individually bonded to the nearest RBB in the same…