Enterprise Branch Design

Requirements differ with the size of the branch offices. Consider to the following questions when designing the Enterprise Branch:

■ How many branch locations need to be supported?

■ How many existing devices (including end users, hosts, and network infrastructure) are to be supported at each location? The number of devices supported is limited by the physical number of ports available.

■ How much growth is expected at each location, and therefore what level of scalability is required?

■ What are the high availability requirements at each location?

■ What level of security is required in the design? Should security be managed locally or through the central location?

■ Are there any requirements for local server farms or networks between the internal network and the external network (for example, in a demilitarized zone [DMZ])?

Should network management be supported locally or via the central location?

What wireless services are needed, and how will they be used by the clients? What effect will the network and the environment have on the wireless devices?

KEY POINT

What is the approximate budget available?

Branch offices can be categorized based on the number of users:

■ Small office: Up to 50 users, using a single-tier design

■ Medium office: Between 50 and 100 users, using a dual-tier design

■ Large office: Between 100 and 200 users, using a three-tier design

The number of devices, high availability, scalability, and migration to advanced services requirements also influence the model adopted. The design models for each of these types of branches are described in the following sections.

Each of the designs in the following sections suggests using an ISR (such as the 2800 series routers) at the WAN edge, which provides various voice, security, and data services that are integrated with the LAN infrastructure. Depending on the specific ISR edge router chosen, the interfaces and modules available include the following:

■ Integrated LAN interfaces (10/100/1000 Mbps)

■ High-speed WAN interface card (HWIC) slots

■ Network modules

■ Embedded security

Alternatively, Cisco multiservice routers (such as the 2600 series routers) can be used.

Small Branch Office Design

Small branch office designs combine an ISR access router with Layer 2 switching and end-user devices, phones, printers, and so forth; a typical design is illustrated in Figure 5-25.

Figure 5-25 Typical Small Branch Office Design

Corporate Headquarters

Corporate Headquarters

ISR and Switch Connections

The ISR connects with Layer 2 switch ports in one of the following three ways:

■ Integrated switching within the ISR (or multiservice router): This option has a lower port density that supports from 16 to 48 client devices on either a Cisco EtherSwitch network module or a Cisco EtherSwitch service module. It provides a one-box solution that offers ease of management. Depending on the module, the integrated switch ports might provide power to end devices using Power over Ethernet (PoE).

■ Trunked network interface on the ISR to external access switches: In this case, there is no link redundancy between the access switches and the ISR. The access switches might provide power to end devices using PoE.

■ Logical EtherChannel interface between the ISR and access switches: This approach uses an EtherSwitch module in the ISR configured as an EtherChannel. Link redundancy is provided to the access layer switches over the EtherChannel. The access switches might provide power to end devices using PoE.

If redundant access layer links and higher-bandwidth uplinks are required, only the third option, with higher-performance devices, can be used. The choice of the edge router also depends on the voice and VPN support needed.

The access switch provides Layer 2 services, and the Cisco ISR provides Layer 3 services such as Dynamic Host Configuration Protocol (DHCP), firewall, and Network Address Translation.

The 2811 ISR or larger ISR is suggested. Both the Cisco 2821 and 2851 ISRs support two integrated 10/100/1000 routed (Layer 3) interfaces and have one slot for a network module. The Cisco 2821 ISR supports the 16-port EtherSwitch network module and the 24-port EtherSwitch service module. The Cisco 2851, 3825, and 3845 ISRs can support the high-density 48-port EtherSwitch service module.

Typical access switches include the Cisco Catalyst 2960, 3560, and 3750 Series switches.

To keep manageability simple, the topology has no loops; however, spanning tree must be enabled and configured to protect the network from any accidental loops. As is the case in the Enterprise Campus, the recommended spanning-tree protocol is Rapid Per-VLAN Spanning Tree Plus for all Layer 2 deployments in a branch office environment.

The ISR is the default gateway for each VLAN configured in the topology, and all Layer 3 configurations are done on the ISR. The access switches must be configured with an IP address for management purposes.

WAN Services

WAN services are typically provided by a T1 primary link. The Internet is used as a WAN backup, accessed by an ADSL connection.

Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by a floating static route across the ADSL Internet connection.

QoS mechanisms used include traffic shaping and policing, and the implementation of a scavenger class of traffic (applied on both the switch and the ISR).

QoS Classes

As mentioned in Chapter 4, end-to-end QoS is provided for IP version 4 using Layer 3 QoS marking in the 8-bit Type of Service (ToS) field in the packet header. Originally, only the first 3 bits were used; these bits are called the IP Precedence bits. Because 3 bits can specify only eight marking values, IP precedence does not allow a granular classification of traffic. Thus, more bits are now used: The first 6 bits in the TOS field are now known as the DSCP bits.

Cisco has created a QoS Baseline that provides recommendations to ensure that its products, and the designs and deployments that use them, are consistent in terms of QoS. Although the QoS Baseline document itself is internal to Cisco, it includes an 11-class classification scheme that can be used for enterprises. The classes of traffic in the QoS Baseline are defined as follows:

■ IP Routing class: This class is for IP routing protocol traffic such as EIGRP, OSPF, and so forth.

■ Voice class: This class is for VoIP bearer traffic (the conversation traffic), not for the associated signaling traffic, which would go in the Call Signaling class.

■ Interactive Video class: This class is for IP videoconferencing traffic.

■ Streaming Video class: This class is for either unicast or multicast unidirectional video.

■ Mission-Critical Data class: This class is intended for a subset of the Transactional Data applications that are most significant to the business. The applications in this class are different for every organization.

■ Call Signaling class: This class is intended for voice and video-signaling traffic.

■ Transactional Data class: This class is intended for user-interactive applications such as database access, transactions, and interactive messaging.

■ Network Management class: This class is intended for traffic from network management protocols, such as Simple Network Management Protocol.

■ Bulk Data class: This class is intended for background, noninteractive traffic, such as large file transfers, content distribution, database synchronization, backup operations, and e-mail.

■ Scavenger class: This class is based on an Internet 2 draft that defines a "less-than-Best-Effort" service. If a link becomes congested, this class is dropped the most aggressively. Any nonbusiness-related traffic (for example, downloading music in most organizations) could be put into this class.

■ Best Effort class: This class is the default class. Unless an application has been assigned to another class, it remains in this default class. Most enterprises have hundreds, if not thousands, of applications on their networks; the majority of these applications remain in the Best Effort class.

The QoS Baseline does not mandate that these 11 classes be used; rather, this classification scheme is an example of well-designed traffic classes. Enterprises can have fewer classes, depending on their specific requirements, and can evolve to using more classes as they grow.

Medium Branch Office Design

A typical medium branch office topology, illustrated in Figure 5-26, is similar to the small office topology, except that the WAN edge devices are larger, typically two Cisco 2821 or Cisco 2851 ISRs, and the access switches for LAN connectivity are external stackable switches.

Figure 5-26 Typical Medium Branch Office Design

Branch Office Network Design

ISR and Switch Connections

To scale up to 100 users, the following options are available:

■ Use a higher port density external access switch

■ Use an ISR module that supports switched access ports; use EtherChannel to provide a redundant connection to the access switches

This design uses the integrated 10/100/1000 interfaces on the ISRs as Layer 3 trunks, providing the flexibility to use various access switches. The stackable Cisco Catalyst 3750 Series switch with an IP Base image or an IP Services image can be used as the access switch, supporting 24 or 48 users per switch. The IP Base image feature set includes advanced QoS, rate limiting, ACLs, and basic static and RIP routing capability. The IP Services image provides a richer set of enterprise-class features, including advanced hardware-based IP unicast and multicast routing. An additional Advanced IP Services license is also available (for example, this license is required for IPv6 routing).

With Cisco StackWise technology, a single 32-Gbps switching unit can be created, using up to nine Cisco Catalyst 3750 Series switches. Cisco StackWise technology uses special stack-interconnect cables and stacking software. The stack behaves as a single switching unit that is managed by a master switch elected from one of the member switches. The master switch automatically creates and updates all the switching and optional routing tables. The number of PoE ports supported depends on the specific access switch selected.

WAN Services

WAN services are typically provided by a private WAN—for example, with dual Frame Relay links.

Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by dual routers running router redundancy protocols such as Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), and Gateway Load-Balancing Protocol (GLBP) (as described in Chapter 4). QoS mechanisms used include traffic shaping and policing, and the implementation of a scavenger class of traffic (applied on both the switch and the ISR).

Large Branch Office Design

In a typical large branch office design, illustrated in Figure 5-27, dual ISRs are used for redundancy at the WAN edge. Firewall functionality is provided by dual adaptive security appliances (ASA), and dual multilayer switches (stackable or modular) are deployed at the distribution layer.

Figure 5-27 Typical Large Branch Office Design

Corporate Headquarters r- —

(Corporate Resources __ Located in Headquarters) * *

Distribution L

(Corporate Resources __ Located in Headquarters) * *

Insinkerator Hot Water Dispenser Parts

ISR and Switch Connections

In addition to supporting more users, a large office might need higher LAN switching capability if supporting a server farm or DMZ. Support for some of these services requires the use of appliance devices if higher throughput is required. To meet these requirements, a distribution layer is added to the topology by introducing a multilayer switch that provides the required LAN switching capabilities, port density, and flexibility to support additional appliances.

Either a stackable switch (for example, a Cisco Catalyst 3750 Series switch) or a Cisco Catalyst 4500 Series switch could be used at the distribution layer. This LAN topology is highly available, scalable, and manageable. High-availability requirements are met by the link redundancy and device redundancy built into the design. For example, redundant links are used to provide high availability between the distribution and edge layers.

The port density of the stacked switches allows a number of access switches to be connected without compromising high availability. The distribution switches typically run the advanced IOS images, which support more features, including various routing protocols and advanced features such as policy-based routing.

If Cisco Catalyst 3560 or 3750 Series switches are used at the access layer, other Layer 2 security features, such as DHCP snooping, Dynamic Address Resolution Protocol (ARP) Inspection (DAI), and IP Source Guard, can be enabled, providing additional security measures.

The default gateways for all the VLANs at the access layer are on the distribution layer. WAN Services

WAN services in this typical design are provided by an MPLS network with dual connections. Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by dual routers running router redundancy protocols (such as HSRP, VRRP, and GLBP), ASA failover functionality, and object tracking.

QoS mechanisms used include traffic shaping and policing, and the implementation of a scavenger class of traffic (applied on both the switch and the ISR).

Was this article helpful?

+2 -2

Post a comment