Designing an Enterprise Network for Blupa Healthcare Ltd

Design Specification Overview:

I have been asked to design an enterprise network for Blupa Health care Ltd. Blupa Health care Ltd has three geographically distant sites. The main administrative center is in London while the two hospitals are located in Manchester and Glasgow. The Manchester and Glasgow sites have been connected to London by leased lines. All medical records, web pages and e-mail are stored on a central server located at London.

The London building has three floors, each with its own switched-Ethernet LAN, each of which is connected to a common ATM backbone The Management suite, the Accounts department and the Advertising teams are each housed on a separate floor. Management (the top floor) is divided into a dozen offices. Accounts have 50 administrative staff, while the Advertising team is 120 strong. Each of these employees has a PC.

The Manchester hospital has a small Administration building with 40 PCs, each used by an administrator. Forty more PCs or other networked medical devices are used by the doctors and nurses spread between two similar-sized wards. The small Glasgow hospital is located in a single building. It employs 20 people, each with their own PC.

Proposed Solution:

This Case study Report will provide direction for logical network representations, equipment representation, connection representation, overall drawing format, cable identification and labels.

Before designing the network, the Network architecture must be considered

I must consider the design of my network before determining which class of routers or switches are needed, where those devices should be placed in relation to each other, and what functionality is required. The following information is required from the network design before choosing the router and switch classes:

1. How many devices are currently present on the network, how many need connectivity now, and what is the estimated future growth?

2. Which devices need to communicate with which other?

3. Where is switching (versus routing) required in the network design?

4. Whether virtual local area networks (VLANs) are required and how many, which hosts will be on each VLAN, and whether any routing will be performed between VLANs?

Network Design:

There are many organizational structures, and many ways of designing network architecture around them. However for my assignment I have chosen to use two different models which will form the basis of my design. They are the multilevel switching architecture, for use at the London based head office, and the small branch office architecture used for Glasgow and Manchester.

Blupa Health care Ltd plans to install a network consisting of Ethernet LAN’s, VLANs, Routers, Switches, ATM backbone, and Category 5 Unshielded Twisted Pair Cable (UTP). To support network connectivity in the future, all new horizontal cabling will be Category 5 UTP or above. Vertical cabling will be accomplished using Fast Ethernet cable that meets each individual build-out requirement.

For this project I have chosen to use star topology within the buildings, this network design features a central connection point called a "Switch" that may be a hub, or router. Devices typically connect to the hub with Unshielded Twisted Pair (UTP) Ethernet. Compared to the bus topology, a star network generally requires more cable, but a failure in any star network cable will only take down one computer's network access and not the entire LAN. (If the switch fails, however, the entire network also fails.)

The Technology used for cabling and switching is called as Ethernet Switching, Ethernet uses a carrier-sense multiple access with collision-detection (CSMA/CD) network access method. With this method, any workstation that wants to access the network must listen for traffic before transmitting. (Listening for network activity is the carrier-sense aspect.) If there’s no traffic, transmission can begin. The Workstation must immediately check to see if there has been a collision due to another workstation sending data at the same time (the collision detection aspect). If there is a collision, the workstation stops, waits a random amount of time, and transmits again.

London Head office: Blupa Healthcare Ltd [Largest network in the design]

For the London Office, I have come up with two alternate designs, a convectional network, and a network that incorporates VLANs.

The basic network design remains the same as the required specification, the Topology may look like a Bus network, but it is indeed a Star network connected to switches, they all use 100 baseT Ethernet cabling. The switches used are Class 3 - Midrange Switches, They provide a higher level of management capability, redundancy, and resilience. All the Internal Routers are Class 3 - Low-end Flexible Routers, these routers provide capabilities similar to low-end fixed routers but have upgradeable hardware which allows for growth as an organization's requirements change. The WAN access routers are Class 4 - Mid Range Routers, these routers allow different types of WAN connectivity or multiple WAN ports and, if there are built-in Ethernet hubs or switches, additional local devices can be connected. Network printers have been included as a part of the design process, keeping in mind that they are also a part of the network.

In addition to this, as required by the project specification I have installed a File server, E-Mail server, Database server, Web server with a firewall linked to the WAN Access router using a switch, this enables the Manchester and Scotland branch’s to access the resources within the London branch, back up the files and establish a communication link. All the connections are carefully controlled using firewalls, routers and various network monitors, any outside or unknown network cannot access these servers.

I have produced two alternative network design for the London office, one with VLANs and one without VLANs, I will explain why I chose to include VLANs as a part of my alternate network design, Virtual LANs (VLANs) can be viewed as a group of devices on different physical LAN segments which can communicate with each other as if they were all on the same physical LAN segment. VLANs do not require internal routers; they are directly connected to the ATM switch thus eliminating the need for more expensive routers, besides those VLANs provide a number of benefits over the network. Configuring VLANs is actually pretty easy. Figuring out which users you want in each VLAN is not. It’s super time consuming, but once you’ve decided on the number of VLANs you want to create, and establish the users you want to belong to each one, its time to bring the VLAN into the network design plan.

In this particular case, VLANs may be useful to manage the different departments based in London; a separate VLAN may be assigned for the Accounts department, Management Department, and the Advertising Department.

Generally VLANs increase overall network performance by logically grouping users and resources together. VLANs are used to group users in the same department together. For example, users in the Advertising department are placed in the Advertising VLAN, while users in the Accounts Department are placed in the Accounts VLAN.

VLANs can enhance scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, and traffic flow management.

The primary reason for using VLANs on a network are to make things more simple and easier to manage. VLANs allow network administrators to organize LANs logically instead of physically. This allows network administrators to easily move workstations on the LAN, Easily add workstations to the LAN, easily change the LAN configuration and easily control network traffic

VLAN benefits include: These are suitable for the London Office

• Increased performance
• Improved manageability
• Network tuning and simplification of software configurations
• Physical topology independence
• Increased security options

Increased performance

Switched networks by nature will increase performance over shared media devices in use, primarily by reducing the size of collision domains. Grouping users into logical networks will also increase performance by limiting broadcast traffic to users performing similar functions or within individual workgroups. Additionally, less traffic will need to be routed, and the latency added by routers will be reduced.

Improved manageability

VLANs provide an easy, flexible, less costly way to modify logical groups in changing environments. VLANs make large networks more manageable by allowing centralized configuration of devices located in physically diverse locations.

Network tuning and simplification of software configurations

VLANs will allow LAN administrators to "fine tune" their networks by logically grouping users. Software configurations can be made uniform across machines with the consolidation of a department's resources into a single subnet. IP addresses, subnet masks, and local network protocols will be more consistent across the entire VLAN.

Physical topology independence

VLANs provide independence from the physical topology of the network by allowing physically diverse workgroups to be logically connected within a single broadcast domain. If the physical infrastructure is already in place, it now becomes a simple matter to add ports in new locations to existing VLANs if a department expands or relocates. These assignments can take place in advance of the move, and it is then a simple matter to move devices with their existing configurations from one location to another. The old ports can then be "decommissioned" for future use, or reused by the accounts, management or the advertising department for new users on the VLAN.

Increased security

VLANs have the ability to provide additional security not available in a shared media network environment. By nature, a switched network delivers frames only to the intended recipients, and broadcast frames only to other members of the VLAN. This allows the network administrator to segment users requiring access to sensitive information into separate VLANs from the rest of the general user community regardless of physical location. In addition, monitoring of a port with a traffic analyzer will only view the traffic associated with that particular port, making discreet monitoring of network traffic more difficult.

Also, it should be noted that the enhanced security that is mentioned above is not to be considered an absolute safeguard against security infringements. What this provides is additional safeguards against "casual" but unwelcome attempts to view network traffic. To provide a higher level of security, firewalls combined with VLANs would be recommended. However, improperly configured VLANs can make a network function poorly or not function at all. Proper VLAN configuration and implementation is critical to the network design process.

So in conclusion VLANs are needed to better manage the network, make it more secure, easy to maintain, upgrade the network. The benefits far outweigh the negative aspects of installing VLANs. The normal network design without the VLANs would also work fine, although it would be cheaper to setup, from a networking point of view it doesn’t give that much control over a network, and does not work efficiently with a larger capacity network, like the one in London.

Manchester Hospital: [Medium Sized Network]

The Manchester Branch is a medium sized network which contains a small Administration building and Hospital wards containing 40 computers/medical equipments. I have chosen to split the wards into two, each containing 20 computers/medical equipments, keeping in mind that the doctors and nurses use it. The computers in the wards are connected to the primary router in the main building via a Switch utilizing a star topology. The Administration network contains 40 pc and a network printer, again this is connected using a similar setup to the wards, onto the main router via a switch utilizing star topology. Both the Wards and the Administration networks have Firewalls to prevent internal hacking. The Primary router is also linked to the File backup server, which doesn’t have its own firewall because all the other parts of the network are fire walled, and I don’t see any point in installing another firewall.

My previous design included one router to manage all the functions in the Manchester branch including the internal routing and the WAN access routing, but this was not the ideal solution, so I added an additional stand alone router that may be more suitable to handle the traffic from London to Scotland. The WAN access router is then directly linked to London and Scotland using a leased line, I preferred connecting Scotland to London via Manchester because, it will half the distance, and cut the cost of using leased lines.

Glasgow Hospital: [Small Network]

The Glasgow network is a straightforward and a simple network of 20 Hosts, and a printer, connected via a 100Base-T Ethernet (due to the short distance). All this is connected to a 24 port Switch, which is connected to a Router, The Router does 2 jobs, it acts as a WAN access router and routes the data between the LAN and the file back up server, thus supporting the internal network. There is a firewall between the router and the leased line to stop external threats, and a internal firewall between the router and the File backup server to stop internal hacking attempts from one of the work stations located within the network.

The End

Reference:

(i) Cisco Certified Network Associate Study Guide by Todd Lammle [fifth edition] ISBN: 0-7832-4391-1

(ii) Microsoft certified Systems Engineer Networking Essentials Guide by Dan York

ISBN 0-7897-1193-1

I used these books for gaining more knowledge about Network planning & designing, LAN and WAN technologies, VLANs and the over all network design, and borrowed some icons for my network design from the CISCO network models.