Modular Approach

The Enterprise SAFE model divides the network into two broad categories, the edge and the campus, further subdividing each of these into modules. The enterprise edge is composed of the following modules:

• The E-Commerce module

• The Corporate Internet module

• ISP modules (one per ISPtwo are assumed, for reliability, named ISP A and ISP B)

• The VPN/Remote Access module

• The PSTN module, which connects via the VPN/RA module

• The WAN module

• The Frame/ATM module, which connects via the WAN module

We will dig into the components of each module shortly, but first it's useful to look at their relationships, or how they are interconnected . An overview of the modules and their connections is shown in Figure 6.1; the modules are presented "in silhouette," to keep you from being distracted by the wealth of internal details.

Figure 6.1. Edge module relationships.

A number of factors are worth noting here. First, the E-Commerce module is separated from the Corporate Internet module. Although both access the Internet via redundant links (via redundant ISPs), the E-Commerce module must allow strangers at least some access, although you do not want strangers entering your internal network via your users' Internet access. Notice that there is no direct connectivity between these two modules; their only interconnection is via the links passing through the ISPs. The E-Commerce module is a DMZ, well isolated from the production network's Internet access. However, the E-Commerce module has access to the heart of the production network via the Edge Distribution module; later examination will show that linkage to be heavily protected.

A second point to notice is that the VPN/Remote Access module connects to the outside world via other modules: via the Corporate Internet module for Internet access, and via the PSTN module for dialup service. Finally, the WAN module interconnects the Edge Distribution module to the Frame/ATM Network. Because these are dedicated circuits, you will find this interconnection less heavily protected.

The enterprise campus is actually more complex in its internal structure, but, paradoxically, its modular relationships are simpler. Again, using only the silhouettes to capture the relationships, the architecture of the campus is as shown in Figure 6.2.

Figure 6.2. Campus module relationships.

If there is only one building, of course, this is even simpler. Note that there is one modification in Figure 6.2 compared to the diagrams in the Enterprise SAFE Blueprint. I added the dashed line for connectivity between the Management module and the Building Distribution module. The SAFE Blueprint itself does not address how the Management module connects to the networking devices in the other modules, although there must be some connections for management to happen. In fact, the Blueprint specifies only that a terminal server can be used to connect directly to devices, a router (with IOS firewall) can be used to connect with encrypted in-band management, and switches can be used for out-of- band management. Because these connections must get from the devices in the Management module to the other devices wherever they might be throughout the network, I have connected the Management module to the rest of the network via the Building Distribution module, which, of course, connects to everywhere else.

Now let's take each module in turn and look at its high points. Much of what we note about these modules will apply to the modules in every version of the SAFE Blueprint, including the SMR SAFE Blueprint.