Network Topology

This section details the network topology used within the MS (Managed Services) infrastructure. Understanding the network layout is crucial for effective management, troubleshooting, and security analysis.

Core Network Structure

The MS network employs a hybrid topology, combining elements of star and mesh architectures to achieve redundancy, scalability, and performance. Data flows primarily through high-speed backbone connections, with individual services and user access points connected in a more distributed manner.

Key Components

Core Routers: High-performance devices responsible for inter-data center routing and external connectivity.
Distribution Switches: Aggregate traffic from access layers and provide connectivity to core routers.
Access Switches: Connect end-user devices, servers, and other network endpoints to the distribution layer.
Firewalls: Implement security policies and segment the network into trusted zones.
Load Balancers: Distribute incoming network traffic across multiple servers to ensure high availability and responsiveness.
VPN Concentrators: Provide secure remote access for authorized personnel.

Figure 1: High-level overview of the MS network topology.

Data Flow and Segmentation

Network segmentation is a critical security and performance measure. The network is divided into several logical zones:

Internal Production Zone: Hosts critical applications and data. Access is highly restricted.
DMZ (Demilitarized Zone): Houses public-facing services.
Management Zone: For network management tools and administrative access.
Development/Testing Zone: Isolated environment for application development and testing.
Guest/External Access Zone: Provides limited connectivity for external users or guests.

Traffic between these zones is strictly controlled by firewall rules. Internal communication within zones typically follows a star topology, with devices connecting to a central switch or access point.

Redundancy and High Availability

To ensure continuous operation, the MS network incorporates several layers of redundancy:

Link Aggregation: Multiple network links are combined to increase bandwidth and provide failover.
Spanning Tree Protocol (STP) / Rapid Spanning Tree Protocol (RSTP): Prevents network loops while allowing for redundant paths.
First Hop Redundancy Protocols (FHRP): Such as VRRP or HSRP, provide redundant default gateways for hosts.
Redundant Hardware: Core network devices are often deployed in redundant pairs.

Connectivity Examples

Example: Server to External Access

A typical data flow for a request from an external user to a web server would traverse the following path:

External Client -> Edge Router/Firewall
Edge Router/Firewall -> DMZ Firewall
DMZ Firewall -> Load Balancer
Load Balancer -> Web Server (in DMZ)

Example: Internal Management Access

Accessing a server in the Internal Production Zone from the Management Zone:

Management Workstation -> Management Switch
Management Switch -> Access Switch (Internal Production Zone)
Access Switch -> Target Server (Internal Production Zone)

All traffic is subject to strict firewall policies defined in the /ms/docs/net/security.html section.