disn data networks: secret internet protocol router network (siprnet)

DISN Data Networks:

Secret Internet Protocol Router Network (SIPRNet)

Jim Nostrant, DISA/D3124

SIPRNET Customer Service Manager

E-Mail: [email protected] Tel: (703) 735-3238 DSN 653

The DOD’s Intranet

Processing

SECRET Information

SIPRNetSecret IP Router Network

Designed to Satisfy the Warfighter’s Requirements

Agenda

• The Network

• Customer Base

• Services

• Security Posture

• Summary

Network Relationships

(Top Secret/SCI Intranet)KG

KG

KG

SIPRNET SIPRNET (Secret Intranet)(Secret Intranet)

(Top Secret Intranet)

INTERNET

NIPRNET(Unclassified Intranet)

Router

High Assurance Guard

KG

KG

KG

KG

Crypto

NES

Covered Link

Uncovered Link

70 Nodes70 Nodes

240 Nodes240 Nodes

KG

SIPRNet

• Secret, System High, US Only Network• Design based on GCCS, CIO, and DSNET1 Req’ts• CISCO 7000/7500 Series Routers• T-1 (1.544Mb/s) Backbone going to ATM Transport• 14 GMF Gateways via STEP/ITSDN• 24x7 Network Management

- Pentagon, DISA-Europe, DISA-Pacific• SIPRNet Support Center (NIC)

- Network and User Information Services• GCCS-T Backbone Support• GPS Timing Service • Dial-up Service

NORTHWEST

LEGEND

UPS ONLY

GEN ONLY

OPERATIONAL SIPRNETHUB ROUTER (NODE)

PLANNED SIPRNETHUB ROUTER (NODE)

INTER-ROUTER TRUNK(OPN’L 1.544MB)INTER-ROUTER TRUNK(PLN’D)

ITSDN ROUTER

DAIL-UP COMM. SERVER

CLASSIFIEDATM SWITCH

UPS &GEN

TO PENTAGON-1 CCSD-230X

TO ELMENDORF AFB CCSD- 23UR

TO HICKAMAFBCCSD 2361

178

TO STERLING CCSD/23B0

HANSCOM AFB

FT LEWIS

BEALE AFB

MONTEREY

SAN DIEGO-1

FT. HUACHUCA

FT. HOOD

KELLY AFB

FT BUCHANANCOROZAL

FT BRAGG-1

JACKSON- VILLE

MACDILL AFB

MIAMI

SCOTT AFB-2

SCOTT AFB-1

COLUMBUS

WRIGHT PAT-1

CARLISLE BKS

HANCOCK

FT MONMOUTHPETERSON AFB

SCHRIEVER AFB

OFFUTT AFB

FTMCPH-1

512KB/23DT

1.544MB/239K

1.544MB 239L

CCSD-239Q

CCSD-23BR

CCSD-23MW

CCSD-23BT

CCSD-23MQ

CCSD-235Z

CCSD-2360

CCSD 2332

CCSD 23UC

512KB/23DN

TOFT SHAFTERCCSD-23MR

TO FT MONMOUTH CCSD-23QH

CCSD-234WCCSD-23QA

CCSD 231U

CCSD-23MV

CCSD/231V

CCSD-231T

CCSD-2337

CCSD-234T

CCSD-233B

CCSD/2312

CCSD 234V

TO SITE-R/CCSD-23CZ

TO PENTAGON-1 CCSD-23DD

TO CROUGHTON2.048MB/23UW

TO NORFOLK/2365

TO PENTAGON-2/23MU

TO SITE-R/23AS

CCSD-2342

CCSD 23MD

CCSD 239R

CCSD 239P

199

202

CCSD23RU

CCSD-2343

CCSD 23QC

235

CCSD/235Y

CCSD-23NV

234

CCSD234S

200

FT MCPH-2

TO STERLING/2313

FT BRAGG-2

WRIGHT PAT-2

231

MCNCSBRG

CCSD23Z4

CCSD230W CCSD-23Z3

219

229

CCSD23UD

TO ARLINGTON VA. CCSD-233A

191

SAN DIEGO-2

176

CP ROBERTS

03/07/00

SIPRNet BACKBONE--CONUS

189

217

209

239

201

206

237

230

178

214

CCSD23QB

177

233

CCSD-23ME

232

236

172

173

212

220 NCR

TO ESKAN VIL./CCSD-233XE/512KB/DSCS

CCSD 2330

TO PSAB/CCSD-23AB/512KB/DSCS

205

SIPRNet National Capital Region

UPS ONLY

03/07/00

GEN ONLY




ITSDN ROUTER



UPS &GEN

LEGEND

STERLING

184

170

208

213

171

183

188

216 175

SITE-R

PENT-1

PENT-2

ARLINGTON

FT BEL-1

FT BEL-2

NORFOLK

HAMPTON ROADS

TO CARLISLE BKS/CCSD-23CZ TO COLUMBUS/CCSD-23AS

CCSD-23B5CCSD23AP

CCSD-2345

TO CARLISLE BKS/CCSD-23DD

TO MCNCSBRG/CCSD-230X CCSD23VG

CCSD23VF

TO FT BRAGG-2/CCSD-23MU

TO BAHRAIN/CCSD-23E1/1.536MB/CSCI

CCSD23VA

CCSD23RT

CCSD23CB

TO RAMSTEIN/CCSD-23UU

TO FT MCPHERSON-2/CCSD-2365

CCSD-23RV

CCSD-23VE

CCSD23RS

TO SCOTT-1/CCSD-23B0

TO FT BRAGG-1/CCSD-2313

TO BEALE AFB/CCSD-233A

TO CARLISLE BKS/CCSD-232W

CCSD-23CU

TO ESKAN VIL./CCSD-23TH/512KB/DSCS

TO CAMP DOHA/CCSD-23AE/1.544MB/CSCI

TO RAMSTEIN/2.048

LEGEND

RAFCROUGHTON

AVIANO TUZLA

CAPODICHINO

VAIHINGEN-1

VAIHINGEN-2

NUERNBERG

RAMSTEIN

HEIDELBERG

CROUGHTON

LONDON

TO FT. MONMOUTH (23UW/2.048MB)

TO HAMPTON RDS.(23UU/2.048MB)

W9K3/512KB

LANDSTUHL

TO BAHRAIN/23D1/256KB

WJ6P 2.048MB

WLCJ/512KB

WPET 512KB

W9FS/384KB

W9ZH/512KB

WPES512KB

W9Y8512KB

WLBB 2.048MB

WLBA 512KB

WJ6N 2.048MB

WLMB/512KB

WLLR/256KB

TASZAR

WLLS/256KB

WJ6M 2.048MB

W9ZG384KB WJ4J

1.544MB

W9FN1.544MB

W9FT 512KB

ROTA512KB/M06Z

512KB/M06Y

TO BAHRAIN/23G6/256KB

W9FU 256KB

DISA-EUR RCCSIPRNET NET MGMT CTR-

EUROPEVAIHINGEN, GE

215

224

223

03/07/00

225

WLCJ/512KB

WLMB/512KB

WLLR/256KB

LANDSTUHL

SIPRNet BACKBONE--EUROPE

UPS ONLY




ITSDN ROUTER


UPS & GEN

GEN ONLY

180

181

197

203

204

195

UPS ONLY

182

221

TO PENTAGON-1/2.048MB

LEGEND

XEJ4 512KB

SIPRNet BACKBONE--PACIFIC

TO FT. LEWIS23UR/1.544MB

23DG512KB

WAHAWA

WHEELER AFB

HICKAM AFB

FT SHAFTER

JAPAN

HAWAIIAN ISLANDS

ALASKA

FINEGAYAN

YONGSAN

CP WALKER

OSAN

FT BUCKNER

YOKOTA

XEG2/128KB

XD4S 512KB

XD4V/512KB

XD7N/512KB

XEJ1/560KB

XD7P/512KB XD7S 512KB

XD46/512KB

DISA-PAC RCCSIPRNET NETMGMT CTR-

PACIFIC

XEJ1/512KB

XD4N/512KB

XEG2/128KB XD4T/1.544MB

TO FT. LEWIS/23MR/1.544MB

TO BEALE AFB/2361/1.544MB

XD5F/512KB

XD4P/512KB

XE4J/512KB

XD44/512KB

XD44/512KB

XD7S/512KB

XD7N/512KB XD6X/512KB

XD46/512KB

TO BAHRAIN/23MM/128KB

03/07/00

194

185 210

187

198

207

193

211

179

186

XD7Z/512KB

XEL8/1.544MB

XEG1/1.544MB

ELMENDORF AFB

ITSDN

ITSDN

SOUTHKOREA

XD6X/512KB




ITSDN ROUTER


UPS & GEN

GEN ONLY

UPS ONLY

192X04F/1.544MB

TO FT BUCKNER JA./128KB/23MM/DSCS

SIPRNet BACKBONE--SWA

LEGEND 03/07/00

TO RAMSTEIN/256KB/W03P/DSCS

DOHA

PSAB

ESKAN

BAHRAIN

196

TO FT. BELVOIR/512KB/23TH/DSCS

TO MACDILL AFB/512KB/23XE/DSCS

TO PENTAGON/SIPRNET/23AE1.536MB/CSCI

DISA-CENT RNOSCSIPRNET NET MGMT

CTR.MANAMA, BAHRAIN

TO CAPODICHINO/256KB/23G6 COMMERCIAL SATELLITE

TO ARLINGTON/SIPRNET/1.536MB/23E1/CSCI

TO MACDILL AFB/SIPRNET/512KB/23AB/DSCS

196

240

ITSDN

226

SIPRNET/TISN/M09E/768KB

SIPRNET/TISN/M09D/512KB

SIPRNET/TISN/M09C/128KB

SIPRNET/DSCS/M09G/512KB




ITSDN ROUTER


UPS & GEN

GEN ONLY

UPS ONLY

218

SIPRNET/TISN/M09H/512KB

ITSDN

TO MACDILL AFB/238P/768KB/DSCS

TO BE UPGRADED TO 2.048MB MARCH 00

TO BE UPGRADED TO 2.048MB MARCH 00

NORTHWEST

LEGEND

T-1 CIRCUITSTO REHOMETO SUPPORT CIP



INTER-ROUTER TRUNK(OPN’L 1.544MB)

ITSDN ROUTER



SIPRNet Highspeed Spine--CONUS

FT LEWIS

205

BEALE AFB

MONTEREY

SAN DIEGO-1

FT. HUACHUCA

FT. HOOD

KELLY AFB

FT BUCHANAN

FT BRAGG-1

JACKSON- VILLE

MACDILL AFB

MIAMI

SCOTT AFB-2

SCOTT AFB-1

COLUMBUS

WRIGHT PAT-1

FT MONMOUTH

PETERSON AFB

SCHRIEVER AFB

OFFUTT AFB

FTMCPH-1

512KB/23DN

199

202

235

234

FT MCPH-2

FT BRAGG-2

WRIGHT PAT-2

MCNCSBRG

219

229

191

SAN DIEGO-2

176

03/09/00

217

209

239

201

206

237

230

178 214

177

233

232

236

172

173

212

220

NCR

DS-3 BACKBONE CIRCUITS

ATM BACKBONE CIRCUITS

231

HANSCOM AFBATM

DS-3

221

EUROPE

VAIHINGEN

WAHIAWA

HAWAIIAN ISLANDS

193

SIPRNet National Capital RegionHigh Speed Spine

03/09/00LEGEND

STERLING

170

208

213

171

183

188

216 175

SITE-R

PENT-1

PENT-2

ARLINGTON

FT BEL-1

FT BEL-2

NORFOLK

HAMPTON ROADS

184

CCSD23VF




INTER-ROUTER TRUNK(OPN’L 1.544MB)

ITSDN ROUTER



ATM BACKBONE CIRCUITS

T-1 CIRCUITSTO REHOMETO SUPPORT CIP


ATM

DS-3

SIPRNETSecret (S) IP Router Network

SAUDI ARABIAWORLDWIDEPACIFIC RIM

USERHOST

3 (7x24) MGMT CTRs

DEDICATED IP ROUTER

TACTICAL

USERLAN

DIAL UP28.8 KBPS

USER PC

IP ROUTER

IP ROUTER

T-1 BACKBONE70 Nodes

IP ROUTER

9.6 KBPS - T-1or ETHERNET ACCESS

DNS

IP ROUTER

859 Full Time User Connections1540 Dial Up Users

Integrated Tactical-Strategic Data Network (ITSDN)

STEP

ITSDN/STEP CONFIGURATION

STEP

ITSDN

UNCLASROUTER

ITSDN

SECRETROUTER

STEP

IPROUTER

IPROUTER

IPROUTER

IPROUTER DSNET 1

USERS

SIPRNET

INTEL COMMUNITY

GCCS

ADNET

IPROUTER

IPROUTER

IPROUTER

IPROUTER

NIPRNET

AGENCY USERS

INTERNET

SERVICE USERS

MILNET USERS

ARFOR

NAVFOR

AFFOR

MARFOR

CJTF

JSOTF

ARFOR

NAVFOR

AFFOR

MARFOR

CJTF

JSOTF

ITSDN Locations

Wahiawa HI

Camp Roberts,California

Ft Belvoir,Virginia

Ft Meade,Maryland

Landstuhl,Germany

RAF Croughton,United Kingdom

Lago Di Patria

Ft Buckner, Japan

Northwest,Virginia

Ft Detrick,Maryland

Bahrain

Ft Bragg,North Carolina

MacDill AFB,Florida

Ramstein,Germany

Currently Direct Connected

TOTAL: 859 Connections

DOD

Air ForceArmy

DISA Navy

USAF = 284Army = 140Navy = 155DOD = 280

Dial-up Users

TOTAL: 1540 Dial-Up Connections

Navy1%DISA

23%

Defense Security Service

<1%Contractor/DISA<1%

Army15%

Air Force58%

On SiteInspection

Agency3%DIAL-UP

SecureSTU-III

Comm Server

Destination Server

User PC SIPRNet STU (B-12) Data Modem

User STU (B-12) Data Modem

SIPRNetHub Router

CISCO Secure Server

SIPRNet Dial Up Capability

• Access Controls and Procedures• Location of Communication Servers• Technology being Used

1. Customer contacts DISA/D3613

2. Customer requests "B" side Information (Network connection point) from DISA/D3613.

3. Customer creates/Submits Request For Service (RFS)

4. In parallel with #3, the customer creates/submits Security Accreditation package to DISA/D3613.

5. Supporting Telecommunications Certification Office (TCO) submits Telecommunications Service Request (TSR).

6. DISA Allocation and Engineering (A&E) submits Telecommunications Service Order (TSO).

7. DITCO orders circuit based on TSO to either commercial provider or via government facilities.

8. Requirement placed on Master Schedule for activation based on D3614receipt of TSO.

9. Customer contacts SIPRNET Support Center for backside IP Addresses.

10. Customer must ensure Premise host equipment is installed and ready to activate. [Note: This also assumes customer has received an Interim Approval to Operate (IATO) based upon DISA approving customer Security Accreditation package.]

11. Field Engineer (FE) dispatched and prepared to activate connection.

12. Upon successful activation by FE, requirement goes into 72 hour test with Initial, Test, and Acceptance (ITA).

13. Requirement declared operational.














Unclassified Environment

USERLAN

GUARD

The Threat Methods: Physical & ElectronicTargets: Hosts, Enclaves, Networks

SIPRNet Security Risks

DomainName

Service

DNS

7x24 Management Centers

INSIDER--The Biggest Threat!

IP ROUTER

SIPRNet

Network Protection



























Routers Password Protected/Non MC Addresses FilteredRouters Physically Protected/Circuits Encrypted (SIPRNET)

IP ROUTER

IP ROUTER

IP ROUTER IP ROUTER

IP Sec Protection

NMCFirewalls

7x24

MGMT CTR

DNS

Keyed MD5 for Authentication

SIPRNet Connection Approval ProcessIntrusion Detection

Devices @ MCs /Support Centers

Procedural Restrictions

Scope

Dial UpUser

Terminal

STU

Fixed / Deployed Site

LAN

SIPRNET Backbone

STU

CommServer

SIPRNETAccreditation

ROUTER

ROUTER ROUTER

PREMISEROUTER

ROUTER

SiteAccreditation

TransportAccreditation

Need to Operate AIS at Secret Level

Internal Verification/Certification

Need to Communicate Over SIPRNET

DISA Reviewsthe Package

DISA ConductsOn Line Assessment

DISA Issues Final Approval to Connect

Includes: Conops Security Policy Connectivity Diagram Approval to Monitor & IATO or Accreditation

DISA Actions

SIPRNet Connection Approval Process

IATO or Accreditation (DAA)

Security Package to DISA

DISA Issues IATC & Connection

Decisions Made Prior to Operation & Connection

Local DAA SIPRNET DAAs

Interim Approval To Operate (IATO)

Approval To Operate (ATO)

Interim Approval To Connect (IATC)

Interim Approval To Connect (IATC)

Approval To Connect (ATC)Consider:

- Outstanding Vulnerabilities

- Residual Risk

- Completed Paperwork

Consider:

- Outstanding Vulnerabilities

- Residual Risk

- Completed Paperwork

Security Status

• No Successful External Attack

• Continuous Monitoring for Insider Events

SIPRNet Points of Contact

• Ms. Cindy Moran for Concepts/Program703-735-8259DSN: [email protected]

• Mr. Jim Nostrant Customer Service703-735-3238DSN: [email protected]

• Mr. John Staples Connection Approval Process703-735-3236DSN: [email protected]

SIPRNet Help Desks For Operational Problems

Call your Regional Network Operations & Security Center (RNOSC)

CONUS 1-800-451-7413

EUROPEIn Germany 0711-680-6241/6363

Outside Germany 0049-711-680-6241/6363Secure 0711-680-6279

PACIFIC 1-800-656-1472/3/4 DSN 315-456-1472/3/4

SIPRNET Support Center 1-800-582-2567

FY00 DISN IP Router Rates

Dial-up Service= $50 Initiation Fee plus $27 MRCNon-recurring Charge for Installation: <512Kb/s= $2,500 512Kb/s and Greater= $5,000

PACIFIC PACIFICBANDWIDTH CONUS (AK & HI) EUROPE RIM__

ETHERNET (6Mbps) $ 3,646 $ 3,646 $ 5,397 $ 6,3014.8 - 64Kbps $ 405 $ 405 $ 600 $ 700128Kbps $ 709 $ 709 $ 1,049 $ 1,225256Kbps $ 1,215 $ 1,215 $ 1,799 $ 2,100384Kbps $ 1,620 $ 1,620 $ 2,389 $ 2,801512Kbps $ 2,025 $ 2,025 $ 2,998 $ 3,501768 - 896Kbps $ 2,228 $ 2,228 $ 3,298 $ 3,8511 Mbps $ 2,329 $ 2,329 $ 3,448 $ 4,026 1.024-1.544 Mbps $ 2,430 $ 2,430 $ 3,598 $ 4,2012-2.048 Mbps $ 2,532 $ 2,532 $ 3,748 $ 4,3763 Mbps $ 2,633 $ 2,633 $ 3,898 $ 4,5514 Mbps $ 2,937 $ 2,937 $ 4,347 $ 5,0765 Mbps $ 3,241 $ 3,241 $ 4,797 $ 5,6017 Mbps $ 4,051 $ 4,051 $ 5,996 $ 7,0018 Mbps $ 4,253 $ 4,253 $ 6,296 $ 7,3529 Mbps $ 4,658 $ 4,658 $ 6,896 $ 8,052

FY00 DISN IP Router Rates (continued)

Dial-up Service= $50 Initiation Fee plus $27 MRCNon-recurring Charge for Installation: <512Kb/s= $2,500 512Kb/s and Greater= $5,000

PACIFIC PACIFICBANDWIDTH CONUS (AK & HI) EUROPE RIM__

12 Mbps $ 5,874 $ 5,874 $ 8,695 $ 10,15215 Mbps $ 6,846 $ 6,846 $ 10,134 $ 11,83218 Mbps $ 8,102 $ 8,102 $ 11,992 $ 14,00321 Mbps $ 9,114 $ 9,114 $ 13,491 $ 15,75324 Mbps $ 10,410 $ 10,410 $ 15,410 $ 17,99427 Mbps $ 11,869 $ 11,869 $ 17,569 $ 20,51430 Mbps $ 13,165 $ 13,165 $ 19,488 $ 22,75533 Mbps $ 14,461 $ 14,461 $ 21,406 $ 24,99536 Mbps $ 16,568 $ 16,568 $ 24,525 $ 28,63639 Mbps $ 18,877 $ 18,877 $ 27,942 $ 32,627

Rates for higher speeds will be provided as needed.

Summary

SIPRNET is...

Physically & Electronically Protected from the Unclassified Environment

Portions Under Constant Surveillance -- Need More

Mechanisms in Place to React

More Secure than Ever! -- Room for Improvement -- And We’re Working on it

disn data networks: secret internet protocol router network (siprnet)

Documents

ccsd23b0to ft bragg

w ccsd

network design

conus ft lewis

uuto ft mcpherson

backbone circuitsatmds

mbs backbone

marylandbahrainft bragg