U.S. Naval base at Guantanamo Bay reworks its network
U.S. naval base at Guantanamo Bay, Cuba, notorious as the prison for enemy combatants, recently got a bandwidth makeover.
The U.S. Naval base at Guantanamo Bay, Cuba, notorious as the prison for enemy combatants, poses a lot of other thorny problems, including a copper communications infrastructure extremely unfriendly to high-speed networking.
As a result, Kenn Devine, manager of BRSC Information Systems, which is part of Burns and Roe Services, has struggled to create an effective WAN to tie its 17 Guantanamo sites to a local data center and link that back to the company’s facility in Virginia Beach, Va.
BRSC has held contracts to supply a range of services to the military at Guantanamo Bay since the 1950s, including providing drinking water and electricity, shuttling barges across the bay, running the airport, making concrete and providing housing.
The firm’s offices — scattered around the 90-square-mile base, which spans both sides of the bay — share business process applications supported at the data center that each project office ties into via copper phone lines. The data center is tied back to the mainland, and carries mainly HTTP, HTTPS, Citrix and some Microsoft CIFS traffic.
Before Devine could work on the WAN problems, he had to upgrade the network infrastructure — a series of cascading hubs — to a 100Mbps HP ProCurve switched infrastructure supported by Cisco routers and VPNs. To squeeze the most out of the links between the sites and the data center and between Guantanamo Bay and Virginia Beach, Devine installed nine Expand Accelerator WAN-optimization appliances.
He says the network now works efficiently, and he is in preparing to swap out most of the antiquated workstations for locked-down Citrix thin-client machines to give him centralized control. That step is on hold until he can upgrade application servers in the data center, probably early next year.
The project isn’t saving any money, but it is giving the firm a faster, more reliable and more efficient network that over time will bring down management and maintenance costs, Devine says.
After replacing the hubs, the first move was upgrading the 64Kbps connections between the remote sites around the base and the data center. The base provides two options for connecting the remote sites to the network operations center: Phoenix Cable, the base cable TV network, or the phone network run by SCSI. Wireless is out because the military bans use of unclassified bandwidth on the base.
Cable would be the less expensive option, but reliability is poor, Devine says. “It’s not as fast as you get with your cable connection at home,” he says.
So he chose DSL, which gave him a leap to 512Kbps links between the sites and SCSI. Each link costs $250 per month, plus $550 per month for dual T-1 trunks that feed traffic from the SCSI network to the data center.
The only option for connecting to the mainland is satellite service also operated by SCSI — $10,000 per month for a 512Kbps hop to Ft. Lauderdale, Fla. Traffic is routed from there over the Internet to the BRSC Virginia Beach facility that taps into the Internet via dual T-1s provided by Cox Communications, Devine says.
Because of the limited copper infrastructure at the base and because the copper is in poor shape, 512Kbps is the top speed BRSC can afford. But six of the sites have significant amounts of traffic that warrant larger connections, he says. So he looked around for WAN-acceleration gear that could make the 512Kbps connections behave as if they were larger.
He considered equipment from Peribit, now part of Juniper Networks, because it supported caching to speed up transfers. By the time the network was upgraded, though, Expand also had caching, and it made appliances for smaller connections for about 30% less than Juniper equipment would cost, he says. “Expand was designed more for a trickle,” he says.
The Expand boxes make the 512Kbps links seem like 2Mbps pipes, with some spikes in throughput where they behave like 11Mbps links, he says.
BRSC had trouble getting the data center Expand box to take in all the branch traffic and feed it directly onto the satellite, so it installed a second Expand box there. Traffic flows from one Expand Accelerator to the other via a Layer 3 ProCurve gigabit switch, into an IPSec VPN tunnel created by Cisco ASA5510 router and over the satellite link.
Both the VPN tunnel and the Expand optimization tunnel are terminated in Virginia Beach, where traffic bound for the Internet is decrypted and dropped onto dual T-1 Internet access lines.
Devine says that with the company’s WAN and LAN settled, he is focusing on better management of endpoints by locking them down and tightening up on who has administrative access. Using Citrix thin clients will allow him to centralize most applications at the Guantanamo Bay data center, making maintenance simpler.
