Tales from the front: More about running crypto over an IP Network

Opinion
Oct 19, 20053 mins

* How Nlets' upgraded network is performing

Last time, we learned how the International Justice and Public Safety Information Sharing Network (known as Nlets) upgraded from frame relay to IP and why Nlets officials chose AT&T as its ISP and Cisco as its equipment provider. This week, we’ll find out how well the upgraded network is performing.

“We’re very happy with the network,” says Frank Minice, director of operations for Nlets. “We’re happy with the support we get from Cisco and AT&T.”

Top-notch support is critical for Nlets, which is one of the most demanding networks imaginable.

As noted previously, Nlets interconnects 18,000 local, state and federal law enforcement and public safety agencies. More than 559,000 devices are hooked up to Nlets, and over 1 million law enforcement and criminal justice personnel use those devices to access data over the network.

Prior to the upgrade, Nlets’ network was unable to support encrypted traffic. Nlets decided to upgrade to IP in response to an FBI mandate that all networks accessing its data needed be encrypted by 2005. The upgrade cost around $500,000.

It took seven years for Nlets to migrate to IP, with two of those years spent rolling out encryption services. Today, Nlets carries more than 41 million transmissions per month that are encrypted end-to-end using the AES standard. 

With the upgrade completed, Nlets is enjoying the benefits of its new network architecture.

“We have not seen any increase in bandwidth demand because we’re running encryption,” Minice says. “We use a Cisco offering called VPN Accelerator that runs the encryption off the regular memory of the router onto a separate piece of equipment. It’s almost like having another memory processor there just to do the encryption. Because of that, we did not see any significant increase in bandwidth utilization.”

Nlets officials recommend that network managers who are moving to encryption buy flexible routers with expansion capabilities. “One thing we liked about the Cisco routers is that they are really flexible,” Minice says. “You want to have a device that you can expand without having to replace the unit.”

Nlets officials also recommend running non-encrypted and encrypted services simultaneously during the transition phase. “It’s nice to be able to take a stepped approach and have both services running at the same time,” Minice says.

One plus of the new Nlets architecture is that it features a hot site in Idaho in case the main operations center in Phoenix isn’t working. The Idaho center features redundant equipment.

“A disaster for Nlets is any outage,” Minice says. “If a backhoe took out a line in Phoenix, then we would cut over to Idaho. We’ve had two cutovers this year. We’ve been able to come up within a matter of minutes, which we could not have done if we weren’t on an IP infrastructure.”

Next on the Nlets agenda is to migrate to XML and Web Services to automate information sharing with federal and state law enforcement agencies. Nlets also is experimenting with VoIP.

“We are extremely proud that Nlets has made Cisco the central core of its system,” says Morgan Wright, global industry solution manager for justice and public safety with Cisco. “When lives are on the line, this is as big of a deal as it gets. The dollar value doesn’t matter as much as the users.”