Network¶

A network provides the interconnectivity between systems. Cataloguing networks shows which systems can reach one another, where systems are isolated in private networks, and where the gateways between those networks - and onto the Internet - are.

The open metadata model for networks is deliberately simple. It has two elements and two relationships:

• A Network is a kind of IT infrastructure asset, so it can be named, owned, located and given a deploymentStatus like any other piece of infrastructure.
• A NetworkGateway is a connection point that enables network traffic to pass between two networks. It is a kind of software capability, because a gateway is provided by software - a router, firewall, proxy or API gateway - running on a server.
• The VisibleEndpoint relationship shows that an endpoint can be reached through a network.
• The NetworkGatewayLink relationship connects a network gateway to a network it serves.

flowchart LR
    H1[Host] -- ServerEndpoint --> EP1[Endpoint]
    H2[Host] -- ServerEndpoint --> EP2[Endpoint]
    EP1 -- VisibleEndpoint --> PRIV["Network<br/>(private)"]
    EP2 -- VisibleEndpoint --> PRIV
    EP2 -- VisibleEndpoint --> DMZ["Network<br/>(DMZ)"]
    NG[NetworkGateway] -- NetworkGatewayLink --> DMZ
    NG -- NetworkGatewayLink --> INET["Network<br/>(Internet)"]

Figure 1: Systems are placed in networks through their endpoints, and network gateways connect the networks together.

Placing systems in networks¶

Systems are not linked to networks directly. Instead, a host or other piece of IT infrastructure is linked to the endpoints at which it can be called with the ServerEndpoint relationship, and each endpoint is linked to the networks it is visible in with the VisibleEndpoint relationship. This is more precise than linking the whole system to a network: a server may expose its administration endpoint only on a management network while its service endpoint is visible more widely. An endpoint may be visible in several networks.

Connecting networks with gateways¶

The NetworkGatewayLink relationship records the addresses that a gateway maps between. Its externalEndpointAddresses property lists the network addresses that callers use to reach the gateway, and its internalEndpointAddresses property lists the addresses that the gateway maps those requests to.

NetworkGatewayLink is a multi-link relationship, so the same gateway can be linked to the same network more than once - for example, once for each address mapping that it maintains. Each link has its own unique identifier, which is used to update or remove it.

Networks at Coco Pharmaceuticals¶

The systems from Coco Pharmaceuticals' acquired manufacturers, catalogued as part of cataloguing infrastructure, include several network-related components. The Austin data lake is reached through a gateway that sits in front of its Hadoop clusters, which is a natural NetworkGateway, and the Bucharest site runs network anomaly detection that monitors the traffic on its site network. Recording the networks and the endpoints visible in them gives Ivor Padlock's security team a picture of which systems are exposed where.

Maintaining networks¶

• The DevOps Pipeline API creates and maintains networks and network gateways, and the NetworkGatewayLink and VisibleEndpoint relationships.
• The Connection Maker API maintains endpoints and links them to the infrastructure that provides them.

Raise an issue or comment below