This
documentation is preliminary and is likely to change before becoming
final. Do not implement to it yet. Check for the next update by
February 2012.
The Allocation Calculator shows the
ranges and gives a rough idea of the purpose of each range. While MN.IT
customers who aren't executive branch agencies don't have to follow
this allocation pattern (except, of course, for the routed/not-routed
portion), we really recommend doing so: it will save us all a
lot of problems over the next few years. Also, we did come up with
these ranges for a reason and, if you can come up with a better
method, please let us know!
Note also that the same range definitions are used for all
customers, including MnSCU ones. Hence the inclusion of
"student" and similar labels.
We have these ranges defined:
- main organization user data networks ('clean side'): most
of your general desktop and work area networks should be assigned
from this range
- additional main organization user data networks ('clean
side'): this is a second range of general-purpose networks
- video: this range is for video conference systems, it does
not generally include desktop video
- public / student / guest networks: public access or only
lightly-restricted networks should be assigned from this range
- additional public / student / guest networks: and a second
range where needed
- assigned by organization as needed: networks can be
assigned from this range for any other purpose
- public safety / law enforcement / first responder: networks
in this range should be exclusively or primarily used for these purposes
- PCI: networks subject to payment card industry (PCI)
regulation should be assigned from this range
- business networks: this range is for networks of servers
providing business support systems such as application servers,
database servers, and financial processing systems
- inside networks: this range is for networks of servers
providing internal services such a file and print server
- DMZ networks: this range is for networks of servers
providing Internet-facing services such as web and mail servers
And these ranges are not routed to the Internet:
- voice: this range is for MN.IT-managed VoIP systems
- server and other IT management; backup: this range is for
server management, backup, and similar systems
- physical security such as badge readers, door locks,
surveillance video: self-explanatory
- not routed outside the organization: this range can be used
for any purpose where Internet connectivity is not desired
- loopbacks and link networks / network management: this
range is for network devices and device management
