Sporveien AS is a municipal company that has operated public transport in Oslo for nearly 150 years. Today, the distinctive light blue trams are an integral part of both the city's rich history and its sustainable and cost-effective future. Netsecurity is now modernizing Sporveien's extensive network infrastructure using distinctive purple equipment and solutions from Extreme Networks, making the infrastructure more secure, easier to manage, and less prone to errors.
With approximately 3300 employees, 217 million individual journeys, and revenue of NOK 5 billion in 2022, Sporveien AS is by far Norway's largest and most prominent provider of public transport. The group is wholly owned by the City of Oslo and operates all metro and tram services in Oslo and Viken, as well as a large share of the tender-based bus traffic in Oslo, Viken, Innlandet, Vestfold, and Telemark. At the same time, Sporveien owns, develops, and manages all infrastructure related to the metro and tram system – that is, tracks, stations, tunnels, signaling systems, and other properties – and is responsible for the maintenance of trams and metro cars.
In line with the vision to provide sustainable mobility for everyone by transporting as many satisfied passengers as possible – quickly, safely, and at the lowest possible cost to society and the environment – the company has continuously evolved and adapted to the growing needs of local communities. Over the past decade, Sporveien AS has operated services more efficiently through two strategy periods: "Best 2015" and "Best 2020." The result is steadily higher service quality as well as operating savings of more than EUR 100 million annually compared with 2011.
In 2021, Sporveien AS launched an advanced and comprehensive modernization of its network infrastructure. The purpose was to achieve further cost reductions and revenue increases, as well as to improve the public transport system as such. The project covered everything from the network core with firewall to access switches and wireless networks for all 43 locations in the group. The most important goal was to build a flexible, cost-effective, robust, and secure foundation that covers the group's current and future needs.
Previously, Sporveien's IT department had to use a traditional network built around VLANs. As time passed and the group's IT environment became increasingly complex, the limitations of the old solution – caused by the rigid and sophisticated architecture – became increasingly clear. Whenever the employees needed, for example, to deploy new services, they had to configure up to one hundred network switches. This naturally put a strain on the IT budget and resources, while also creating a significant risk of human error and consequently a risk of network downtime. The use of IP addressing also represented a certain threat from a security perspective.
At the same time, strengthening security and robustness could negatively affect the simplicity and agility of the network, which in turn tends to increase operating costs. Sporveien's IT department realized that they needed a completely new approach to break out of this vicious circle. It became clear that a new network based on the Shortest Path Bridging (SPB) protocol IEEE 802.1aq would be the best choice, especially with a view to redundancy in a demanding physical cabling infrastructure with independent services (I-SIDs) on top.
During the tender process, some of the participants proposed Extreme Fabric Connect – the industry's leading SPB technology from Extreme Networks – as the foundation for the new solution. Initially, the company considered a fairly traditional approach with fabric switches in the core and EXOS switches at the network edge. In the end, Netsecurity, one of Norway's leading providers of services and solutions in IT security and infrastructure, developed a far more elegant and advanced solution.
– After a thorough review of Sporveien's needs and challenges, we asked ourselves: "Why not extend the simple fabric network technology to all locations with production and maintenance, such as workshops and traffic control centers?" To achieve the desired cost efficiency, redundancy, and security, we chose to base the new solution on Extreme Fabric Connect from the network core all the way out to the access switches and the wireless network. This decision was made in consultation with the customer, says Netsecurity Senior Network Security Engineer Frode Slangsvold, who has more than ten years of experience with Extreme's fabric solution.
|
– Why not extend the simple fabric network technology to all locations with production and maintenance, such as workshops and traffic control centers? Frode Slangsvold, Senior Network Security Engineer, Netsecurity |
|
– We wanted to avoid making it too complicated. When things are complicated, they stop working after a while, and then you just end up with a cluttered network. It is quite easy to make a network more complex. For us, however, it was crucial to simplify practically everything, including administration, operations, troubleshooting, and deployment of services, explains Gunnar Gullberg, network manager at Sporveien AS.
Sporveien plays a crucial role in the everyday lives of the municipality and its residents, and the group has many geographically dispersed locations, all of which are connected to the production network. Last but not least, Sporveien works on transport infrastructure every single day, so given the nature of the business, the need for efficient operations and cost savings becomes very clear. This is where we see the first major advantage of the new SPB network.
Now that the Extreme Fabric Connect solution is in place, Sporveien's IT department can onboard new equipment, new software, and new services and users much faster and more easily. The basis for this automation lies in the auto-sense-enabled ports.
– Fabric edge switches from Extreme support zero-touch deployment. This means that when new switches are deployed, auto-sense is automatically enabled by default on all ports, so they are simply up and running. The switches then create an onboarding I-SID that ensures that everything connected to the infrastructure – including other SPB nodes and client devices – is automatically onboarded onto the network management infrastructure. This service is created by default, says Senior Systems Engineer Adam Minowski at Extreme Networks.
What does this mean in practice? First, there is no need to send a highly qualified network technician on-site every time a change is needed in the network.
– This is a major advantage in our production network, especially when employees work night shifts. The network technicians do not need to be present. They can simply ask an electrician to connect a switch, and when they show up for work the next morning, it is in place and working as it should. Our network team consists of only two people, but if something happens and we are away or unavailable, practically anyone in the office can pick up the switch, drive to the location, and replace the switch. The new switch is up and running within a couple of minutes, says Gullberg.
The new network solution simplifies moves, additions, and changes. At the same time, it makes it easier to connect existing, traditional networks to the structure or extend the fabric network to third-party locations via any type of connection and network topology. Both are crucial in Sporveien's case.
– One of our partners – a bus company with many locations spread throughout Oslo – was not connected to our network, so the connection had to be established via the internet. We could not have done that before, at least not without a great deal of work. Now we can deliver the same service as we do here in the office and anywhere else in the network, almost instantly – instead of within three weeks, says Gullberg.
– What we mainly did was extend the fabric services to the partner's locations over a private IP VPN connection using VXLAN tunnels. The connection runs from the far edge to the firewall. This provides the same benefits in terms of automation and security as at Sporveien's locations. Thanks to instant onboarding, their devices automatically connected to our fabric and had new services delivered. Best of all, we were able to do it with just a few mouse clicks, since it is Fabric-to-the-Edge, even across Layer 3 connections. With the old solution, all of this would have been very labor-intensive in terms of routing, IPsec, and so on, explains Slangsvold.
It is reliability that determines a system's quality. This applies to both public transport and IT networks. For Sporveien, it was crucial that the modernization project gave them greater robustness and redundancy in critical network infrastructure in order to reduce downtime.
Previously, the group had to use routing protocols with Spanning Tree and switch clusters to achieve a certain degree of redundancy, but it was limited to only the central parts of the city. Today, the risk of downtime related to equipment integration is significantly reduced throughout the infrastructure.
– With the new solution, it is no longer dangerous to automate Sporveien's network, since you only touch the edge. The automatic process for onboarding switches also ensures that no loops occur, and that is thanks to the Fabric Connect solution in the backbone. Therefore, the group does not have to worry about loops and human errors, says Slangsvold.
The downside of improving network redundancy is that it often comes at a price – whether in the form of actual costs or increased complexity (which in turn also entails costs). Previously, companies and organizations had to ask themselves the old question: "How far are we actually willing to go to achieve true redundancy?" However, the introduction of the new fabric solution gave Sporveien the opportunity to use its existing fiber connections for redundancy more efficiently, increasing the return on that investment. Thanks to the plug-and-play functionality, almost everything is redundant, even at the network edge.
|
– Shortest Path Bridging technology makes it much easier to achieve redundancy in challenging physical environments like those at Sporveien, without making the environment harder to maintain or manage. Today, the customer benefits from both a simple network and redundancy for critical services. This is fabric network technology at its best Frode Slangsvold, Senior Network Security Engineer, Netsecurity |
|
The time saved can be used for more strategic tasks and for introducing further innovations in IT. Perhaps even more importantly, the new infrastructure provides tangible efficiency gains that save Sporveien money and resources and strengthen the group's reputation.
.png?width=3840&height=2160&name=header%20%20sprveien%20(1).png)
– Previously, downtimes were longer. If any of our critical locations – for example, those that manage our metro or tram systems – could not do their job in the morning, there were many traffic delays. This actually results in fines that the group usually has to pay, so the new infrastructure provides us with savings all around, adds Gullberg.
Network security is crucial for public transport companies and naturally a top priority for Gullberg and his colleagues in the IT department. The implemented solution addresses this need in an interesting way. The most important thing is the logical segmentation into separate networks for network management, administration, and technical tasks for transport managers, such as traffic monitoring and control of all trains.
– It is not possible to access the service layers in the network from the administrative layer in such a fabric. You can connect to any port you want, but because of the way Sporveien's fabric is built, you will never reach the administration. That is a significant security achievement in itself, says Slangsvold.
What makes the project especially interesting is that Netsecurity originally built this fabric network only at Layer 2. This means there are no VLANs or IP addresses that potential attackers can exploit to gain access to the network.
Network access control was another element the customer wanted to implement, and this feature now covers around 98 percent of all the ports in their network. The implemented ExtremeControl solution gives Sporveien centralized and advanced control over all endpoints across the entire network. The ability to locate, authenticate, and apply targeted policies for users and devices has been important in further strengthening Sporveien's network security.
One of Sporveien's key priorities in the network modernization was also to rethink the wireless part of the infrastructure. The purpose was to facilitate a mobile and flexible working environment. Gullberg and his colleagues envisioned the wireless network as something much more than just a primary access method for employees.
– First and foremost, we wanted all employees to have seamless connectivity in every nook and cranny of every office. We also wanted to extend the wireless network to cover the vehicle maintenance areas, which are very large. In addition, we are taking the opportunity to collect data from trams that stop at the stations. This data is forwarded to the transport managers. In other words, we needed good coverage and capacity in some fairly challenging environments, both indoors and outdoors, says Gullberg.
Netsecurity's solution was to deploy more than 600 WiFi 6 access points from Extreme Networks. The new wireless infrastructure was designed in a way that maximizes the capabilities of the devices. The industry's first software-defined 802.11ax access points support not only dual 5 GHz capacity, but also two software-programmable modes that allow Sporveien's IT department to manage radios optimally to deliver the highest possible client performance. All of this can be done very easily – either locally or in the cloud with the implementation of the ExtremeCloud IQ management platform suite.
In an IT environment as large and complex as Sporveien's, it is important that network management is centralized and unified. This enables the IT department to work more efficiently and meet the ever-growing needs of the business.
That is why Sporveien decided to implement ExtremeCloud IQ – Site Engine, a comprehensive platform for network management. It enables task automation, real-time analytics, service monitoring, and orchestration – all from a single, flexible, and user-friendly dashboard that makes it possible to view the entire network and all network devices without having to stitch together multiple pieces of software.
The implementation of the ExtremeAnalytics solution also gave Sporveien a centralized, advanced overview of all user software running on their network, as well as that software's performance relative to overall network performance. This helps network operators identify any need for intervention and determine exactly which software may need troubleshooting.
– Sometimes people complain about a slow network connection, when the problem in reality is not in the network, but in the software. Previously, we would have spent a lot of time proving the network's innocence, but now we can simply take a quick look in ExtremeAnalytics to find the software that is responding slowly or not responding at all. That means we no longer have to grope in the dark, and we can fix problems much faster, Gullberg concludes.