Customer Profile
A healthcare enterprise scaling across dozens of sites
The organization operates multiple hospitals, auxiliary care facilities, and clinics, supported by two primary data centers. Site scale varies significantly across the network — from large campus hospitals to single-router clinics — requiring an architecture that could serve every facility type on one consistent platform.
2
Primary data centers anchoring the network backbone
Dozens
Interconnected hospital, auxiliary, and clinic sites
65,000+
Hosts on the largest campus hospital sites
1
Access router at the network's smallest clinics
Business Challenge
Integrating acquisitions without disrupting existing operations
The healthcare system was undergoing rapid expansion through the acquisition of new hospitals and clinics. Each newly acquired facility needed to be integrated into the existing network in a phased, non-disruptive manner — while the network as a whole had to support facilities of vastly different sizes on a single, scalable design.
Phased facility acquisition
New hospitals and clinics needed to be integrated in a phased, non-disruptive manner as the organization continued to grow.
Patient-data protection was a core requirement
Regulatory requirements for patient-data protection required granular access control, encrypted management, and per-service firewalling throughout the network.
Strict traffic segmentation
Clinical, administrative, and guest traffic required strict separation across every site in the network.
High availability for life-critical systems
Life-critical medical applications required high network availability, with multicast support for medical imaging distribution.
Scaling across vastly different facility sizes
The design needed to accommodate everything from large campus hospitals to small single-router clinics.
Security requirements
Security was equally critical. Regulatory requirements for patient-data protection demanded granular access control, encrypted management, and per-service firewalling across the network, alongside strict segmentation between clinical, administrative, and guest traffic.
Architecture
A hierarchical IP/MPLS backbone with tiered facility connectivity
The solution deployed a hierarchical IP/MPLS network with four core routers across two data centers providing the backbone, and PE routers at each hospital or clinic providing local aggregation.
Facility Tiers
Four tailored topologies, one consistent platform
Hospital sites were classified into four tiers — Campus, Small, Auxiliary, and Clinic — each with a network topology tailored to its scale.
Campus
- Dual PE routers
- MC-LAG connectivity to access switches
- 10GE+ uplinks to the core
- Layer 2 satellite switches for port extension
- Local firewall pairs
Small
- Dual-PE design
- 1GE or 10GE uplinks
Auxiliary
- Ring or hub-spoke connectivity
- Connects through a parent Campus or Small hospital
Clinic
- Single PE router
- Simplified connectivity
Routing & Resiliency
Deterministic, efficient routing across the backbone
A multi-area IS-IS design kept routing tables efficient, while RSVP-TE LSPs provided deterministic traffic paths with Fast Re-Route protection. BGP route reflectors at the data-center and hospital levels distributed VPN routes with constrained distribution to limit unnecessary route propagation.
Multi-area IS-IS
Keeps routing tables efficient across the backbone as the network scales.
RSVP-TE LSPs & Fast Re-Route
Provide deterministic traffic paths across the backbone, with Fast Re-Route protection.
BGP route reflectors
Deployed at the data-center and hospital levels to distribute VPN routes across the network.
Constrained route distribution
Limits unnecessary VPN route propagation across the network.
Services Delivered
Segmented services purpose-built for hospital operations
The network supported Layer 2 extension, multiple VPRN instances for distinct traffic domains, inter-VPRN firewalling, gateway redundancy, multicast for medical imaging, and comprehensive QoS for real-time medical applications.
VPLS
Layer 2 extension across sites.
Multiple VPRN instances
Dedicated instances for clinical, administrative, biomedical, building management, and guest networks.
Inter-VPRN firewalling
Secure, controlled access across traffic domains.
VRRP & BFD
VRRP-based gateway redundancy with BFD health checking.
PIM-based multicast
Supports medical imaging and video distribution across the network.
QoS, WRED & hierarchical scheduling
Comprehensive QoS ensures priority for real-time medical applications.
Security & Segmentation
Security built around segmentation, access control, and visibility
Regulatory requirements for patient-data protection demanded granular access control, encrypted management, and per-service firewalling — delivered through strict segmentation, inter-VPRN firewalling, management-plane hardening, and comprehensive logging.
Security and segmentation as part of the network architecture
Regulatory requirements for patient-data protection demanded granular access control, encrypted management, and per-service firewalling — delivered through strict segmentation, inter-VPRN firewalling, management-plane hardening, and comprehensive logging.
Strict service segmentation
Clinical, administrative, biomedical, building management, and guest networks are kept separate through dedicated VPRN instances.
Granular access control & encrypted management
Required to meet regulatory obligations around patient-data protection.
Per-service & inter-VPRN firewalling
Firewalling is applied per service and between VPRN instances for secure cross-domain access.
Management-plane hardening & logging
Comprehensive logging and management-plane hardening support the organization's regulatory compliance requirements.
Migration Approach
Phased onboarding designed to avoid disruption
Integrating newly acquired facilities into the existing network
A three-phase migration process enabled seamless integration of newly acquired facilities, allowing new sites to be onboarded without disruption to existing operations.
Results & Benefits
A unified platform supporting every facility type
Unified network platform
A single platform supports all facility types with consistent service delivery across the network.
Cost-effective, tiered scaling
The tiered design allows cost-effective scaling from small clinics to large campus hospitals.
Non-disruptive onboarding
The phased migration approach enables new facility onboarding without disruption to existing operations.
Security and regulatory requirements
Per-service segmentation, management-plane hardening, and comprehensive logging help meet healthcare regulatory compliance requirements.
Centralized, service-aware management
Centralized network management through a service-aware management platform reduces operational overhead across all sites.
Conclusion
A tiered IP/MPLS platform built for healthcare-scale growth
By combining a hierarchical IP/MPLS backbone with facility-tier-specific topologies, the healthcare system gained a single network platform capable of supporting campus hospitals, small hospitals, auxiliary facilities, and clinics alike. The three-phase migration approach allowed newly acquired sites to be integrated without disrupting existing operations, while strict segmentation, per-service firewalling, and centralized service-aware management supported the organization's regulatory compliance requirements and reduced operational overhead across the network.
Get in touch
Discuss your network modernization requirements with Telence Solutions
Explore how Telence Solutions can support complex enterprise network transformation for healthcare organizations navigating network modernization.
Contact Our Team