Command Communication System Network and System Architecture

1 Core Function Implementation

For inter-site communication, a dedicated network optimization solution (IP tunnel) is designed and deployed to ensure voice and message transmission quality; the solution includes an independent external line backup link that supports automatic switching when the primary link quality degrades, and provides a detailed network topology and switching test plan; the system adopts a B/S architecture with containerized deployment, and deploys a recording service to achieve unified recording, storage, management, and playback of all calls.

2 Dedicated Network Optimization Solution

(1) Network Topology Design

A "dual-link + dual-IP tunnel + QoS optimization" network architecture is adopted. A domestically produced high-performance load balancer, firewall, and VPN gateway are deployed at each of the two sites, Beijing and Nanjing, to achieve secure, low-latency, and highly reliable communication between the two locations.

Primary link: An encrypted tunnel is adopted with QoS policies configured, setting voice, signaling, and audio/video streams to the highest priority to guarantee real-time communication services;

Backup link: An independent carrier MPLS dedicated line is provisioned as a physical backup link, with a backup encrypted tunnel established to form redundancy with the primary link;

Network partitioning: Both sites adopt a network partition design with DMZ zone, application zone, and data zone. Each zone is subject to strict access control through firewalls, with only necessary ports and services opened to ensure network security.

(2) Link Automatic Switching Mechanism

BFD (Bidirectional Forwarding Detection) technology built into the router is used to perform real-time detection of latency, packet loss rate, and bandwidth utilization on both the primary and backup links, with a detection interval of ≤500ms;

Switching trigger conditions: When the primary link latency exceeds 100ms, packet loss rate exceeds 5%, or the link is interrupted, the system automatically and seamlessly switches to the backup link, with a switching time of <1s. During the switching process, voice, message, and audio/video communications remain uninterrupted and lossless;

Switch-back: When the primary link recovers, the system can automatically switch back to the primary link or be manually switched back based on configuration, with no service interruption during the switch-back process either.

(3) Switching Test Plan

A detailed link switching test plan is provided. Before system deployment and go-live, multi-scenario simulated fault switching tests are completed to verify switching reliability and business continuity. Upon completion of the tests, a complete switching test report is provided.

Test Scenario	Test Content	Test Metrics	Acceptance Criteria
Manual disconnection of primary link	Verify continuity of voice, message, and VHF communication	Switching time <1s, no interruption, no packet loss	Switching successful, services normal
Primary link network congestion	Simulate high latency and high packet loss on the primary link, verify automatic switching	Switching time <1s, no significant impact on services	Automatic switching successful, performance stable
Primary link port failure	Simulate firewall port failure on the primary link, verify automatic switching	Switching time <1s, no interruption, no packet loss	Automatic switching successful, services normal
Primary link recovery and switch-back	After primary link recovery, verify the switch-back process	Switch-back time <1s, no interruption, no packet loss	Switch-back successful, services normal

3 Highlight Features

Network status visualized monitoring: A Beijing-Nanjing inter-site network status monitoring dashboard is built to display in real time the latency, packet loss rate, bandwidth utilization, and tunnel status of both the primary and backup links. When network anomalies occur, multi-channel alerts are triggered via system pop-up, WeChat Work, and SMS to facilitate timely troubleshooting by operations personnel;

Intelligent bandwidth scheduling: Intelligent bandwidth scheduling based on service type is supported. When real-time services such as voice and audio/video are transmitted simultaneously with non-real-time services such as file transfer, bandwidth is preferentially allocated to real-time services to ensure the quality of real-time communication;

Domestic network equipment: All network equipment (load balancers, firewalls, VPN gateways) adopts domestically produced equipment, compatible with Phytium/Kunpeng CPUs and Kylin OS, meeting information technology application innovation (Xinchuang) security requirements. Redundant equipment configuration is also provided to avoid single points of failure.