HSCN Internet Protocol (IP) addressing policy
This HSCN Internet Protocol (IP) addressing policy defines the legitimate addressing schemes and the working principles for their use. This policy statements set out in this document are necessary to underpin the transition to the HSCN in support of the business needs of health and social care.
- The HSCN IP addressing policy
- Compliant IP addresses
- Non-compliant IP addresses
- Network Address Translation (NAT)
- Requests for additional HSCN RIPE addresses
- Return of HSCN registered RIPE address space
- Authorisation and allocation process
- Further information and enquiries
- Glossary of terms
The Health and Social Care Network (HSCN) programme will deliver new and significantly different network services for health and social care as part of its remit to provide successor services to the current N3 network. The HSCN will create the effect of a single network across health and social care providers and their partners. All health and social care organisations (in England) are within scope of the HSCN solution, which supports greater integration of care delivery.
This HSCN Internet Protocol (IP) addressing policy defines the legitimate addressing schemes and the working principles for their use, to support the smooth transition to the HSCN, ensure continued access to Transition Network (TN) services (such as national applications), and to provide a solid infrastructure for IP networking in health and social care. This policy statements set out in this document are necessary to underpin the transition to the HSCN in support of the business needs of health and social care.
The HSCN IP addressing policy applies to all direct connections to the HSCN from organisations of all types, such as NHS, social care, and third party organisations such as application providers.
The HSCN implements standards and policies to support existing connectivity and services and in parallel will work to ensure that the structure and frameworks are in place for a seamless transition to the cloud/internet environment.
NHS Digital recognises that existing connectivity and services use a number of different addressing schemes and that a mandatory move towards a public address scheme in the short term is, for many organisations, unachievable due to cost, impact on existing services, timescales, and other factors.
To support this, the HSCN IP addressing policy is set out in a hierarchical structure.
Registered Réseaux IP Européens (RIPE) addresses at the point of connection for new and migrated connectivity services.
HSCN registered RIPE allocations will typically comprise of either a /31 or /30 subnet per connection. See section "Requests for additional HSCN RIPE addresses" for more information. These RIPE addresses may be newly allocated by NHS Digital, or previously allocated (by NHS Digital or predecessor organisation). Predecessor organisations include Health and Social Care Information Centre, NHS Connecting for Health, NHS Information Authority, or Central/Local Communications Management Group, or locally 'owned' legitimately assigned to the connecting organisation by RIPE Network Coordination Centre (NCC).
The use of 'NHS private' address space (centrally allocated subnets from the 10.0.0.0/8 and 172.17.0.0 - 172.31.255.255 space), for HSCN connectivity and to advertise hosted services may be maintained upon migration to the HSCN.
- The allocation of HSCN RIPE addresses will be managed by the HSCN operations IP address management (IPAM) team
- The HSCN network will support Network Address Translation (NAT)
- RIPE addresses owned and allocated by NHS Digital (or predecessor organisation) must not be shared outside of the HSCN or be presented as a viable route reachable from the internet
- RIPE address allocations made by NHS Digital (or predecessor organisation) that are no longer required during the life of the HSCN service must be returned. See "Return of HSCN registered RIPE address space" for more information.
The following IP address schemes are valid for connection to and routing across the HSCN.
- NHS Digital allocated RIPE addresses for use at the point of connection to the network.
- Valid assigned RIPE addresses
- 'owned' by and assigned to NHS Digital with RIPE NCC and allocated to customers by NHS Digital (or predecessor organisation).
- 'owned' by the connecting organisation and assigned to that organisation by RIPE NCC.
- Addresses and subnets from the 'NHS private address space' (10.0.0.0/8 and 172.17.0.0 to 172.31.255.255) that were allocated by the predecessor network, NHS national network (N3) or the Transition Network (TN), service provider.
- Addresses and subnets from the RFC1918 private address space 192.168.0.0/16 will not be routed across the HSCN.
- Addresses and ranges from the RFC1918 private address space previously adopted as 'NHS private address space' (10.0.0.0/8 and 172.17.0.0 to 172.31.255.255) that have been deployed independently, meaning those not allocated by the predecessor network service provider, are deemed non-compliant and will not be routed across HSCN.
- RIPE addresses and subnets, meaning not held or assigned to the organisation, will not be routed across the HSCN. NHS Digital is not responsible for any instances of litigation against organisations that knowingly or otherwise route 'illegal' IP addresses to the Internet.
Network Address Translation (NAT) is supported at the point of connection to HSCN to aid the allocation and use of registered RIPE addresses at all connection points to the HSCN and to allow organisations to maintain existing internal addressing. Connecting organisations can refer to the HSCN IP addressing good practice guidelines document for guidance on the use of NAT and other key protocols and methods within HSCN.
Health and social care organisations that connect to the HSCN, and adopt a HSCN allocated RIPE address and NAT at the point of connection, may apply for an additional allocation of HSCN RIPE addresses. This may be, for example, to support the advertisement of hosted services that cannot currently be configured to work with NAT. Requests for additional HSCN allocated RIPE addresses are made via the IP authorisation and allocation request process.
It is important to note that the pool of HSCN RIPE addresses is a limited resource therefore requests will be carefully scrutinised and allocations rigorously controlled. NHS Digital does not prevent the use of RIPE ranges already owned by the connecting organisation, or organisations obtaining additional subnet assignments from RIPE.
Given that the HSCN RIPE address pool is a finite resource, requests for additional RIPE addresses from health and social care organisations will be prioritised. Therefore, commercial third party Supplier organisations that need to advertise services across the HSCN are advised to use locally owned RIPE assigned addresses or obtain additional subnets from RIPE NCC.
A substantial amount of RIPE registered address space registered to NHS Digital is still allocated to a number of public and private sector organisations. It is essential that any NHS Digital assigned RIPE address space that is not in use, no longer required, or in use on private networks, should be identified and returned to NHS Digital.
Organisations may return NHS Digital owned RIPE addresses. NHS Digital will actively pursue the return of allocated registered RIPE address space. This activity will be managed by the NHS Digital HSCN IPAM function.
NHS Digital manages and administers the HSCN IP addressing policy and the IPAM function. The IPAM function manages the allocation and return of subnets from the HSCN IP address space.
For further information and enquiries please email the HSCN IPAM team at firstname.lastname@example.org.