Branch Role for Off-Campus Sites

This role is only deployed to off-campus sites that have only a few number of managed endpoints requiring network connectivity. Printers, audio/video, cameras, IoT devices and others are assigned this network role. The intent is to simplify engineering and deployment of network access rather than have network roles in place with only a single device assigned.

Network role at a glance:

• Wired connectivity only
• Private IP addressing with network address translation (NAT) for traffic destined off-campus
• DHCP reservations are not supported. Dynamic DNS used instead.
• All outbound traffic permitted
• Inbound traffic limited to management tools, print services and audio/video streaming (from Ohio State endpoints)

Network Role Characteristics

Aliases for this role include

• Branch
• osu-branch

Network Traffic Permissions

No outbound traffic limitations are applied to this network role.

Inbound traffic is limited to:

• IT management tools (e.g., Active Directory, Config Manager, Jump hosts, etc.)
• Remote access tools (e.g., Guacamole, RDP gateway, etc.)
• Screen sharing and audio/video streaming from Ohio State endpoints only
• Printing commands from permitted print servers

How to connect

OTDI staff must register a device’s wired MAC address, as permissions to register devices for this network role has been limited. OTDI will review each request and perform a risk assessment. If assessment passes, OTDI will register the device(s) on behalf of the requester.

Once registered, connect the device to a wired port on OTDI’s Managed Network Service at one of the following sites:

IP (Internet Protocol) Addressing

Devices placed in the Audio Video role are assigned private IPv4 address space dynamically assigned through DHCP. IP address reservations are not supported. Traffic destined off-campus to non-Ohio State address space will have the source IP translated to routable IPv4 public address space. However, traffic destined to Ohio State address space will retain the original private source address and not be translated. IPv6 addresses are not currently supported for this network role.

After receiving an IP address, the campus DHCP service will dynamically create a DNS A record for the endpoint in the DNS zone branch.role.it.osu.edu. For example, an endpoint with hostname “device123456” would have a DNS record of device123456.branch.role.it.osu.edu. In the event the endpoint has no configured hostname, the mac address of the device will be used instead.