Network Systems Requirements - Accuray

CYBERKNIFE I.T GUIDE
WI 1022517
REV A
DEPT. MANAGER: R. RONQUILLO
(SEE DOCUMENT SERVICES FOR
SIGNED/APPROVED ORIGINAL DOCUMENT)
Accuray Confidential
Copyright © 2013 Accuray Incorporated
APPROVAL
DATE: 11/30/12

Installation IT Guide
Accuray Confidential
Revision History
Rev. ECO # Description of Change Revised By Date
A 7152 Initial Release. T. Chieng
J. Moran
12/17/12
Verify Latest Printed Version Before Using Page 2 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
Table of Contents
1 DEFINITIONS .......................................................................................................... 4
2 CYBERKNIFE® SYSTEM NETWORK .................................................................. 5
2.1 Description ......................................................................................................... 5
2.2 System Overview ............................................................................................... 7
2.3 Network Overview .............................................................................................. 7
2.4 CyberKnife® System Network Configuration ..................................................... 9
2.5 CyberKnife® System Treatment Network Plan ................................................ 11
3 INTERNAL NETWORKING PORT DIAGRAM ................................................... 13
4 CYBERKNIFE® DATA MANAGEMENT SYSTEM............................................. 14
4.1 Data Server ...................................................................................................... 14
4.2 Administration Workstation (option – CK 9.x ONLY unless site is an upgrade . 14
4.3 Storage Vault (option) ...................................................................................... 15
5 DISASTER RECOVERY ....................................................................................... 15
6 DICOM ................................................................................................................... 15
7 REMOTE WORKSTATIONS ................................................................................ 15
8 CUSTOMER SUPPORT REMOTE ASSISTANCE ............................................. 15
9 CYBERKNIFE ACCESS TM ................................................................................... 16
10 MULTIPLAN® REMOTE ACCESS ...................................................................... 16
11 NETWORKING REQUIREMENTS ....................................................................... 16
APPENDIX - NETWORK CONFIGURATION ............................................................ 18
Verify Latest Printed Version Before Using Page 3 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
1 Purpose
1.1 The purpose of this document is create an overview of the the cyberknife network
as reference for Hospital IT departments, Accuray Installation & Site Planning
departments, and Accuray Field Service – CyberKnife.
2 Responsibilities
2.1 Field Service – CyberKnife is responsible to updating and maintaining this
document.
Verify Latest Printed Version Before Using Page 4 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
3 Definitions
3.1 CDMS: CyberKnife® Data Management System: The subsystem that manages the
data of the CyberKnife.
3.2 UCC: User Control Console. The computer that performs treatment delivery on
patients.
3.3 VLAN: Virtual Logical Area Network. An OSI model layer 3 construct designed to
separate one network into many logical networks. CyberKnife networks have
switches using VLANs to separate critical devices (e.g. CDMS, UCC) from non
critical treatment devices (e.g. MultiPlan).
4 Reference Documents
4.1 WI 1024437A CK10.X NETWORK INSTALL AND CONFIGURATION
5 Definitions
5.1 UCC: User interface to Treatment Delivery System
5.2 IFCC: Controls communications between robot and Linear Accelerator.
5.3 MTS: Synchrony (motion tracking)
5.4 TLS: Imaging System
5.5 CDMS Data Server: Database server
5.6 MultiPlan (may exist outside LAN)
5.7 MD Suite (optional, may exist outside LAN)
5.8 LAN: Local Area Network
6 CyberKnife® System Network
6.1 Description
The Accuray CyberKnife® Robotic Radiosurgery System is an FDA cleared medical device. As such, we
are limited in what changes we can allow to the approved configuration of the system, which includes all
internal connections and networking which allow the system to operate properly. All devices that are a
Verify Latest Printed Version Before Using Page 5 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
part of the CyberKnife® System should be considered as a black box environment and part of an
approved, tested configuration.
The CyberKnife® System is composed of several computers running Windows and Red Hat© Enterprise
Linux operating systems. They are connected to a managed switch, which contains the traffic of the
various devices within various VLANs. The switch is attached to a router, which connects the
CyberKnife® System to the hospital network. The Treatment Planning devices may be connected to the
CyberKnife® System or to the hospital.
Imposing any specific controls on the connection to the CyberKnife® System will be at the full discretion
of the hospital, however, the CyberKnife® System devices themselves cannot be modified, and the
requirements listed under section 10 must be fulfilled to maintain full operation of the CyberKnife®
system. Accuray will abide with hospital policies to the point that the system configuration is not changed.
If you have any questions or feedback regarding the CyberKnife® System, or about this document
specifically, please contact Accuray Customer support by email at customersupport@accuray.com or
by calling 1.877.668.8667.
Verify Latest Printed Version Before Using Page 6 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
6.2 System Overview
The CyberKnife® LAN contains the following parts:
• UCC: User interface to Treatment Delivery System
• IFCC: Controls communications between robot and Linear Accelerator.
• MTS: Synchrony (motion tracking)
• TLS: Imaging System
• CDMS Data Server: Database server
• MultiPlan (may exist outside LAN)
• MD Suite (optional, may exist outside LAN)
6.3 Network Overview
The CyberKnife® System network configuration is controlled by two devices:
CK 9,x Network Hardware
• Cisco ASA 2821 Firewall
• HP ProCurve 2824 Switch
CK 10.x Network hardware
• Cisco ASA 5510 Firewall
• Cisco 2960 Switch
The Cisco router/firewall contains rule lists that separate the hospital LAN from the CyberKnife® System
LAN, so as to prevent computers not explicitly allowed with CyberKnife® System treatments from
accessing the CyberKnife® System LAN.
The network switch uses VLANs to divide its ports. VLANs allow for a higher degree of control in the
CyberKnife® System LAN, and it separates the user devices, such as MultiPlan, from the control
devices, such as the CDMS Data Server.
In one treatment network, there are three VLANs: the primary VLAN 185, the secondary VLAN 184, and
the CDMS VLAN 183. The primary VLAN contains the treatment delivery system, whereas the secondary
VLAN contains all the user devices, like MultiPlan, and finally, the CDMS VLAN only contains the CDMS.
The use of VLANs provides another layer of security for the CyberKnife® System LAN, however, it adds a
restriction where each device connects to a specific port on these switches.
Each network device uses Category 6 Ethernet cables, to provide up to 1 Gbps, or 1000 Mbps,
bandwidth.
Each network has special port-forwarding rules to allow the communication of various devices within the
CyberKnife® network with devices located on the hospital LAN:
Hospital traffic (Local)
• DICOM: Medical image transfer with CyberKnife® System devices and hospital modalities, e.g.,
PACS, CT, PET, etc.
o
o
Traffic is initiated either inbound or outbound, based on the initiator of the traffic.
Uses TCP/104.
• CDMS: Stores and retrieves all CyberKnife® System related data, including planning/treatment.
o
o
Traffic is initiated inbound to the CyberKnife Data Management System.
Uses TCP/4000-4099. Primary port is TCP/4027.
Verify Latest Printed Version Before Using Page 7 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
• OIS: Oncology information systems
o Traffic is initiated outbound to OIS devices.
o Uses configurable Port Addresses per vendor.
• Miscellaneous: FTP, telnet and SSH access to the treatment delivery system.
o
o
Internet traffic (Remote)
Traffic is initiated inbound to CyberKnife® System.
Uses TCP/21 for FTP, TCP/22 for SSH, and TCP/23 for telnet.
• FTP: Transfers diagnostic files from the CyberKnife® System to Accuray for diagnostics and
troubleshooting purposes over an encrypted channel.
o
Secure FTP is initiated outbound to ftps.accuray.com.
o The public address assigned to ftps.accuray.com is 67.108.13.71.
o FTPS transfers data in passive mode on TCP/990, 2000 - 2011.
• Symantec Anti-virus definition updates: Provides anti-virus definition update services to Symantec
anti-virus clients installed on Multiplan and MD Suite planning workstations.
o
Traffic is initiated outbound to araysep.accuray.com.
o The public address assigned to araysep.accuray.com is 67.108.13.94
o
Uses TCP/443 or TCP/8014.
• CyberKnife Access TM Remote Service: Provides real time remote access to support the
CyberKnife® System remotely.
o
Traffic is initiated outbound to www.cyberknifeaccess.com.
o The public address assigned to www.cyberknifeaccess.com is 209.202.167.23.
o
Uses TCP/443 or TCP/17002.
• MultiPlan® Remote Access: Accuray and/or authorized hospital personnel can connect to
planning stations remotely, and perform necessary planning tasks.
o
Traffic is initiated outbound to www.gotomypc.com and poll.gotomypc.com
o The public address assigned to www.gotomypc.com is 66.151.158.183.
o The public address assigned to poll.gotomypc.com is 66.151.158.177.
o
Uses TCP/443 or TCP/8200.
• GoToAssist: Accuray Customer Support personnel may log in remotely, with customer’s
permission, to access the system to diagnose and troubleshoot issues that may occur.
o
Traffic is initiated outbound to www.gotoassist.com and broker.gotoassist.com.
o The public address assigned to www.gotoassist.com is 216.115.210.200.
o The public address assigned to broker.gotoassist.com is 216.115.210.202.
o
Uses TCP/443 or TCP/8200.
Verify Latest Printed Version Before Using Page 8 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
6.4 CyberKnife® System Network Configuration
Verify Latest Printed Version Before Using Page 9 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
Verify Latest Printed Version Before Using Page 10 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
CyberKnife® System Treatment Network Plan
Verify Latest Printed Version Before Using Page 11 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
CyberKnife® System Network Plan Notes:
1. Patched connections from equipment room to control room for field service access and spare.
2. Connection to facility network. Two (2) direct connections (RJ-45 drops) from hospital switch to equipment room. 1 Gbps recommended.
a. Connection 1 patched into Cisco router. Provides inbound and outbound communications to/from hospital modalities.
b. Connection 2 left as spare or patched into Control Room for field service engineer’s access.
3. Router/firewall and switch in 19” rack. (Location may vary. Accuray supplied)
4. 8 direct connections for MultiPlans, Administration Workstation (optional), MD Suites, Printer, and future upgrades.
5. Use Category 6 cabling for 1 Gbps (1000 Mbps) connectivity.
6. Require 3 static IP address for:
a. Treatment Network (Forwarding IP)
b. Firewall Management
c. Field service connectivity
Verify Latest Printed Version Before Using Page 12 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
7 Internal Networking Port Diagram
CT, MRI, PET, etc.
MultiPlan or InView
Hospital Router/Firewall
`
DICOM
Hospital LAN
DICOM
CDMS
DICOM
104, 6000 - 6019
FTP
21
SSH
22
Telnet
23
CDMS
4000 – 4099
CyberKnife® Router/Firewall
DICOM
CDMS
FTP, SSH, Telnet
DICOM
`
CDMS
InView
CDMS
UCC
CDMS
CDMS
`
`
MD Suite
MultiPlan
Figure 3.1 – CyberKnife® Network Port Flow Diagram – Incoming
Figure 3.1 shows which ports and protocols that the router forwards to the appropriate device. Please
note Accuray supports the MultiPlan, InView and MD Suite devices either being inside and/or outside the
CyberKnife® System network.
Verify Latest Printed Version Before Using Page 13 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
8 CyberKnife® Data Management System
The CyberKnife® Data Management System (CDMS) provides patient data management to the
CyberKnife Systems. CDMS provides applications that allow the user to add, access, modify, export,
delete, and validate CyberKnife patient-related data.
The CyberKnife® Data Management System includes the following components:
8.1 Data Server
The data server hosts the CyberKnife® System database, DICOM server, and DRR Generation server.
All of the data on this server pertains to currently active patients. It is located in the Equipment Rack in
the Equipment Room.
The CyberKnife® System Data Server is configured with two sets of redundant hard drives, or volumes.
Each volume is in RAID 5 (Interleaved Parity) configuration for redundancy in case of hard drive failure:
1. 600 GB volume for live database and OS
2. 1000 GB (1 TB) volume for database backups
The CyberKnife specific data on the first volume is backed up to the second volume every two hours for
the purposes of data redundancy.
The Data Server supports the Disaster Recovery solution.
8.2 Administration Workstation (option – CK 9.x ONLY unless site is an upgrade
The Administration Workstation (Admin Workstation) option includes a computer, monitor, keyboard, and
mouse. The Admin Workstation includes a suite of applications to manage and interface with the data on
the Data Server. (These applications are also installed with the MultiPlan and MD Suite workstations.)
The suite of applications provides the following functionality:
1. User Administration
2. DICOM Administration
3. Patient Record Archive and Restore
4. Patient Administration
5. Image Review and Import
6. Beam Data Import
7. Plan Administration
8. Report Administration
9. System Administration
Once a patient treatment has completed, the patient record should be moved to the default network
location. The Administration Workstation can be specified as a network location, since it contains a
redundant volume, RAID 10, with approximate total of 1 TB (1000 GB) storage. The Admin Workstation
may be located anywhere based on the needs of the site, although it is recommended to be located on
the CyberKnife network.
The Administration Workstation supports the Disaster Recovery solution.
Verify Latest Printed Version Before Using Page 14 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
8.3 Storage Vault (option)
The Storage Vault option is a set of features for the management of CyberKnife data. It includes a
professional grade network attached storage (NAS) device, called the Vault, with approximately 10 TB
(10,000 GB) of fault-tolerant storage space. This device is designed to operate with the CyberKnife, and
is not meant as an external means of storage.
The Storage Vault will intelligently determine if the CyberKnife is running out of space, and will move the
patient record off the CyberKnife onto the Vault. If the patient record is needed later, the system will
automatically move it back to the CyberKnife. The records can be moved manually, if so desired. Thus,
there is virtually no need to move patient records. However, patient records can be moved to an external
network storage location as desired, or if the Vault is filled up with patient records.
The Storage Vault supports the Disaster Recovery solution.
9 Disaster Recovery
The Disaster Recovery solution is a built-in feature that provides mirroring of critical devices in the
CyberKnife system. Once provided with the network location and credentials, the Disaster Recovery
solution will be configured on each critical machine, which will provide a quick path to recovery from a
disaster scenario.
10 DICOM
The DICOM 3 Conformance Statement for the CyberKnife® System can be obtained by contacting
Accuray Customer support and requesting the latest revision to document P/N 019055.
The following is a list of supported image studies:
Type
Supported Patient Positions
Computed Tomography (CT)
Axial HFS, FFS, HFP, FFP
Magnetic Resonance (MR)
Axial HFS, Sagittal HFS, Coronal HFS
Positron Emission Tomography (PET) Axial HFS
X-Ray Angiography (XA)
Axial HFS, Coronal HFS
11 Remote Workstations
MultiPlan and MD Suite workstations located externally from the hospital network have additional
requirements due to the amount of data it needs to process and move within the network defined by a
minimum of 5 MB/s throughput from the device’s location to the CyberKnife router. This requirement is
necessarily for MultiPlan and MD Suites to be able to save plans without running into timeout issues.
12 Customer Support Remote Assistance
Citrix GoToAssist© is an Accuray solution to provide remote assistance for the CyberKnife. It provides
a remote desktop connection via an encrypted connection between the machine and the Accuray
Customer Support Representative.
Please go to http://www.gotoassist.com to find more detailed information, which includes additional
information on GoToAssist, including networking information, and HIPAA compliance.
Verify Latest Printed Version Before Using Page 15 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
13 CyberKnife Access TM
The CyberKnife Access TM remote service will enable Accuray Customer Support to proactively monitor,
diagnose and repair device problems remotely, resulting in an increase in system uptime by decreasing
the time required to detect and resolve reported system problems. In addition, remote servicing will
enhance the ability to detect root causes of a device failure, providing Accuray Customer Support the
ability to anticipate and resolve potential issues before they affect the clinical workflow.
14 MultiPlan® Remote Access
MultiPlan® Remote Access offers remote tools that allow users to remotely run the MultiPlan Treatment
Planning System from any location. Remote tools provide enhanced communication capabilities and are
giving CyberKnife® centers the ability to collaborate and outreach to remote facilities and physicians.
Ultimately these operational improvements are helping to maximize utilization and the bottom-line for our
customers.
15 Networking Requirements
The following network requirements are necessary to achieve a fully functional CyberKnife® System.
Accuray requirements:
1. Accuray will abide by all hospital IT policies so as to maintain the CyberKnife® System operation.
Accuray will send a statement in case any policy/policies affect any features in any manner.
2. Accuray will provide the hospital IT department with required CyberKnife® System network
information.
3. Accuray will assist hospital in DICOM image transfer connectivity issues from the CyberKnife®
System LAN to any hospital modality.
Hospital IT Department requirements:
1. Two static IP addresses per CyberKnife® System. One address is for the CyberKnife® System
Forwarding IP address, the second address is for CyberKnife® System router management. Both of
these IP addresses require one physical port.
2. One physical port with internet access for the Field Service Engineer for remote connectivity.
3. Various remote services require access to specific public IP addresses. These services require the
following outbound IP addresses and ports to be opened on the hospital gateway:
Name Description IP Address Ports
FTP (deprecated) Nonsecure FTP 67.108.13.69 TCP/21
Remote Diagnostics
Secure FTP
Secure FTP Remote
Diagnostics
67.108.13.71 TCP/990
TCP/2000-2011
Anti-Virus Updates Symantec anti-virus
definition updates
67.108.13.94 TCP/443
TCP/8014
CyberKnife Access TM CyberKnife Access TM
Remote Diagnostics
209.202.167.23 TCP/443
TCP/17002
MultiPlan® Remote
Access
Treatment Planning
Services
66.151.158.177
66.151.158.183
TCP/8200
TCP/443
GoToAssist
GoToAssist Remote
Diagnostics
216.115.210.200
216.115.210.202
TCP/80
TCP/443
TCP/80
Verify Latest Printed Version Before Using Page 16 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
216.115.208.0 /20
216.219.112.0 /20
66.151.158.0 /24
66.151.150.160 /27
66.151.115.128 /26
64.74.80.0 /24
202.173.24.0 /21
67.217.64.0 /19
78.108.112.0 /20
TCP/8200
4. Provide Accuray with the network configuration information listed in the Network Configuration
section, to allow Customer Service to diagnose and troubleshoot issues.
5. Inform Accuray Customer Support (customersupport@accuray.com, 1.877.668.8667) when a
network change may cause connectivity between any hospital modalities and the CyberKnife®
System LAN to be inoperable.
Verify Latest Printed Version Before Using Page 17 of 18 P/N 1022517, Rev. A

Installation IT Guide
Accuray Confidential
Appendix - Network Configuration
Accuray Sales – General, Site Planning and Installation in conjunction with Hospital IT:
Please fill out the entries below to document your site configuration. Please submit this document to the
appropriate site planner prior to installation.
Contact Information
Equipment Room Number: ( ) - Name: ____________________
Treatment Room Number: ( ) - Phone: ____________________
Control Area Number: ( ) - E-Mail: ____________________
Network Settings
Hospital Connection
(circle appropriate connection type)
IP Addresses
LAN T1 DSL Cable Forwarding IP Address: ____.____.____.____
Other ____________________
Management IP Address: ____.____.____.____
Field Service IP Address: ____.____.____.____
Hospital Subnet Mask: ____.____.____.____
Hospital Gateway IP: ____.____.____.____
Additional Devices
Modality
(circle appropriate)
IP Address
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
MultiPlan MD Suite Admin Workstation Printer ____.____.____.____
Disaster Recovery
Network Credentials
Network UNC Path
__________________ __________________ ___________________
__________________ __________________ ___________________
Verify Latest Printed Version Before Using Page 18 of 18 P/N 1022517, Rev. A