UK HSCN Overview
Sources: HSCN Network KB (TRIB 19537854848) · HSCN Customers (TRIB 19931889960)
What is HSCN?
HSCN (Health & Social Care Network) is a private Wide Area Network (WAN) used by NHS organisations and approved health and social care providers across England. It replaced the legacy N3 network.
HSCN provides:
- Private connectivity between NHS Trusts, GP surgeries, and approved third-party providers
- Isolation from the public internet for sensitive health data
- Compliance framework for organisations handling NHS data
Why RaaS Uses HSCN
UK NHS customers require their Rhapsody integration engines to communicate with hospital systems over HSCN rather than the public internet. RaaS connects to HSCN via:
- Redcentric — the HSCN network provider and our AWS Direct Connect partner
- StrongSwan VPN tunnels — IPsec tunnels from Redcentric into the management account EC2 instances
- AWS Transit Gateway — routes traffic from the VPN tunnels to customer VPCs
How the VPN Termination Works
HSCN customers do not have public-facing VPNs. Instead, they peer into the management account via two StrongSwan VPN servers (active/passive) in the management account (640815619001, eu-west-2). VPN connections to customers run from these StrongSwan servers.
| Node | IP | Role |
|---|---|---|
| hscn-vpn-termination01 | 10.104.29.4 |
Primary |
| hscn-vpn-termination02 | 10.104.29.20 |
Standby |
MTU / MSS Configuration
MTU must be set correctly
Incorrect MTU/MSS settings are the most common cause of HSCN VPN connectivity issues. Always verify these when troubleshooting packet loss or partial connectivity.
The HSCN VPN connection requires specific MTU and MSS values due to the overhead of IPsec encapsulation:
| Setting | Value | Notes |
|---|---|---|
| MTU | 1399 | Set on the VPN interface |
| MSS (standard) | 1330 | For AES-256 encryption |
| MSS (alternative) | 1320 | Used depending on encryption type |
MSS formula:
Where IKE_overhead depends on the cipher suite (40 bytes for standard, 64 for some configurations).
The DF-bit Problem
If a customer device is sending packets with the Don't Fragment (DF) bit set, and those packets exceed the MSS, they will be rejected by the VPN tunnel — resulting in silent packet drops or partial connectivity.
Troubleshooting questions to ask: - What device type is the customer using at their end? - What packet sizes are they using? - Is the DF bit set on their packets? - What is the MTU/MSS configured on the customer firewall?
Christie Resolution: Cisco device with jumbo frames enabled. Fix was to prevent the VPN from "clearing" the DF bit (allowing the firewall to handle fragmentation itself).
Prerequisites for HSCN Work
Before working on HSCN tasks, ensure you have:
- KeePass — for SSH private keys and DataDog API keys
- AWS Workspace (UK region) — needed for VPN-only network access
- Ansible Tower UK region access — System Administrator group required
- Redcentric SMAX portal access — for firewall change requests
Current HSCN Customers
See HSCN Customers for the full list of HSCN-connected customers with contacts.
Compliance
Sensitivity
HSCN infrastructure carries patient health data. Always follow security best practices and consult Lee before making changes to HSCN-connected resources.
Working with HSCN-connected infrastructure requires awareness of:
- NHS Data Security and Protection Toolkit (DSPT) requirements
- Handling of Patient Identifiable Data (PID)
- Network isolation — HSCN traffic must not route via the public internet
- Change control — changes to HSCN-connected infrastructure require approval from Franck Dakpogan or Brendon McAlevey