Digital and network infrastructure provides the essential foundation for delivering the digital services, application platforms and security models described in the other sections on the University’s digital transition.

The University’s digital infrastructure is a strategic asset for implementing digital transformation policies in support of teaching, research and administrative services. The architectural model focuses on network resilience, the rationalisation of local infrastructure and a predominantly cloud-first / cloud-only approach to delivering core services.

The University’s data network interconnects its sites in Varese, Como and Busto Arsizio through a dark fibre backbone, with connectivity to the GARR network at its points of presence (PoPs) in Milan. The topology is designed to ensure operational continuity and redundancy, with a ring backbone and backup links over SPC infrastructure.

The logical architecture comprises several functional layers (Border Router, Campus Distributor and Building Distributor), with dynamic routing protocols (BGP for external routing and OSPF internally) and network segmentation through VLANs and dedicated policies for the different service domains (clients, servers, telephony and IoT).

The University network has the following general characteristics:

• the capacity of the University backbone has been progressively upgraded to 10 Gbps, in line with the University’s connection to the new GARR-T network;
• wired access connections provide 1 Gbps ports with PoE for network equipment, telephony and other technological devices;
• Internet connectivity is provided through redundant links to ensure service continuity.

These capabilities support intensive use of digital platforms for teaching and research, as well as the delivery of centralised services across the University.

The University’s Wi-Fi coverage extends to all sites and is based on the eduroam service, with the infrastructure undergoing a comprehensive technological upgrade (Wi-Fi 6/7). Remote access to internal services is provided through a VPN with differentiated access profiles for different user groups (technical and administrative staff, academic staff, researchers and doctoral students), supporting flexible working and academic mobility.

The University adopts a secure access model for network resources that extends beyond remote working and is also widely used for accessing internal services and systems. 

The widespread use of secure connections strengthens network access control, reduces the direct exposure of services and ensures consistent levels of security regardless of the user’s physical location. 

This approach makes a significant contribution to protecting digital infrastructure and mitigating the risks associated with unauthorised access or lateral movement within the network.

All University devices, including computers and network printers, use private IP addresses and are not directly exposed to public networks. The systematic use of network address translation and network segmentation provides a structural reduction in the attack surface, improves control over traffic flows and enhances the overall security of the infrastructure. 

This configuration is a fundamental infrastructure measure supporting the security policies, monitoring systems and endpoint management models adopted by the University.

To support its institutional activities, the University provides and manages core infrastructure services, including institutional email, name resolution services and other network services essential to the operation of its information systems. 

These services are designed and managed in line with the principles of reliability, operational continuity and security. They form a fundamental part of the digital ecosystem underpinning the application platforms, teaching services and security models described in the other sections on digital transition.

For several years, the University has used a telephony model based entirely on VoIP technologies, integrated into its network infrastructure and designed to ensure reliability, operational continuity and flexibility of use. The service is delivered through both physical handsets, still available at many workstations, and software solutions that enable users to make and receive calls through an application, supporting a gradual transition towards more flexible and integrated communication models.

Over time, the University has assessed and trialled unified communications solutions integrated with collaboration platforms to analyse their organisational, technical and financial implications. These assessments have guided the University towards solutions considered more sustainable over the medium to long term, taking account of the existing infrastructure, efficiency requirements and the need to control overall operating costs.

The University also takes a structured approach to managing mobile devices used for institutional activities, such as mobile phones and tablets, procured through national framework agreements and integrated into the overall endpoint management model. These devices are administered through centralised management solutions that enable consistent security, configuration and data protection standards to be applied, in line with the policies adopted for conventional workstations.

In particular, this model enables a clear separation between institutional and personal use, safeguarding University data while respecting users’ privacy. This approach supports flexible and sustainable use of mobile devices, reduces operational risks and ensures continuous, secure access to the University’s digital services while on the move.

The University’s digital infrastructure also includes digital identity management systems, which enable secure and consistent access to institutional services. The adopted model provides for the centralised creation and management of identities within the University’s directory environments, integrated and synchronised with the cloud services used by the University. 

This approach ensures operational continuity, resilience and scalability, while providing a consistent sign-in experience across digital services for different user groups and coherent management of security and authorisation policies.

As part of its digital identity services, the University uses strong authentication mechanisms, including multi-factor authentication, to support access to institutional and cloud services. These mechanisms are integrated into the identity management model and help strengthen access security while ensuring scalability, resilience and a consistent user experience across different user groups.

The University’s digital identity services are integrated with the main national identity systems, including SPID and the Electronic Identity Card (CIE), to provide secure access methods that comply with the regulatory framework for external users and specific institutional services. The University also participates in the IDEM federation, the national authentication and authorisation infrastructure for the academic and research community, which enables federated access to numerous shared services using institutional credentials.

In parallel, the University adopts an identity federation model spanning multiple access domains, differentiated according to service characteristics and the security assurances required. In particular, access to applications within the national university system and to federated services relies on standardised authentication mechanisms, while the University’s cloud services use authentication and authorisation models that provide more advanced control over access conditions, including adaptive and context-aware security policies. This approach balances interoperability, security and operational continuity, avoiding the forced consolidation of identity systems that could reduce control over specific critical areas.

The University’s data centres were classified as Class C in the AGID census. This has guided strategic decisions towards a substantial reduction in investment in on-premises infrastructure and an extensive migration of services to cloud platforms, particularly Microsoft Azure and SaaS solutions delivered by qualified providers (e.g. Cineca).

This model has enabled:

• the rationalisation of local server numbers and backup infrastructure;
• greater scalability and reliability of digital services;
• the repurposing of space freed up in local data centres to meet departmental research computing needs.

Taken together, the University’s network infrastructure and digital services reflect a strategy focused on:

• the centralisation and standardisation of platforms;
• cloud-only as the predominant architectural approach for institutional services;
• resilience, security and operational continuity as core requirements;
• a gradual shift in emphasis from local hardware to the quality of digital services and the user experience.

This infrastructure provides the technical and organisational foundation for the University’s digital transformation initiatives, as outlined in its institutional planning and self-assessment documents.