Addressing Security Issues and Deployment Approach for WAN - Coursework Example

Table of Contents Introduction 2 2 Addressing Deployment Approach for Departments 3 3 Addressing Security Issues and Deployment Approach for WAN 5 4 Hardware Specification 9 5 RAS Troubleshooting and Installation 9 6 Cost: 18 7 Windows Server 2008 20 8 References 23 1 Introduction For designing a network for the second building of the company requires a fit for purpose scalable network that will address future goals of the company. Currently we have two buildings and in the future there may be three buildings, i.e. more risk exposure. Moreover, critical assets of the company are located at the ground floor, as the company is located near river banks, there is a high probability of natural disasters i.e. floods etc. Furthermore, the distance between the two buildings is 120 meters that is manageable for connecting the sites physically. However, in case of configuring a wireless network, IEEE-802.11g Compliant will be recommended for covering the distance of 250 meters. Figure 1.1 demonstrates the current architecture and Figure 1.2 illustrates the network architecture for XYZ Corporation Figure 1.2 2 Addressing Deployment Approach for Departments Star topology is recommended for the wired local area network. It is the most widely adopted topology. The star topology supports the centralized provision of network resources and services. The support staff can manage the network administrative and troubleshooting tasks centrally. Star topology helps to implement centralized security architecture for improved and enhanced security of the network. The network implementation cost can be saved by provisioning the core systems located centrally. The security controls and backup systems are also located centrally for better troubleshooting and management. For deploying the local network for XYZ Corporation, CAT 5 cable is the best option. It supports both voice and data transmission. CAT-5 is in the form of twisted pairs. This cable consists of 4 copper wire pairs, connecting the network node with RJ 45 connectors.CAT-5 supports up to 100 to 1000 MHz speeds in a ‘full duplex’ mode (Category 5 Cable. 2007). The XYZ Corporation enterprise network will corresponds to request related to internet applications, online transactions, requests by sale contractors, file transfer protocol and Emails. CAT 5 can support these features with ease. However, CAT 5 cable can support up to 300 feet equal to 100 meters in distance. A requirement of the switch is mandatory for every 300 feet. Data switches perform packet distribution tasks within the local area network. Acting as a core backbone, XYZ Corporation network requires fast Ethernet switches to support the internet and external communication. The Cisco Catalyst 3750 v2 series switch is recommended to cater the requirements for the current scenario as well as for the future. The deployment of switches will be carried out by disconnecting one department at a time on a non-working day, as the installation will be conducted by the vendors or the staff available at XYZ Corporation. From each of these available departments, human resource department will be the first one to be replaced with the new switch supporting VLAN and addressing security issues. The next department will be the technology department itself for enabling compatibility with the human resource department switch, as proper configuration and testing is required. Each department follows the similar approach with finance department to be the last one. Cisco Catalyst 3750 is the OSI layer 3 stackable switch, supporting the energy efficiency factor. Stackable means that more switches can be added to the current switch configuration for providing more network nodes. This switch supports the Cisco Energy Wise technology, which assist in the provision of power management of the big switch network. At the same time, the Cisco energy wise technology reduces the cost and carbon foot prints. The latest invention to the energy wise technology is the ‘Cisco Energy Wise’ Orchestrator which is a dedicated turnkey power management solution for the network and information systems. The Cisco Energy Wise Orchestrator enables to administer the energy requirements of Power over Ethernet (POE) enabled devices. It also extends the enterprise power management to workstations and laptops (Newswire 2012). Some of the enhanced features for the Cisco catalyst 3750 v2 series incorporate efficiency for remote sites environments. The switch consumes less power and enhances productivity for the local area network. It protects the network investment by supporting the unified network for data, voice and video streaming. The switch supports two software versions, which are also called the input / output system (IOS). One is the Internet Protocol IOS which includes enhanced quality of service (QoS), frame rate limiting, access control list (ACL), Open Shortest Path First (OSPF) to support the routing features and IP v6 support which will definitely support the future IP v6 compatible network devices in the future. The second IOS support the enterprise network level functionality. It includes hardware based Internet Protocol Unicast, Internet Protocol Multicast routing, and policy based routing (PBR) (Rist 2003). 3 Addressing Security Issues and Deployment Approach for WAN A router is a core computing and packet processing devices in the XYZ Corporation computer network. Router connects two or more networks with different subnets, enabling the networks to expand on an enterprise level. Logically the router builds a routing table, where it stores all the route addresses. For example, the data packet source and destination is stored in the routing table. The network administrator can statically define the network addresses which are called as ‘static routes’. The dynamic routing protocol is used for the automation of exchanging data packets with other routers located in campuses of XYZ Corporation. The selection criterion of the router depends on the network requirements. The data transmission gauge, which is also called the maximum transmission unit (MTU), is also considered for optimal network efficiency. To support the current scenario, the router must support redundancy and security features for the XYZ Corporation enterprise network. As the current network design incorporates a core backbone, it is essential for the network to be operational and efficient. Cisco 3845 integrated service router will fulfill all the network requirements. The Cisco 3845 Integrated Services Router provides optimal performance for parallel services on the local area network including security, voice and enhanced services. Improved speculation is achievable by increased performance and modularity. The Cisco 3845 ISR consist of robust ‘WAN’ slots to improve density. The router supports over 90 modules for enhanced and latest network functionality. The router supports both copper and fiber interface. Keeping in mind that the cost must be kept to a minimum, the router supports power over Ethernet (POE). It is the revolutionary technology integrating data, voice and power on a standard CAT 5 Ethernet infrastructure. This technology provides power to the devices connected on the network in parallel. The security aspect is attractive as the router has built in features for data encryption. The router also supports up to 2500 Virtual Private Network tunnels for creating connectivity with campuses of XYZ Corporation enterprise network. However, the AIM-HPII-PLUS Module is required to support VPN capability in the router. VPN is further elaborates as it is created to improve security and productivity by combining Cisco VPN technology. Cisco VPN is considered a trustworthy name in the vendor industry to connect remote offices, remote users and remote sites in a secure way. VPN is most widely used for remote connectivity solutions in all sizes of organizations. It is affordable due to the provision of public switched telephone networks (PSTN) (Tiso, n.d.). The deployment of router will be carried out by connecting the hot site initially with the current operational network. After establishing connectivity with the hot site, router will be replaced by the vendors or the staff available at big Switch. Moreover, cost savings and productivity is also supported encryption and authentication techniques that defend data in transportation from unauthorized access and attacks. The Cisco based VPN server uses highly secure communication mechanism with integrated access rights to specific users. The network administrator can quickly add remote sites and users without expanding the current infrastructure. It will improve productivity by extending the current network, applications and collaborative tools. These features enable to reduce the communication cost by a significant level along with improving the efficiency of administrative tasks and configuration. XYZ Corporation can adopt VPN technologies. VLAN configuration is carried out in data switches and it is also configured in the ports of the router. In order to secure the network from threats associated with VLAN, for instance, VLAN hopping is a type of network attack in which the workstation of the end user broadcast data packets to another VLAN instead of the legitimate VLAN. As VLAN do not allow data packets to be send at another VLAN, the traffic is marked with another VLAN ID that belongs to the end user workstation. Similarly, in this scenario, an attacker may act like a data switch and can convey trunking for sending and receiving data from other VLANs. In order to mitigate attacks associated with VLAN, configuration is required within the router and the switch as well. The first primary objective is to dedicate VLAN identifications for all available trunk ports. Moreover, there is also a requirement of de activating all the unused switch ports and allocate port numbers in unused VLANs. Furthermore, all the ports already accessible by the users must be set to non-trunking mode by de activating DTP. For addressing Media Access Control (MAC) spoofing attacks, there is a requirement of analyzing the functionality and approach of the threat. MAC spoofing attack incorporates learning of a MAC address pertaining to another host for making an attempt to the target switch. The switch will forward the frames destined for the host connected remotely to the attacker. In process of sending frames with dissimilar source address, the attacker gets the chance to overwrite the Content Addressable Memory (CAM) table entry. The modification to the CAM table enables the attacker to forward destined data packets of the host to the attacker. Port security is incorporated to every layer 3 switch to eliminate or minimize MAC spoofing. Likewise, port security is capable of specifying the MAC address for workstations that are connected to a specific port. If there is any violation in terms of connecting other workstation other than the authentic one, logs are generated that can be viewed by the network administrators for rectification. The perimeter network demonstrates interior router that is connected to the internal network and exterior router is connected to the external network, i.e. Internet, campuses, sale contractors. The perimeter network provides robust security by deploying a bastion host between the two routers. Bastion host is similar to intrusion detection system and reports immediate whenever anomalies are detected within the network. However, Demilitarize Zone (DMZ) is also ideally placed at the perimeter network, when operating on a domain based computer network. The demilitarized zone operates as a part of a firewall configuration in order to secure the local area networks. If a DMZ is configured on the whole network or on specific workstations, they are known to be in a DMZ. Moreover, the zone also facilitates workstations that are configured behind the firewall to initialize request that are considered as outbound traffic to the DMZ. The functionality of DMZ is similar to a proxy server, as the workstations configured in DMZ interact with the public networks. Furthermore, the most significant advantage for a DMZ is that it protects the local area network domains by segregating the network layer. Likewise, the disadvantages associated with DMZ are not significant, but one issue can be highlighted, as the segregation may create a hassle for the network administration because DMZ requires frequent updates and maintenance. Moreover, the hardware cost is high and requires dedicated hardware in order to implement DMZ within the network. Deployment includes a switch, separate firewall and IDS etc. In order to protect the computer network of XYZ Corporation, organizations emphasize on implementing hardware and software application as well as a framework in terms of surveillance security. Network security issues can lead to many different aspects. For example, if the server containing customer data is breached, organization will lose its credibility and trust among the customer and that will result in business loss. Similarly, if a critical system storage device is stolen by internal or external sources, organization’s financial data along with goals and objectives can be revealed to other competitors. In the proposed network design for XYZ Corporation, surveillance security is incorporated for protecting unauthorized access to switches located at each department. The surveillance security will provide following features: It will track unauthorized access of employees to departments Monitor activities of employees related to physical interference with critical hardware components User activity on the network and unusual behaviors will be monitored User authentication and Authorization will be implemented IP cameras to monitor their critical information assets on the network. 4 Hardware Specification The cost hardware specification will be as: Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 4GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstation $ 2570 5 RAS Troubleshooting and Installation For conducting the RAS testing, a test bed is required. At least two systems are required for the testing process. One system will be the host. The second will be a remote server. Both of the system must have a modem installed. One network access server and telephone switch is required. As far as time is concerned, the testing will continue until there are no errors left. It may take a day or two depending on how many RAS servers are available in the organization. 5.1.1 Installation RAS on a Wireless Router In order to install a typical RADIUS server on a router, following protocols and services are associated: DHCP TCP / IP TKIP SSID WPA Internet Authentication Service DNS The next step is to demonstrate RADIUS server installation on a wireless router by incorporating the above mentions protocols and services. Figure 1.1 As shown in figure 1.1, the first step is to configure the wireless router configuration. These parameters will be considered: Internet Connection type: Automatic Configuration Router Name: Any Host Name: Any Domain Name: Any MTU: Any Local IP Address: Local IP address of the workstation DHCP Server: Disabled for RADIUS Configuration Figure 1.2 As shown in figure 1.2, following parameters will be considered for Basic Wireless network settings: Wireless Network Mode: Mixed Wireless Network Name (SSID): Type SSID Wireless Channel: do not make any changes Wireless SSID Broadcast : Enabled Figure 1.3 Figure 1.3 shows the configuration of the following parameters: Security Mode: Select WPA Enterprise WPA Algorithms: Select TKIP RADIUS Server Address: Configure IP address of the RADIUS server RADIUS Port: Set the port to 1812 Shared-key: Configure the selected shared key Key Renewal Timeout: Leave it to default Figure 1.4 Figure 1.5 As shown in Figure 1.4 and 1.5, Right click on the RADIUS client and click on ‘New RADIUS Client’ As shown in Fig 1.6, now select name of choice and enter IP address of the Linksys router. Figure 1.6 As shown in Fig 1.6, the last step will be to set ‘RADIUS standard’ as the ‘Client-Vendor’ and set the shared key that will be identical to the shared key that was configured in the Linksys router. Click finish to end the wizard. 5.2 Topology / Cabling We will apply star topology. As the network design will follow a centralized server / client architecture. For implementing this network, “CAT 5” cable is used. The length required for each switch depends on the distance and the location of the router. Wikipedia defines it as “Category 5 cable includes twisted pairs in a single cable jacket. This use of lines helps preserve a high signal-to-noise ratio despite interference from both external sources and other pairs (this latter form of interference is called crosstalk). It is most commonly used for 100 Mbit/s networks” (Category 5 cable.2007). 5.3 Workstations The minimum hardware specification of the workstations: System specification Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive DVD Drive 16 X Chassis Thermal HT Support 5.4 Network devices Network devices are the objects for any network. The network functionality relies on the network devices .The dependability of the network devices emphasizes on the requirements of the organization. For example, organization dealing with 3D animation and rich media may require a Gigabit Ethernet rather than Fast Ethernet. This is because the sub ordinates share the animated data among themselves for various purposes. The 3D animation contents are large in volume and require gigabit Ethernet for moving files at a high speed within the network. 5.5 Switch Implementation Fast Ethernet switches will be implemented instead of hubs. Switches are more powerful and intuitive as compared to hubs. There are 6 departments excluding the board room. Six fast Ethernet 10/100 switches will be installed in each department. The switches will be connecting to the router. 5.6 Router Implementation Routers are implemented on a Wide Area Network (WAN) as well as on the Local Area Network (LAN). There are six switches in each department. For eliminating the unnecessary broadcast within a LAN domain, ACL can be configured to minimize the unwanted broadcast from each network node. Access rights and permissions can also be configured for restricting the user at certain level. 5.7 Access Control List (ACL) ACL can be configured for restricting and allowing the access of any network resource to the specific user or group of users. In HHF, board room required access to all the network resources. In this case, the user available in the board room is permitted to access to all the resources of the network. 5.8 Network Server The network server can be a domain controller, firewall or Windows NT server. The requirement of the network server will emphasize on the requirements of the network. Network containing 62 network nodes may require a domain controller for the administration of user accounts and permissions. 5.9 IP Addressing Scheme IP version 4 scheme is best suited and cost effective for LAN implementation. The IP v6 required a high budget as the network devices supporting IP v6 are expensive, equipped with the latest technology as compared to the IP v4 Network devices. We have: Total Number of hosts = 62 IP Addresses range: 192.168.0.1 to 192.168.0.255 Total Usable IP addresses: 192.168.0.3 to 192.168.0.254 = 252 Gateway IP address: 192.168.0.1 Router IP Address: 192.168.0.2 VLAN can be implemented on “layer 3” switches to provide different IP addresses for each department. 5.10 Allocation of Network and Host 192.168.0.1 The blue digits represent the network part. The brown digits represent the Host part. 5.11 Splitting up of IP Address Class Range Network Address Host Address A 0-127 xxx xxx.xxx.xxx B 128-191 xxx.xxx xxx.xxx C 192-223 xxx.xxx.xxx Xxx Figure 3.3 In Figure 3.3, the range is specifying the class of the IP address. The network and host addresses are showing the available bytes for allocation. 6 Cost: The cost is calculated separately for each department. The cost includes, network devices, Workstations and Operating system software. 6.1 Administration Department System specification and cost including Windows Vista Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstations 300 x 18 = $5400 Network device Specification and cost Network switch $100 Total cost of network $100 Grand total cost $5500 6.2 Human resources System specification and cost including Windows Vista Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstations 300 x 9 = $2700 Network device Specification and cost Network switch 1 x 100 = $100 Total cost of network $100 Grand total cost $2800 6.3 Accounting System specification and cost including Windows Vista Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstations 300 x 13 = $3900 Network device Specification and cost Network switch 1 x 100 = $100 Total cost of network $100 Grand total cost $4000 6.4 Media Relations System specification and cost including Windows Vista Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstations 300 x 4 = $1,200 Network device Specification and cost Network switch 1 x 100 = $100 Total cost of network $100 Grand total cost $1,300 6.5 MIS 1. System specification and cost including Windows Vista Processor Intel Dual Core E5400 2.7GHZ (2MB cache – 800MHZ FSB) Motherboard Intel DG41RQ (LGA775-SND+AGP+GIGA LAN-800MHZ FSB) Memory 1GB DDRII (800 Bus) Hard drive 320GB 3.5" SATA-II 7200RPM Optical drive HP DVDRW 24X SATA Chassis Thermal HT Support Total cost of workstations 300 x 6 = $1800 Network device Specification and cost Network switch 1 x 100 = $100 Total cost of network $100 Grand total cost $1900 Total Cost: 5500 + 2800 +4000 + 1300 + 1900 = $15,500 Router cost: $2000 Cable Cost approx. 2000 Meters = 500 +15,500 + 2000 Grand Total = $18,200. 7 Windows Server 2008 7.1 Web The Windows Server 2008 provides the facility to experience sheer web-based skills efficiently and effectively. In addition, it also provides the customers enhanced administration and diagnostics, development and application tools and cost reduction infrastructure facility. 7.2 Virtualization The Windows server 2008 allows its users to experience server virtualization technology. Moreover, it also enables its users to improve hardware usage, optimize infrastructure, helps to lower cost and enhances server availability. 7.3 Security According to a recent survey, Windows Server 2008 is considered as the most effective and secured Windows Server. Due to the fact, it possess tough operating system and security innovations along with its Network Access Protection, Federated Rights Management and Read-Only Domain Controller, provide extraordinary levels of protection for network, for data and for organizations. 7.4 Solid Foundation for Business Workloads The Windows Server 2008 is considered as the most efficient, elastic and robust Windows Server operating system up till date. The modern techniques and structures for example Server Core, PowerShell, Windows Deployment Services and improved networking and clustering technologies are provided by the Windows Server 2008. In addition, Windows Server 2008 provides its users the most stylish and reliable Windows platform in order to manage heavy workload and application needs. 7.5 Scenario Introduction The Windows Server Manager utility helps us to identify its role regarding server configuration as it is considered as Microsoft’s most customer-focused servers released till date. This server provides the multitasking server host for the customers thus providing them full control for their infrastructure. Moreover, it can act as a platform for the Hyper-V™ server virtualization role in order to run multiple servers along with different roles by each server. Also, the IT specialist will usually refer this towards “print server”, “file server”, “Web server” or “domain controller” defining that the server by its initial function. Likewise, the server is implemented to perform a specific role regarding work load or to contribute in an organizations scenario. The term “Workloads” describes the employed multiple servers that are running particular roles in order to deliver an overall solution for a mentioned scenario. For instance, , servers running Active Directory® Domain Services, Active Directory Certificate Services and Active Directory Federation Services might run distinct roles but they all contribute to a higher-level “Identity and Access Management” workload or scenario. When customers deploy Windows Server 2008, they will likely choose certain scenarios and workloads where they feel the product provides greatest value or ease of implementation with minimal disruption to their existing infrastructure. For this reason, we consider Windows Server 2008 as it will be deployed by customers in specific scenarios. We will focus on key product scenarios that support the technology investments for Windows Server 2008. If you haven’t upgraded from Server 2003 to Server 2008 — here’s the how-to you’ve been waiting for. Today I’m going to show you how to prepare for a server upgrade and how to perform it. I’ll also tell you why you need to upgrade your server to 2008; let’s start with that. 8 References Category 5 Cable. 2007. Network Dictionary, , pp. 88-88. NEWSWIRE, P., 2012. Server Technologys Intelligent Rack Mount Power Distribution Units Now Cisco® EnergyWise™ Certified. PR Newswire US, . RIST, O., 2003. Catalyst 3750 Stacks Up Well. InfoWorld, 25(28), pp. 34-34. Read More