Business Proposal for the Requirements of the TEEVO Corporation - Case Study Example

Running Head: IN451 Case Study IN451 Case Study Executive Summary A company engaged in developing TV broadcasting systems has been doing well through the past few years. The company has an office in Sydney and now it wants to set up another one in Brisbane. Since the company is already in the field of communication and broadcast, it wants to implement a suitable network infrastructure to conjoin its offices ands synchronise its various processes. Hence, a communications planning and infrastructure project needs to be initiated. Contextually, this project proposal is aimed to suggest a productive plan involving the internetworking technologies. The integrated form of the network would be mainly based on the IEEE 802.3 (CSMA/CD), IEEE 802.1 (LAN/WAN Management & Media Access Control Bridges) and IEEE 802.2 (LLC) standards. The IEEE 802.3 (CSMA/CD) networking standard is the most popular and adaptable specification which caters with the new challenges and implementations of the modern internetworks equipped with powerful switches and routes. Distinct LAN and DMZ areas would be set up in the networks at Sydney and Brisbane to ensure speed, interoperability and segregation. When the design and recommendations of the proposed plan are implemented, the internal and external communication processes of the company would faster and more reliable. Introduction The Teevo Corporation has a considerable number of employees and also it is passing through a phase of growth. It is possible that in the near future, the number of the employees of the company increases. The various departments it has are the departments of Management, Accounting, HR, Development and Executive Management. The company’s expansion plans and establishment of a new office at Brisbane has compelled the management to reflect on the communication issues that exist in the present set up. Of course, there are various ways to determine that how the company can perform better and how the internetworking should be implemented. Diverse implementation models can be adopted to simplify the network of the company. However, the ongoing business proposal would present and suggest the solutions that would best suit the necessities of the company within the logical and physical constraints of the scope of the project. The solutions would be discussed intricately through this proposal, while special attention would be given to the safekeeping, accessibility and usability of the company’s network in general. Design, recommendations, cost estimates, security techniques, etc. would be presented in the course of the proposal. The Present Scenario The Current System State Currently, the company has an office in Sydney, which has an ADSL connection to the Internet. A routing device has been deployed which is currently operating through three interfaces. One of these interfaces is connected to the Internet (131.181.6.9/30), another is connected to the internal LAN (192.168.10.1/24), and the remaining one is connected to a switch labelled DMZ (10.0.0.1/24). Moreover, the switch is connected to several servers and other important computer units as follows: 1. DHCP server (10.0.0.2/24) 2. Local DNS (10.0.0.4/24) 3. File Server (10.0.0.5/24) 4. Windows Server 2003 (10.0.0.6/24) 5. Linux Printer Server (10.0.0.7/24) 6. SSH bastion host (10.0.0.8/24) 7. Sendmail server (10.0.0.9/24) 8. HTTP Web server (10.0.0.10/24) 9. Executive Management Database (10.0.0.11/24) Further, the router that is being used is labelled “Firewall and NAT Box”. Moreover, the company LAN uses 192.168.10.0/24 network, and the staff desktops obtain their IP addresses through the DHCP server located in the DMZ area. The addresses of the desktops can be changed but those of the computer units in DMZ area cannot be changed. Right now, the staffing scheme of the company is as follows: Name of the Department Number of Staff Management 26 Accounting 24 HR 22 Development 22 Executive Management 4 Table – 1 All the staff members share a single big broadcast domain and network at the Sydney Office. Restructuring the Existing Network After opening a new office at Brisbane, the company will transfer some of its staff members over to there. The new situation is being shown in the following table: Name of the Department Number of Staff at Sydney Number of Staff at Brisbane Management 13 13 Accounting 8 16 HR 12 10 Development 22 0 Executive Management 3 1 Table – 2 Explanation of Some Important Terms ADSL: Asymmetrical Digital Subscriber Line. This implementation of Digital Subscriber Line (DSL) has a speed of up stream transmissions around 640 Kbps and that of down stream transmissions is around 9Mbps. It operates with a single phone line and is compatible with the voice calls. NAT: Network Address Translation. It is a TCP/IP service which many firewalls, IP proxies and routers can provide. NAT interprets the addresses which are allowable for an internal network but not allowable for a corresponding external network into the addresses which are allowable for the external network. Generally, a corporate internal network with the Internet cannot work until NAT is applied to it properly. Firewall: It is an arrangement of software applications, protocols, and hardware devices which safeguards a network from external attacks. A firewall implemented at the gateway router protects the internal network from illegal access and attacks by hackers. DMZ: Demilitarized Zone. It is a segment of the network which is neither local nor public, but rather halfway between the two. This is an intermediary network that provides added security to the internal network. Assumptions 1. The routers, switches, servers and desktop computers are all interconnected by means of a proper cabling scheme. The company understands and can arrange for the extra cables to facilitate interconnectivity. 2. A suitable third party will maintain the network and the systems, especially the server computers in the DMZ area. The primal and continued maintenance, servicing and configuration (if necessary) would be carried out by this third party. 3. The company is assumed to have and/or arrange for suitable communication cabinets, housing for extra hardware, sufficient power access and monetary resources necessary for the implementation of this business proposal. 4. Cisco Systems equipments have been chosen as the primary brand apparatus for all the necessary communication devices, particularly the routers and switches. Cisco provides almost ninety percent of the world’s internetworking devices. This products are highly compatible, deployable and suit the industry standards. Other hardware and network equipment manufacturers can be considered upon request. At the component level design, we have mainly chosen the Windows Server 2003 Network Infrastructure environment to handle the client-server implementations. Windows Server 2003 is already running in the given network. The Proposed Network Design The overall network design is being elucidated by means of the following pictorial representation: Figure -1 The Overall Network Design Logical Network and Address Scheme Sydney Office: The router at the Sydney Office is firewall and NAT enabled. Three interfaces of the router are being used. One is used to connect the Internet (131.181.6.9/30), and another one is connected to the switch labelled DMZ (10.0.0.1/24). Let’s connect the remaining interface to a Cisco XR 12000 Router (192.168.10.1/24). Now we apply a subnetting scheme and connect three interfaces of the second router to three distinct subnets. The Subnetting scheme is being rendered in the Table – 3. Original Address Block Internally Configured Subnet Mask Grouping Value Beginning & Ending Addresses of the Subnet Ranges 192.168.10.0/24 255.255.255.192 256 – 192 = 64 Subnet 1 192.168.10.0 - 192.168.10.63 Subnet 2 192.168.10.64 - 192.168.10.127 Subnet 3 192.168.10.128- 192.168.10.191 Table – 3 Each subnet can accommodate 62 hosts. In Subnet 1, we can place the 22 hosts of Development Department. Likewise, in Subnet 2, we can place the 13 hosts of Management Department. In Subnet 3, let’s further connect a Cisco Catalyst 3560 Series Switch with 48 ports. We assign 20 ports to VLAN 1 for the accounting Department, another 20 ports to VLAN 2 for the HR Department and the remaining 8 ports to the Executive Management Department. Brisbane Office: Let’s assume that the model of the router in the Brisbane Office is same as is same as that of the router in the Sydney Office. Also, NAT and Firewall are enabled. Three interfaces of the router are being used. One is used to connect the Internet (131.191.6.9/30), and another one is connected to the switch labelled DMZ (10.0.0.1/24). Let’s connect the remaining interface to a 48 port Cisco Catalyst 3560 Series Switch (192.168.0.1/24). Now, we can create four VLANs with the help of this switch. Let’s assign 13 ports to VLAN 1 and reserve them for the Management Department. Further, let’s assign 16 ports to VLAN 2 and reserve them for the Accounting Department. Next, 10 ports are assigned to VLAN 3 for the HR Department and one port is assigned and one port is assigned to VLAN 4 for the Executive Management Department. The remaining ports are reserved for future use. A portion of the relevant coding is furnished below: Switch# config t Switch(config)#int f0/1 Switch(config-if)#switchport mod trunk Switch(config-if)#int f0/2 Switch(config-if)#switchport access vlan 4 Switch(config-if)#int f0/3 Switch(config-if)#switchport access vlan 1 Switch(config-if)#int f0/4 Switch(config-if)#switchport access vlan 1 … … … … … … … … … … The Internet Connection Security Method In order to keep the communication between the network at Sydney Office and the network at Brisbane Office safe and secure, we have to choose an appropriate security method. The security method would mainly comprise of the following steps: 1. Management of the user accounts and password security: Usernames and passwords are very important for the network security since they are used to control the initial access to the network. In the Windows Server 2003 environment, the integrity of the user accounts and passwords can be managed effectively. The passwords are specially protected against crack programs. At the client side, deployment of Windows XP can facilitate easy synchronisation and secure functionality. 2. Selection of the security protocols Deployment of IP Security or the IPSec protocol is the best option since it provides both encryption and authentication over the Internet. IPSec can work well along with IPv4 and IPv6. It has broad spectrum industry level support. It secures the applications which operate at the Layer 4 and above in the OSI Model. In a nutshell, it secures both the application and transmission data. Additionally, we can also apply the Secure Sockets Layer (SSL) protocol which is based on RSA Public Key Encryption and is utilised to establish secure session layer connections across the Internet. In case there are special requirements, L2TP, PPTP and Kerberos security protocols too may be implemented later on. 3. Firewall techniques: Apart from the implementation of the security protocols, the two other important firewall techniques applied to the network are (i) DMZ and (ii) ACL. Moreover, dynamic packet filtering, setting up proxy servers, etc. are also useful in regards of network security. However, for the sake of simplicity, economy and effectiveness, this business proposal focuses on a compatible and tested protocol scheme, DMZ and access control through ACL. Figure – 2 Firewall Implementation with the help of an ACL-enabled router (i) DMZ: A DMZ is typically an intermediary network that is pretty halfway between the external and internal networks. In this business proposal, it must be clearly stated that we must implement a DMZ in the Sydney Office and another distinct DMZ in the Brisbane Office too. Since in both the cases, the gateway routers are firewall protected and NAT enabled, DMZ implementation would provide added security. However, the important servers like the Sendmail server, HTTP Web server and File Server have also been installed in the DMZ area. But both at the Sydney and Brisbane offices, the routers would be further empowered by access control. Therefore, it is suggestible that the basic DMZ structure is left unchanged to avoid fiscal overhead and complications in the network. (ii) ACL: Access control is implemented through the Access Control List (ACL). The ACLs are applied to the routers. An ACL determines which devices (or more precisely, IP addresses) would utilise the router and in which direction the data traffic would be transferred. These lists are the lists of conditions that categorise the data packets as per their source and destination IP addresses. An Access Control List would help the administrator to control the network traffic. The most important implementation of an ACL is filtering the unwanted data packets at the Network Layer in accordance with the appropriate security policies. In the corporate situation under scrutiny, the access lists must be implemented as per the following policies: All internal traffic today the DMZ network and DMZ servers would be allowed. To achieve this, at the interface of the router that connects the DMZ area switch, we have to give the following command: access list 10 permit 192.168.10.0 0.0.0.255 Further, all DMZ servers would be made accessible by only the staff desktop computers. By implementing specific permissions and denials in the access list, the Executive Management Database would be made accessible by the Executive Management staff computers. All internal traffic to the external network would be allowed. The external traffic to the internal network would be allowed if they are the return traffic of sessions initiated by any of the internal staff desktops or any of the DMZ servers. Finally, the HTTP Web server would be made accessible by the internal staff desktops and also would be accessible by any client connections from the external network. DHCP Server Configuration and Operation The combination of Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) forms the foundation of any Microsoft Windows Server 2003 infrastructure. Further, implementing the TCP/IP Stack and IPSec, we can increase both the security and compatibility of the given network. DHCP controls the IP standard to reduce the complexities of the various address configurations in a given network administration scheme. The DHCP server automatically manages the job of assigning the IP addresses to the client desktops and configures various essential settings for the workstations. The DHCP server would determine the Scope, IP Address Range, Router (Default Gateway), DNS Settings, etc. for the computers at the client side. In the Brisbane Office, application of VLAN techniques at the internal network would help us to establish and implement a single DHCP server at the DMZ and control the whole network. However, in the Sydney Office, we would need to establish secondary DHCP servers and DHCP relay agents in the internal network. The internal network here has been subnetted and divided by the installation of a router. Since there are three subnets, we would require at least three DHCP relay agents to handle the DHCP service. Network Backup A backup server would be installed in the internal networks of both the offices at Sydney and Brisbane. These backup servers would facilitate the following: 1. Backup of the network configuration 2. Offline file synchronisation 3. Secure storage of data 4. Availability of both historical and local data in the case of a network failure or system crash 5. Creation of network based restoration points The backup server in each case should be created in the internal network so that it is kept completely safe from any external attack. Extended Research NAT Configuration and Operation The router labelled “NAT Box” would operate as a NAT server by utilising the ISP supplied global address. I t would also multiplex the local IP addresses to provide an address pool of 192.168.x.x (the most common form). In our case, this ISP-supplied global IP address at the Sydney Office is 131.181.6.9/30 and that for the Brisbane Office is 131.191.6.9/30. In both the cases, the local IP address pool is 192.168.10.0/24. Further, the router needs to be statically configured to map an internal address to an external one. This is static one-to-one mapping between the global and local addresses. The static NAT would also help the administrator to control the port forwarding and establish an effective packet filter in combination with the implemental ACLs at the Layer 3. Since DHCP is already configured in the proposed network structure along with DNS, NAT can be used effectively. The external interface addresses would be entered and maintained manually while the internal addresses would be automatically managed by DHCP. Also, in order to allow or deny the special ports, manual configuration may be needed. Router interface level configurations must be done by using access control methods. Static NAT configuration would affect the overall network. Port numbers of certain protocols would be utilised through a modifiable lookup table to run the required protocols and associated services via NAT. Some important protocols for the proposed network are listed along with their respective port numbers in Table - 4: Name of the Protocol Port Numbers SSH TCP port 22 FTP data TCP port 20 FTP control TCP port 21 NETSTAT UDP port 15 POP3 TCP port 110 SMTP TCP port 25 IMAP4 TCP port 143 HTTP TCP port 80 HTTPS TCP port 443 PPTP TCP port 1723 RIP UDP port 520 Table – 4 Port forwarding and control through static NAT can be utilised in various ways. For example, if the administrator blocks TCP port 25, the email services associated with SMTP would be terminated. Thus, the internal computer units can be completely cut off from the external network if needed. Similarly, by opening TCP port 1723, we can run the VPN service associated with PPTP throughout the network. Implementing Virtual Private Network (VPN) According to Todd Lammle (2003), a Virtual Private Network (VPN) is a method of encrypting point-to-point logical connections across a public network, such as the Internet. For the purpose of this business proposal, we have to scrutinize the possibility of establishing a VPN connection between the internal networks at the Sydney and Brisbane offices. Enough ports will have to be configured for the VPN type needed (PPTP or L2TP). For the corporate infrastructure under scrutiny, implementation of VPN using PPTP (Point to Point Tunnelling Protocol) appears to be more practical since it can support multiprotocol VPNs. It enables a remote user to access the corporate network securely across the Internet by plainly dialling into the ISP. Furthermore, a VPN utilising PPTP is compatible with the various technologies like IPX, NetBIOS, NetBEUI, etc. In a nutshell, the router to router PPTP is easier to implement, reliable for different technologies and sufficiently secure for a mid size corporate network. By implementing PPTP, we can also avoid the technical hassles of installing a certificate infrastructure across the internal networks. Moreover, PPTP traffic uses TCP port 1723 for creating and maintaining a VPN linkage and IP protocol 47 to transfer data over it. Hence, it can be simply handled by manipulating the common TCP/IP protocol stack. Thus, the router to router input and output pattern of data through the packet filters can further be monitored and configured through the NAT and ACLs as well. Operation Behaviour By implementing the Access Control Lists and routing tables, the router can be administered efficiently. The simplicity of a combined implementation of NAT, ACL and VPN lies in the fact that a standard router is built to handle these technologies simultaneously. By means of the ACLs and routing tables, the router controls the intercommunication between the different workstations and servers. Packet filters and address resolution are largely implemented through NAT. Finally, a secure channel is established between the two protected networks by “tunnelling” the Internet using VPN technology and implementation of PPTP. The router can thus further handle the incoming and outgoing calls, VoIP, video conferencing, etc. and cater to a faster and safer corporate network. Cost Estimate The following table enlists the per-device and total hardware cost needed to implement this proposal. It excludes the fiscal overhead that might be incurred by network cabling and labour charges. We have not replaced the existing router at the Sydney Office and considered the future growth prospects too. Also, at the Brisbane Office, a router of the similar brand and model like the one at Sydney Office has been proposed to be installed at the company costs. Device Cost per Unit Quantity Total Cisco XR 12000 Router $25935.00 1 $25935.00 Catalyst 3560 Series Edge Switch (with 48 ports) $4010.66 4 $16042.64 Barracuda Backup Server 390 $2500.00 2 $5000.00 Grand Total $46977.64 Table – 5 Figure – 3 Catalyst 3650 Series Switch Figure – 4 Cisco XR 12000 Recommendations and Conclusion 1. A site visit is recommendable before the practical implementation of this business proposal. 2. The network architecture must be thoroughly examined in the run-time environment so that the design issues (if any) are diagnosed in time. 3. Managing the office space and appropriate cabling are important considerations. 4. In the case of budget restraints, it is advisable to use bridges and hubs instead of switches in some cases where VLANs have not been implemented. Due to implementation of DMZ, replacement of routers by switches is not recommended. There are several possible solutions that might go well with the specific requirements of the TEEVO Corporation. The present business proposal suggests a network set up to be created that would orchestrate the various departments and structures in the corporate settings. Implementation of the proposed network design would accomplish a stable and secure communications system. Services like VoIP, Telnet, VPN, remote access, video conferencing, etc. can be initiated in the network environment whenever required as per the company’s specifications. A third party network administration team must always monitor the functionality of the component level hardware equipments for better results and increased up time. The proposal is basically intended to aid in the complicated decision making process of the company in regards of the network solutions and technological communications in business. Appendix Source of Figure – 3: Google Images Source of Figure – 4: Google Images References Ballew, S. M. (1997). Managing IP Networks with Cisco Routers. Sebastopol: O'Reilly Media. Borowka, P. (1997). Internetworking: The Way to a Structured Network. London: International Thomson Computer Press. Cisco Systems Inc. & Cisco Networking Academy Program (2003). CCNA 3 and 4 Companion Guide (Cisco Networking Academy Program) (3rd Edition) (Companion Guide) (3 ed.). Indianapolis: Cisco Press. Cisco Systems Inc. (2003). Internetworking Technologies Handbook (4th Edition) (Networking Technology) (4 ed.). Indianapolis: Cisco Press. Cole, E. (2009). Network Security Bible (2 ed.). New York, NY: Wiley. Crovella, M., Feeney, L. M., Rubenstein, D., & Raghavan, S. V. (2010). NETWORKING 2010: 9th International IFIP TC 6 Networking Conference, Chennai, India, May 11-15, 2010, Proceedings (Lecture Notes in Computer Science / Computer ... Networks and Telecommunications) (1st Edition. ed.). New York: Springer. Hunt, C., & Thompson, R. B. (1998). Windows NT TCP/IP Network Administration (1 ed.). Sebastopol, CA: O'Reilly. Lammle, T., & Tedder, W. (2000). CCNA Certification Kit. New York: Sybex Inc. Lammle, T. (2003). CCNA Cisco Certified Network Associate Study Guide, Deluxe Edition. New York: Sybex. Lewis, W. (2008). LAN Switching and Wireless, CCNA Exploration Companion Guide (1 Har/Cdr ed.). Indianapolis: Cisco Press. Mackin, J., & Mclean, I. (2006). MCSA/MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure, Second Edition (2nd ed.). Redmond, Washington: Microsoft Press. Miller, M. (1991). Internetworking: A Guide to Network Communications, LAN to LAN, LAN to WAN. Alexandria, VA: Prentice Hall. Pfleeger, C. P., & Pfleeger, S. L. (2002). Security in Computing (3rd Edition) (3 ed.). Upper Saddle River: Prentice Hall PTR. Read More