Transcript Treaded Case Study Computer Networks 2002 Daire Sheriden

Treaded Case Study
Computer Networks
2002
Daire Sheriden
Ronan Monaghan
Mark Gilmore
TCS Overview
• Local Area Networks (LANs) at each site
• Wide Area Network (WAN) to provide data connectivity between all school
sites.
• Access to the Internet from any site in the school district is an integral part
of this implementation.
• Since this network implementation will have to continue to be functional
for a minimum of 7-10 years, all design considerations should include a
minimum of 100x (times) growth in the LAN throughput, 2x (times)
growth in the WAN core throughput, and 10x (times) growth in the
District Internet Connection throughput. The minimum requirement for
initial implementation design will be 1.0 Mbps to any host computer in
the network and 100 Mbps to any server host in the network.
• Only two OSI layer 3&4 protocols will be allowed to be implemented in this
network, they are TCP/IP.
Layer 1 design
•
The school has been divided into 4 catchment
areas served by 1 MDF and 3 IDF’s.
•
All HCC is cat 5 UTP 100Mbps cable.
•
All backbone cable is multi-mode fibre optic cable.
The following is a design of the fibre backbone of the
network.
Followed by the HCC diagrams the MDF and three
IDF’s.
IDF1
IDF2
IDF3
MDF
MDF
IDF1
IDF1
IDF2
IDF3
CLASSROOM WIRING CLOSET
classrooom
Equipment
• 3 * 12 port standard
switches
• Multi-Port Patch Panel
12U 19in Wiring Closet#1
CLASSROOM
• Three standard 12 port Switches
• One 32 Port Patch Panel is hard wired to the 25 Drop Points in Each
Classroom
• Students use ports 1 – 24 on the patch panel.
• Ports 1-8 will be connected with patch leads to switch 1, 9-16 to
switch 2, 17 – 24 to switch 3
• Lecturer drop-point is hard wired to port 32 on the patch panel
• The 4th Cable run (Lecturer Run) is plugged into port 32 of the Patch
Panel
• Each Classroom Wiring Closet is placed in an elevated position and
securely locked.
IDF1 WIRING CLOSET
IDF 1
A DMIN SERV ER
Equipment
• Admin Server
• UPS
• 24 Port Enterprise Switch
• Multi-Port Patch Panel
• Keyboard / Mouse Shelf
• Monitor
18U 19in Wiring Closet#2
IDF 1
• IDF 1’s catchments area is the Administration Block.
• This IDF must be able to service 6 offices with 4 runs going to each.
• We have decided to use one 24 port switch as not all runs going into the
offices will be used.
• This in turn will allow for any installation of extra network devices.
• An Administrative Server is contained within this IDF. The server is
connected to the switch by fibre optic cable. The Administration
server which will house the student tracking, attendance, grading and
other administration functions
• The Wiring Closet also contains a UPS to allow uninterrupted service and it
also provides Power Conditioning
• Every 4th port is assigned to VLAN 1 every other port is VLAN 2
IDF2 WIRING CLOSET
IDF 2
Equipment
• 2 * 24 Port Enterprise
Switch
• Multi-Port Patch Panels
18U 19in Wiring Closet#1
IDF 2
• IDF 2’2 catchments area includes 22 classrooms with 4 cat 5
runs going to each.
• We have used two 48 port switches.
• This will provide us with 96 ports in total. 88 of which will be
used for the cat 5 runs.
• The top switch is connected to the fibre backbone. This switch
in turn is linked to the switch below by fibre optic cabling.
• Every 4th port is assigned to VLAN 1 every other port is VLAN 2
IDF3 WIRING CLOSET
IDF 3
Equipment
• 24 Port Enterprise
Switch
• Multi-Port Patch Panel
12U 19in Wiring Closet#2
IDF 3
• IDF 3’S catchments area includes 11 classrooms with 4 runs
going to each. This gives us a total of 44 runs
• IDF 3 contains one 48 port enterprise switch
• Every 4th port is assigned to VLAN 1 every other port is VLAN 2
MDF
MDF Wiring Closet
Equipment
DNS SERV ER
LIBRA RY SERV ER
A PPLICA TION SER
EMA IL SERV ER
DHCP SERV ER
• One 48 port Enterprise Switch
• Multi-port Patch Panel
• Servers
• 2 Monitors
• 2 UPS
• One 12 port fibre Switch
• Multi-port fibre Patch Panel
• Router 3640 with Serial port,
Ehternet port and
Dial-in Facilities.
FILE SERV ER
FILE SERV ER
FILE SERV ER
• File Servers
M.D.F.
• The MDF catchments area contains 11 rooms with 4 cat 5 runs going to
each.
• This will mean 44 runs going out plus the IDF’s cabling.
• The fibre from the 48 port switch, the IDF’s and the 7 server’s all go into
the 12 port fibre switch.
• The 12 port fibre switch has added RJ45 connection port to allow it to be
connected to the Router
• The 5 servers located in the MDF are
• DHCP, Library, File Server, Application, E-mail Server
• A firewall is included on the router which provides one level of security
• The ACLs offer second level of security
IP ADDRESSING
Our IP Addresses will be issued by the DHCP server located in
the MDF.
The DHCP server will be configured to allocated specific
addresses to specific machines.
We will be using a Class B address which will provide us with
plenty of addresses for future expansion
IP Group
IP Addresses assigned by DHCP
Lecturers
10.1.1.16 – 10.1.1.170
Admin Staff
10.1.1.171 – 10.1.1.255
Students
10.1.2.1 – 10.1.10.255
STATIC IP ADDRESSES
Device
IP Address
Location
DNS
LIBRARY SERVER
10.1.1.1
10.1.1.2
MDF
MDF
APPLICATION SERVER
E-MAIL SERVER
DHCP
ADMINISTRATION SER
10.1.1.3
10.1.1.4
10.1.1.5
10.1.1.6
MDF
MDF
MDF
IDF1
NET PRINTER 1
10.1.1.7
ADMIN
NET PRINTER 2
10.1.1.8
LIBRARY
NET PRINTER 3
10.1.1.9
ADMIN
File Server 2
10.1.1.11
MDF
File Server 1
10.1.1.10
MDF
VLANS
We will incorporate 2 VLANS
One for Lecturers and Staff
(VLAN 1)
One for Students
(VLAN 2)
The VLANS are implemented on the Enterprise Switches located in
the 3 IDF’s and the MDF
The VLANS will employ a static port , which will assign ports on the
switch to a particular VLAN
All Network devices under IDF1 (Admin Block) will be on VLAN 1
(Lecturers + Staff)
Also assigned to this VLAN will be every 4th port on the other
switches (This will be the lecturers cat 5 run from each classroom)
The other ports on each switch will be assigned to the student VLAN
NAT (Network Address Translation)
• IP Address space is limited and obtaining a large block of registered
addresses is difficult.
• For this reason we are using a private IP addressing
scheme internally
• Hosts cannot access registered networks such as the
internet, when assigned private IP addresses.
• NAT replaces the source address with a routable address and
enables private addressed hosts to access registered
networks without requiring globally unique IP addresses on
end hosts.
ACCESS CONTROL LISTS
• Access Control Lists (ACL) are used to segregate the
VLAN traffic between VLAN 1 (Admin +
Lecturer) and VLAN 2 (Student) and traffic
coming into and out of the network
• Students are not permitted access to VLAN 1.
• Except for access to various file servers.
• Lecturers and Admin Staff are permitted access to
VLAN 2
• This ACL will allow DHCP requests and E-mail traffic
between VLANs
• The ACL for the VLAN traffic will be applied to the
Trunking port on the router
• All Hosts on both VLANs will be allowed access to the
internet and E-mail.
• Telnet access is denied to all hosts except from a
specific Network Administrator Computer.
• All external Telnet requests are denied.
Access Control
List
Permit / Deny
Port
ACL 1
Permit :
From VLAN 1 to DHCP traffic
VLAN 2
DNS traffic
E-mail
Applications Server
Library Server
Deny:
Everything Else
Trunking Port
(e0)
ACL 2
Serial 0 (s0)
Permit:
Internet
Email
Deny:
Everything Else
FRAME RELAY
• Frame Relay will connect site to the District Office
• The internet connection will be at the District office.
• Each site is assigned a DLCI number.
• Our router serial port (s0) is connected to a CSU DSU by means
of a serial cable.
• The DTE end is attached to the router and the DCE end is
attached to the CSU DSU
Conclusion
Objectives
• Connectivity
• Internet Access
• Room For Expanision
• Security