MN503 Overview of Internetworking: Network Design of PQR

Project Scope

PQR is a business enterprise whose business enterprise that relies so much to IT in its daily activities. For example, for a customer to receive a service in PQR premises, the customer has to check-in with a ticket for him/her so as to access any kind of service. The management has therefore decided to come up with a kind of network design that will support efficiently business processes. PQR company has therefore has contracted us to come up with a network design that will support the business processes. In this article, we are will be providing the network simulation on how our real network will be.

Network Design Objectives

The network to be implemented has to hit the following main technical requirements:

1. Scalability: the network in design process has to be flexible in terms of expansion. For instance, the network has to provide an allowance of growth without interrupting with the original network design. It should allow addition of more LANs without interfering
   
   with the current network design.
2. Security: the proposed network design has to achieve management need of having secured network that filters both incoming and outgoing traffic. This will be attained by use of Cyberoam firewall and access lists implement in router.

Projected users

The key intended users of this network are the administrators namely: human resource, finance and the finance departments. Other departments such as engineering and sales will require use of the network but not as much as compared to later three. In addition, guests and customers will be passive users of the network as they will either require the output of the network for them to be served or will require network infrastructure to get what need.

Project requirements

To put up our network up running, the following tabulated hardware components have to be availed.

Name of device	Features	Required amount	Reason as to required
Switch	Ø Fast Ethernet ports-48 Ø Flash memory-64 MB Ø DRAM: 128 MB Ø Model- 2900 series Cisco Switch	5	Each department requires a single switch (5*1=5). The switches will be required for network extension
Wireless router	Ø Auxiliary port: RJ 45 single port Ø USB port-1 Ø Flash memory: 256mb Ø LAN interface 4 fa ports Ø DRAM : 512MB	2	Wireless router will be used to support wireless handheld devices.
Firewall	Ø Cyberoam	1	Cyberoam firewall will be used to monitor incoming and outgoing traffic
Router	Ø Dram: 512 MB Ø Flash memory:128 MB Ø Interface card slots: 4 Ø Network slot: 1 Ø USB ports-2	1	Router is necessary to route outgoing traffic and route incoming traffic too.
Server	Ø Processor speed: 3.7 Ghz Ø Processor number:26 Ø Processor family: intel Ø Max memory: 2 TB Ø Memory slots: 18 DIMM Ø Cache level: l3 38.80	2	One server will be used to host DNS and DHCP services, another one will host print and file sharing and mailing.
Layer 3 Switch	Ø VLAN features Ø STP enabled Ø Routing capability	1	The layer 3 switch will be used to perform inter-VLAN roles.

Non-functional requirements

Device name	Quantity	Justification
RJ 45 clips	1600	For termination of patch codes
Trunking	40 pieces	For coverage of network cables
Patrice boxes	190 pieces	For termination of wall patch codes
Cabinets	5	For housing server and switches
Patch panel	5	For cable management
UPS	5	For power backup in the cabinets

Network Design

IP Addressing

LAN area	No of Nodes	Octet	NA	First Usable Address	LUA	Mask
Department: Finance	30	32	192.168.100.0	192.168.100.0	192.16.100.1	/27
Department:Human Resource	30	32	192.168.100.32	192.168.100.33	192.168.100.62	/27
Department:Administration	30	32	192.168.100.64	192.168.100.65	192.168.100.94	/27
Department:Engineering	30	32	192.168.100.96	192.168.100.97	192.168.100.126	/27
Deparment:Sales	30	32	192.168.100.128	192.168.100.129	192.168.100.158	/27
WAN	2	4	100.100.100.0	100.100.100.1	100.100.100.2	/24

Distribution Layer Switch Configuration

Step 1: Erasing Startup configuration File

Switch>

Switch>

Switch>ena

Switch#era start

Switch#reload

Proceed with reload? [Confirm]

Step 2: General Configuration

Switch>ena

Switch#conf ter

Switch(config)#hos DistributionLayerSwi

DistributionLayerSwi(config)#line vty 0 15

DistributionLayerSwi(config-line)#pass cisco1

DistributionLayerSwi(config-line)#login

DistributionLayerSwi(config-line)#logg sy

DistributionLayerSwi(config-line)#exi

DistributionLayerSwi(config)#line c 0

DistributionLayerSwi(config-line)#password cisco

DistributionLayerSwi(config-line)#logi

DistributionLayerSwi(config-line)#logg

DistributionLayerSwi(config-line)#logg sy

DistributionLayerSwi(config-line)#exi

DistributionLayerSwi(config)#serv pas

DistributionLayerSwi(config)#ena secre cisco1

DistributionLayerSwi(config)#vlan 30

DistributionLayerSwi(config-vlan)#ip add 192.168.100.33 255.255.255.224

DistributionLayerSwi(config-vlan)#exi

DistributionLayerSwi(config)#inter vla 30

DistributionLayerSwi(config-if)#ip add 192.168.100.33 255.255.255.224

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#vla 40

VLAN 40 added:

Name:VLAN0040

DistributionLayerSwi(config-vlan)#inter vla 40

DistributionLayerSwi(config-if)#ip add 192.168.100.1 255.255.255.224

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#vlan 50

DistributionLayerSwi(config-vlan)#inter vla 50

DistributionLayerSwi(config-if)#ip add 192.168.100.65 255.255.255.224

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#vlan 60

VLAN 60 added:

Name:VLAN0060

DistributionLayerSwi(config-vlan)#inter vla 60

DistributionLayerSwi(config-if)#ip add 192.168.100.97 255.255.255.224

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#vlan 70

VLAN 70 added:

Name:VLAN0070

DistributionLayerSwi(config-vlan)#inter vla 70

DistributionLayerSwi(config-if)#ip add 192.168.100.129 255.255.255.224

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#inter fa0/1

DistributionLayerSwi(config-if)#ip add 100.100.100.2 255.255.255.0

DistributionLayerSwi(config-if)#exi

DistributionLayerSwi(config)#no swi

DistributionLayerSwi(config)#inter fa 0/1

DistributionLayerSwi(config-if)#no switchport

DistributionLayerSwi(config-if)#ip add 100.100.100.2 255.255.255.0

DistributionLayerSwi(config-if)#no shu

DistributionLayerSwi(config-if)#exi

DistributionLayerSwi(config)#ip route 0.0.0.0 0.0.0.0 100.100.100.1

DistributionLayerSwi(config)#end

DistributionLayerSwi#copy run start

Destination filename [startup-config]?

Building configuration...

[OK]

Router configuration

Router>ena

Router#era start

Router#reloa

Proceed with reload? [confirm]

Building simulated configuration...

[OK]

Router>ena

Router#conf ter

Router(config)#hos RouterHQ

RouterHQ(config)#servi pass

RouterHQ(config)#ena sec

RouterHQ(config)#ena sec cisco1

RouterHQ(config)#banner motd *Do NOT tamper with this MAIN router.*

RouterHQ(config)#inter fa0/0

RouterHQ(config-if)#no shu

RouterHQ(config-if)#ip add 100.100.100.1 255.255.255.0

Router DHCP configuration

RouterHQ(config)#ip dhcp pool PQR_LAN

RouterHQ(dhcp-config)#leas 3 5 0

RouterHQ(dhcp-config)#net

RouterHQ(dhcp-config)#network 192.168.100.0

RouterHQ(dhcp-config)#dns-server 192.168.100.67

RouterHQ(dhcp-config)#default-router 100.100.100.1

RouterHQ(dhcp-config)#exi

RouterHQ(config)#ip dhcp

RouterHQ(config)#ip dhcp excluded-address 192.168.100.65 192.168.100.70

RouterHQ(config)#inter fa 0/0

RouterHQ(config-if)#ip helper-address 192.168.100.67

RouterHQ(config-if)#exi

RouterHQ(config)#copy run start

RouterHQ(config)#end

RouterHQ#copy run start

Destination filename [startup-config]?

Building configuration...

[OK]

Server Configuration

DHCP Server Configuration

In our project, we are going to use Windows 2012R server to host DHCP and DNS services for our network. Below are configuration steps for both DHCP and DNS services

Step 1: IP address assignment

Step 2: enable the DHCP and DNS service

DNS server

Security configuration

Security aspect is key to any business enterprise. It is important to keep at bay cyber-attacks that would in one way bring our network or business operational activities down to its knees. Wang says, prevention is better than cure. Though we may say we are keeping cyber-attacks at bay, this not enough, as employee education about cybercrime is important too. To achieve internal security controls, we are going to apply access lists on our router to make sure mentioned traffic does not get away into limited zones. For instance, traffic should not flow from sales and engineering department to finance department. It worth to mention too that cyberoam will be used to monitor both incoming and outgoing traffic [9]. See access list configuration implemented on router below.

RouterHQ(config)#end

RouterHQ#copy run start

Destination filename [startup-config]?

Building configuration...

[OK]

RouterHQ#confi ter

RouterHQ(config)#access-list 115 deny tcp 192.168.100.96 0.0.0.64 192.168.100.64 0.0.0.32

RouterHQ(config)#access-list 115 permit tcp 192.168.100.96 0.0.0.64 192.168.100.100 0.0.0.0

RouterHQ(config)#access-list 115 permit ip any any

RouterHQ(config)#inter fa0/0

RouterHQ(config-if)#ip access-group 115 in

RouterHQ(config-if)#end

RouterHQ#copy run start

[OK]

References