ccna discovery 4.0 designing and supporting computer...

2007CiscoSystems,Inc.Allrightsreserved. CiscoPublicITEPCv4.0Chapter1 1

CCNADiscovery4.0DesigningandSupportingComputerNetworks

CreatingtheNetworkDesignChapter5

ITEPCv4.0Chapter1 22007CiscoSystems,Inc.Allrightsreserved. CiscoPublic

Objectives


AnalyzingBusinessgoalsandtechnicalrequirements

Determininghowtodesignanetworktomeetbusinessgoalsisamultistepprocess.Thedesignerusuallyfollowsthesesteps:

Step1:Listthebusinessgoalsthatmustbemetbythenewdesign.

Step2:Determinewhatchangesoradditionsarenecessaryforthebusinesstomeetitsgoals.

Step3:Decidewhattechnicalrequirementsarenecessarytoimplementeachchange.

Step4:Determinehowthedesigncanaddresseachofthetechnicalrequirements.

Step5:Decidewhichdesignelementsmustbepresentinthefinaldesign.



DealingwithConstraints

TheDesignRequirementsdocumentincludesalistofconstraints.Usually,whenconstraintsaffectthedesign,compromisesmustbemade.Thenetworkdesignerexploresallpossiblealternativesandselectsthebestonestoincludeinthedesign.

MakingTradeoffs

Atradeoffisanexchangeofonebenefitoradvantageforanotherbenefitthatisdeterminedtobemoredesirable.Networkdesignconstraintsoftenforcetradeoffsbetweentheidealdesignandadesignthatisrealisticallyachievable.



Tradeoffsbetweenthebenefitsofanidealsolutionandtherealityofcostortimeconstraintsarecommon.Itisthejobofthedesignertominimizetheeffectsofthesetradeoffsonthemaingoalsofscalability,availability,security,andmanageability.

AnexampleofatradeoffinthestadiumnetworkdesignisabudgetlimitationthatpreventsaconnectiontoasecondaryInternetserviceprovider(ISP).Becauseofthislimitation,analternativestrategymustbedesignedtomeettheavailabilityrequirementsfortheecommerceservers.


Requirementsforscalability

Thestadiummanagementanticipatessignificantgrowthincertainareasofthenetwork.Theydonotexpectthenumberofwiredconnectionstoincreaserapidly.Thestadiummanagementplanstoaddatleasttwonewremoteofficesites.Thisexpansionincreasesthenumberofusersby50percent,toapproximately750users.

Thescalabilityrequirementsreceivedfromthestadiummanagementaresignificant:



50percentincreaseinthenumberoftotalusers(LANandWAN)

75percentincreaseinthenumberofwirelessusers

75percentincreaseinthenumberofonlinetransactionsservicedbythestadiumecommerceservers

100percentincreaseinthenumberofremotesites

AdditionofIPphones,andtheincorporationofthevideonetwork,adding350enddevices



PlannedWirelessAP

ExistingwirelessAP



Tosupportthisrapidgrowth,thenetworkdesignerdevelopsastrategytoenablethenetworktoscaleeffectivelyandeasily.Includedinthestrategyarethefollowingrecommendations:

DesignAccessLayermodulesthatcanbeaddedasnecessarywithoutaffectingthedesignoftheDistributionandCoreLayers.

Useexpandable,modularequipmentorclustereddevicesthatcanbeeasilyupgradedtoincreasecapabilities.



Chooseroutersormultilayerswitchestolimitbroadcastsandfilterotherundesirabletrafficfromthenetwork.

Plantousemultiplelinksbetweenequipment,usingeitherEtherChannelorequalcostloadbalancing,toincreasebandwidth.

CreateanIPaddressstrategythatishierarchicalandthatsupportssummarization.

Whenpossible,keepVLANslocaltothewiringcloset.


RequirementsforAvailabilityOnthestadiumnetwork,theplannedecommerce,security,andIPtelephonysystemsrelyontheunderlyingnetworkbeingavailable24hoursaday,7daysaweek.

Incompletewebsitetransactionscancausethestadiummanagementtoloserevenue.Ifthesecuritymonitoringbecomesunavailable,thesafetyofthestadiumcustomerscanbeendangered.Intheeventthatthetelephonesystemisdown,vitalcommunicationsarelost.


RequirementsforAvailability

Thenetworkdesignermustdevelopastrategyforavailabilitythatprovidesthemaximumprotectionfromfailureandthatisnottooexpensivetoimplement.Toprovidethenearly100percentuptimerequirementofthenetworkapplications,thedesignermustimplementhighavailabilityandredundancycharacteristicsinthenewdesign.



AvailabilityforECommerce

Anunreliablewebsitecanquicklybecomeasupportproblemandevendiscouragecustomersfrommakingtransactions.Toensurereliabilityforecommerce,usethefollowingrecommendedpractices:

DualconnecttheserversontwodifferentAccessLayerswitches.

ProvideredundantconnectionsattheDistributionLayer.



ProvidesecondaryDNSserverscolocatedattheISP.

IncludeadditionalmonitoringlocallyandthroughtheInternetfordevicesinthecriticalpath.

Wherepossible,includeredundantmodulesandpowersuppliesincriticalpiecesofequipment.

ProvideUPSandgeneratorpowerbackup.

Choosearoutingprotocolstrategythatensuresfastconvergenceandreliableoperation.

InvestigateoptionstoprovideanadditionalInternetserviceprovider(ISP)orredundantconnectivitytothesingleISP



TheSecurityMonitoringSystem

Theserversthatmaintainthevideofilesandthesecuritymanagementsoftwarehavethesameavailabilityrequirementsastheecommerceservers.Thefollowingadditionalmeasuresareneededforthecamerasandsurveillanceequipment:

Redundantcamerasincriticalareasthatareconnectedtoseparateswitchestolimittheaffectofafailure

PoweroverEthernet(PoE)tothecameras,withUPSand/orgeneratorbackup



TheIPTelephoneSystem

AlthoughtheinstallationofthenewIPtelephonesystemisoutsidethescopeofthisnetworkdesignproject,itisstillnecessaryforthenetworkdesignertoconsidertheavailabilityrequirementsinthedesign.ThedesignerfocusesonthefollowingrequirementsforprovidingredundancyandhighavailabilityontheAccessLayerswitches:



ImplementLayer3connectivitybetweentheAccessLayerandDistributionLayerdeviceswhenpossible.

ProvideredundantpowerandUPSbackup.

CreateredundantpathsfromtheAccessLayertotheCoreLayer.

Reducethesizeoffailuredomains.

Whenpossible,selectequipmentthatcansupportredundantcomponents.

Useafast,convergingroutingprotocol,suchasEIGRP


Requirementfornetworkperformance

Convergednetworks,suchasthenetworkbeingdesignedforthestadium,carryacombinationofdata,voice,andvideotraffic.Eachtypeoftraffichasuniqueservicerequirements.

Characteristicfeaturesofapplicationsonatypicalconvergednetworkinclude:

Packetsofvarioussizes

Distinctsetsofprotocols

Differenttolerancestodelayandjitter



Sometimestheservicerequirementsofoneapplicationconflictwiththeservicerequirementsofanother,resultinginperformanceproblems.Whenthissituationoccurs,frustrateduserscallthehelpdesktoreportthattheirapplicationisslow.

Evenskilled,experiencedITprofessionalsstruggletomaintainhighapplicationperformance.Deployingnewapplicationsandserviceswithoutdisruptingexistingonesisdifficult.



Onthenewstadiumnetwork,threeapplicationshavespecificperformancerequirementsthatmustbeaddressed:

TransactionProcessing

VideoDistributionandMonitoring

IPTelephoneVoiceQuality



Thenetworkdesignercreatesalistofthedesigngoalsandconsiderationsthatcouldaffecttheperformanceofthesehighpriorityapplications.

Goal:Improvetransactionprocessingtimetolessthan3seconds.

Reducethenetworkdiameter.

Restrictunwantedtrafficandbroadcasts.

Providehighbandwidthpathstokeyservers.

Recommendadditionalhighspeedstorageorcontentservers.



Goal:Providehighqualityvoiceandstreamingvideo.

DesignVLANandtrafficclassificationstrategy.

Keepthepathsfromservertoendpointsshort.

Reducethenumberoftimestrafficisfilteredorprocessed.

IncreaseWANsitebandwidthandimproveconnectivity.

DetermineQoSstrategyandtrafficpriorities.

IdentifyareaswherebottlenecksmightoccuranddeployaQoSstrategy.


Requirementsforsecurity

Securityistheoneareaofnetworkdesignwheretradeoffsshouldnotbemade.Althoughitmaybenecessarytofindlowercostorlessstreamlinedwaystoprovideasecurenetwork,itisneveracceptabletodisregardsecurityinordertoaddothernetworkcapabilities.

Anetworkriskassessmentidentifiestheareaswhereanetworkismostvulnerable.Networksthatcontainhighlyconfidentialorcriticalinformationoftenhaveuniquesecurityconsiderations.Organizationsdoriskassessmentsaspartoftheiroverallbusinesscontinuityanddisasterrecoveryplanning.



Mostnetworksbenefitfromstandardrecommendedpracticeswhenitcomestodeployingsecurity.Recommendedsecuritypracticesinclude:

Usefirewallstoseparatealllevelsofthesecuredcorporatenetworkfromotherunsecurednetworks,suchastheInternet.Configurefirewallstomonitorandcontrolthetraffic,basedonawrittensecuritypolicy.

CreatesecuredcommunicationsbyusingVPNstoencryptinformationbeforeitissentthroughthirdpartyorunprotectednetworks.



Preventnetworkintrusionsandattacksbydeployingintrusionpreventionsystems.Thesesystemsscanthenetworkforharmfulormaliciousbehaviorandalertnetworkmanagers.

ControlInternetthreatsbyemployingdefensestoprotectcontentandusersfromviruses,spyware,andspam.

Manageendpointsecuritytoprotectthenetworkbyverifyingtheidentityofeachuserbeforegrantingaccess.

Ensurethatphysicalsecuritymeasuresareinplacetopreventunauthorizedaccesstonetworkdevicesandfacilities.

SecurewirelessAPsanddeploywirelessmanagementsolutions.


MakingNetworkDesignTradeoffs

Afterthenetworkdesignerlistsalltheelementsthatneedtobepresentinthestadiumupgradedesign,someharddecisionsmustbemade.Unfortunately,fewnetworkscanbedesignedwithoutconsidering:

Thecostofthenetwork

Thedifficultyofimplementation

Thefuturesupportrequirements

TheStadiumCompanyhasplacedsomeconstraintsonthenetworkupgradethatrequirethedesignertoevaluatedifferentdesignoptions.Itmaybenecessarytomaketradeoffsinsomeareastoaccommodatetheseconstraints.



TheprimarybusinessgoaloftheStadiumCompanyistoimprovetheatmosphereandsafetyforthethousandsofpeoplewhoattendstadiumevents.Networkimprovementsthatdirectlyaffecthowthenetworksupportsthisgoalmustbeatoppriorityforthedesignerwhenmakingdesigntradeoffs.

Supportingthebusinessgoalsmayleadtodecisionsthateliminateorcomplicateotherdesirableornecessaryimprovements.Forexample,addingwirelessaccesstoimprovethecustomerexperienceintheluxuryboxesandrestaurantmaydecreaseserversecurityunlesstheguestaccessisisolatedfromtheinternalnetwork.


DesigninganAccessLayerTopology AccessLayerRequirements

ThedesignercreatesthefollowinglistofAccessLayernetworkrequirementsforthenewnetwork:

ProvideconnectivityforexistingnetworkdevicesandaddwirelessaccessandIPtelephones.

CreateVLANstoseparatevoice,securitysurveillancemonitoring,wirelessaccess,andnormaldatadevices.

RestrictVLANstowiringclosets,withtheexceptionofthewirelessVLAN,tosupportfutureroamingrequirements.


DesigninganAccessLayerTopology

ProvideredundantlinkstotheDistributionLayernetwork.Usethe16existing2960switcheswherepossible.ProvidePoweroverEthernet(PoE)toIPphonesandwirelessaccesspoints,ifpossible.ProvideQoSclassificationandmarkingcapabilities.



Anincreaseinthenumberofhostsdoesnotalwaysnecessitateanequalincreaseinthenumberofdevicesandports.Forexample,IPphonesandotherdevicesincludeanembeddedswitchthatpermitsaPCtobepluggeddirectlyintothephone.Thisswitchreducesthenumberofportsneededinthewiringclosettoconnecttheadditionaldevices.Assumingthatover50percentoftheIPphonesalsoconnectPCdevices,addingmoredataconnectionsmaynotrequiretheadditionofanewswitchtothewiringcloset.



IPPhoneshavethreeports:

Port1isanexternalportthatconnectstotheswitchoranotherVoIPdevice.

Port2isaninternal10/100interfacethatcarriestheIPphonetraffic.

Port3isanexternalaccessportthatconnectstoaPCoranotherdevice.



The16existing2960switchesaretobeusedintheAccessLayertoprovideenduserconnectivity.Thenetworkdesignermustensurethatthe2960switchissuitableforthenewnetwork.

2960SwitchCapabilities

Theseswitchesarefixedconfiguration10/100Ethernetswitcheswithtwo10/100/1000uplinkports.The2960cansupportmostofthefollowingrequirementsoftheAccessLayernetwork:



ScalabilityThe2960supportsCiscoswitchclustering;therefore,newswitchescaneasilybeaddedtosupportadditionalconnectivity.

AvailabilityThe2960supportsredundantpowersupplies.Redundantswitchmanagementisavailablewhentheswitchesareconfiguredinacluster.Twoswitchescanbeconfiguredasthecommandswitches.Ifonefails,therestoftheclustercanstillfunction.Classificationandmarkingcapabilitiesarealsoavailableinthismodel.



SecurityPortsecurityandotherswitchsecurityoptionsareavailable.

ManageabilityTheswitchessupportSimpleNetworkManagementProtocol(SNMP).Theycanbemanagedinbandandoutofband.The2960supportsthestandardCiscoIOSsoftwarecommandset,aswellasCiscoNetworkAssistantGUIconfigurationandmanagementtools.



LimitationsoftheExistingEquipment

The2960switchhascertainlimitationsinthenewnetworkdesign.Thecurrent2960switchesinthestadiumnetworkneedadditionaltransceiverstosupportthefiberuplinks.Becauseonlytwofiberconnectionsareavailabletoeachwiringcloset,multiple2960switchesmustbeclusteredtosharetheuplinks.The2960isaLayer2switch;therefore,thenetworkdesignerislimitedtoprovidingLayer2functionalityattheAccessLayer.



PowerRequirements

Althoughthe2960switchdoesnotsupportPoE,itdoessupportvoiceVLANcapability.ItmaybenecessarytousepoweredpatchpanelstoprovidepowertotheIPphonesuntiltheswitchesarereplacedinthefuture.

UPSunitsprovidebackuppowerfortheswitchesandthepoweredpatchpanels.ThedesignerrecommendsthepurchaseofageneratortoprovidepowertocriticalareasoftheAccessLayer.


DesigningDistributionLayerTopology DistributionLayerRequirements

ThenetworkdesignercreatesthefollowinglistofDistributionLayerrequirementsforthenewnetwork:

Provideredundantcomponentsandlinkstominimizetheeffectofafailure.

Supporthighdensityrouting.Eachofthe16wiringclosetsinthestadiummayeventuallyhavemorethanoneuplinktotheDistributionLayerswitches.

Providetrafficfilteringcapabilities.

ImplementQoSmechanisms.

Providehighbandwidthconnectivity.

Implementafastconvergingroutingprotocol.

Aggregatetrafficandperformroutesummarization.


DesigningDistributionLayerTopology

Multilayerswitchesareanappropriatechoiceformeetingtheserequirements.Theyprovidehighportdensityandsupportthenecessaryroutingcapabilities.TheDistributionLayerdesignincludesconnectivityfortheLANusers,serverfarm,andenterpriseedgedistribution.Sixmultilayerswitchesneedtobepurchasedtoprovidetherequiredsupport.



DesignConstraints

ThelimitedamountoffiberconnectivitytothewiringclosetsistheonlydesignconstraintthatlimitstheDistributionLayer.ThetwofiberpairsthatconnectthewiringclosetslimitthenumberofswitchesthatcanberedundantlyconnectedtotheDistributionLayerequipment.Becauseallofthefiberterminatesinacentrallocation,muchoftheDistributionLayerequipmentmustbeinstalledinthenewdatacenter.



MultilayerSwitchCapabilities

UsingMultilayerswitchesattheDistributionLayermeetsthestadiumdesigntechnicalrequirements:

ScalabilityThemodularmultilayerswitchessupportadditionalfiberandcopperports.UsingroutingattheDistributionLayeravoidsmanyLayer2SpanningTreeProtocol(STP)reconfigurationissues.Newswitchblockscanbeaddedwithoutaffectingtheexistingtopology.



AvailabilityThemidrangemultilayerswitchessupportredundantpowersuppliesandfans.Moreimportantly,theysupportredundantmanagementmodulesandfastfailovertechnology.Ifonemanagementmodulefails,thesecondarymoduletakesover,withnoperceptiblelossofconnectivity.TheLayer3switcheddesignmakesthebestuseofnetworklinksbyefficientloadbalancingoftheroutedtraffic.RoutingprotocolscanbeconfiguredtoconvergeasfastasSTPorfaster.RoutesummarizationcanoccurattheDistributionLayer,reducingtheimpactofanAccessLayerdeviceorlinkfailureontheCoreLayerrouting.



SecurityAccesslistfiltering,portsecurity,andfirewallfeaturesetsareavailableonthemultilayerswitchCiscoIOS.Additionalsecurityfeaturespreventunauthorizedorunwantednetworktraffic.

ManageabilityTheswitchessupportSNMP.Theycanbemanagedbothinbandandoutofband.


DesigningCoreLayerTopology

TheCoreLayerofthestadiumLANmustprovidehighspeedconnectivityandhighavailability.BoththelocalandremotestadiumnetworksdependontheCoreswitchesforconnectivity.

CoreLayerRequirements

DesignrequirementsfortheCoreLayernetworkinclude:

HighspeedconnectivitytotheDistributionLayerswitches

24X7availability

RoutedinterconnectionsbetweenCoredevices

HighspeedredundantlinksbetweenCoreswitchesandbetweentheCoreandDistributionLayerdevices


DesigningCoreLayerTopology TheCoreLayerdesignrequireshighspeed,lowerdensity,multilayerswitching.Inthenewdesign,

theCoreLayernetworkforthestadiumcanbeimplementedontwopowerfulmultilayerswitches.

TheCoreLayerisreservedforhighspeedtrafficswitching;therefore,littleornopacketfilteringisdoneatthislayer.

Inasmallbusinessenvironment,theDistributionandtheCoreLayersarefrequentlycombined.ThismaybereferredtoasacollapsedCoreoracollapsedbackbone.



HighAvailability

ThetoppriorityattheCoreLayerofthenetworkishighavailablity.Thenetworkdesignerneedstoconsideranymeasuresthatcanbetakentoimprovereliabilityanduptime.

RedundantlinksbetweentheCoreLayerandtheDistributionLayershouldbeestablished.Installingredundantcomponentsandtakingadditionalmeasurestoprovideredundantairconditioning,power,andservicestotheCoreLayerdevicesshouldbeimplementedwhereverpossible.



UsingaLayer3routingprotocolsuchasEIGRPorOSPFattheCoreLayercandecreasethetimeittakestorecoverfromalinkfailure.RoutedconnectionsbetweentheCoreLayerswitchescanprovideequalcostloadbalancingaswellasrapidrecovery.

Speed

ThenextpriorityattheCoreLayerisspeed.AlmostallofthestadiumnetworktrafficmusttravelthroughtheCoreLayerdevices.Highspeedinterfaces,fiberconnectivity,andtechnologiessuchasEtherChannelcanprovideenoughbandwidthtosupportthetrafficlevelandletthenetworkgrowinthefuture.


CreatingthelogicalnetworkDiagramfortheWAN

CreatingtheLogicalLANDiagram

ThefinalstepinthepreliminaryLANnetworkdesignistocreatethelogicaldiagramforthenewstadiumnetwork.Thisdiagramshowshowallofthevariouslayersanddevicesinterconnect.

InthenewstadiumLAN,eachofthe16wiringclosetscontainsatleastone2960switch.Becausetherearethreedistinctmodulesinthestadiumnetwork,sixDistributionLayerswitchesaggregateandroutetrafficbetweentheAccessLayerandtheCoreLayer.


TheCoreLayerconsistsoftwohighendmultilayerswitcheswithredundancy.TheyareconnectedtotheDistributionLayerandtoeachotherwithgigabitlinks.

ThenetworkdesignermakesnotesonthenetworkdiagramtoindicatewheretheserversandIPservicesarelocated.AftercompletingthewiredcampusLANdesign,thedesignerthenplanstheportionofthenetworkthatsupportsremoteconnectivityintothestadiumLAN.



DeterminingConnectivityfortheremotesites

Attheenterpriseedge,thestadiumnetworkconnectstotheInternetviaDSLprovidedbyalocalISP.ISPmanagedroutersarelocatedatthestadiumconnectedtotheEdgeRouteroftheStadiumCompany.

ExtendingServicestoRemoteLocations

Thetwoexistingremotelocations,aticketingofficelocatedinthedowntownareaandasouvenirshopinalocalshoppingmall,usethesameISPproviderasthemainstadiumsite.TheISPalsoprovidesamanagedVPNservicetothem.Theseconnectionsprovidetheremotesiteswithaccesstothedatabaseslocatedonserversinthestadiummanagementoffices.



Oneofthehighprioritygoalsofthenewstadiumnetworkistoextendthevoiceandvideonetworktotheremotelocations.Therearetwoadditionalremoteconnectionsplanned:

Afilmproductioncompany,hiredtoprovidevideoduringandafterevents,needstoconnecttothestadiumnetworktoexchangefiles.

Asportsteamthatcurrentlyleasesspaceinthestadiumisexpandingtoaremoteofficelocation.TheteamneedsaccesstothesamenetworkresourcesthatitusesonthestadiumLAN.



AddingNewWANConnections

ThenetworkdesignerrealizesthatdedicatedWANconnectionsarerequiredtomeetthesenewgoals.ARFQissenttotheTelecommunicationsServiceProviders(TSPs)intheareatodeterminethecostandavailabilityofWANservices.

Becausethestadiumislocatedoutsidethecitylimits,thechoicesforWANconnectivityarelimitedtopointtopointT1andFrameRelay.TheseservicesareavailabletoboththestadiumandtheremotelocationsthroughalocalTSP.



AlthoughthepointtopointT1serviceoffersthemostcontroloverthequalityofserviceavailabletotheWANsites,theFrameRelayserviceislessexpensive.ThenetworkdesignerrecommendsthatthestadiumuseFrameRelaytoconnecttotheremotesitesuntilaMetroEthernetorotherhighspeedservicebecomesavailableinthearea.



AnadvantageofusingaFrameRelayconnectionoverpointtopointT1connectionsisthatasinglephysicalconnectiontotheTSPcanprovideconnectivityfromthestadiumtomultipleremotesitelocations.

FrameRelayConnectionTypes

FrameRelaynetworkstransferdatausingoneofthesetwoconnectiontypes:



SwitchedVirtualCircuits(SVCs)aretemporaryconnectionscreatedforeachdatatransferandthenterminatedwhenthedatatransferiscomplete.

PermanentVirtualCircuits(PVCs)arepermanentconnections.ThistypeofconnectionistobeprovidedbetweenthestadiumnetworkandtheremoteWANsites.

Afterdiscussionswithstadiummanagement,theNetworkingCompanystaffdecidestoinstallaFrameRelayconnectionfromthestadiumtothesouvenirshopasapilottotestthededicatedWANconnectivity.


DefiningTrafficPatternsandapplicationsupport

NetworkServicesforRemoteSites

Whendeterminingthephysicalmethodforconnectingtheremotesitestothemainstadiumnetwork,thenetworkdesignermustalsoanalyzehowworkersattheremotesitesexpecttousethenetworkservices.Theremotesiteshavesomeapplicationsincommonandsomerequirementsthatareunique.Servicesneededbytheremotesitesinclude:

Accesstotheecommerceanddatabaseservices

IPtelephony

Videosurveillanceandmonitoring



Inaddition,thenewremoteteamofficerequiresaccesstotheteampayrollandaccountingserverlocatedatthestadium.

TheFilmCompanyemployeesneedtobeabletoremotelymonitorthevideoscreensthroughoutthestadiumandtransfervideofilestothestadiumwebservers.

ThedesignermakesachartofthetrafficflowsfromeachWANconnectionthroughthenetworktothevariousservicelocations.


DesigningVPNandEndpointConnectivityOptions

BackinguptheFrameRelayLink

TheticketsalesofficeandthesouvenirshopconnectbacktothestadiumnetworkusingsitetositeVPNsthroughtheInternet.TheroutersatthestadiumandremotesitesthatprovideendpointsforeachVPNareownedandmanagedbytheISP.ThenetworkdesignerplanstousetheseVPNconnectionsasabackuptotheFrameRelaydedicatedconnections,intheeventthattheFrameRelaylinkfails.Thedesignerrecommendsabackuplinkfromeachofthetwonewsitesaswell.Asecondedgerouteratthemainsiteisplannedforredundancy.


SupportingRemoteWorkers

Thestadiummanagementwouldalsoliketosupportremoteworkerswhooccasionallyworkfromhomeorfromotherremotesites.Thesportsteampersonnel,forexample,needtobeabletoaccesstheteamserversecurelywhentraveling.ClientVPNaccesscanbeprovidedthroughthesameISPmanagedservice.Thedesignerrecommendsthatthestadiummanagementinvestigatethisoption.TheyagreetocontacttheISPtodiscusstheupgrade.



CreatingthelogicalNetworkdesignforWAN

RoutingandIPAddressing

Intheexistingnetwork,theWANsitesuseonlytheVPNtoconnectbacktothestadium.Simplestaticroutesaresufficienttoensureconnectivity.DHCPaddressingisprovidedtotheremotesiteLANsbytheISPmanagedservicesrouter.

ProvidingbothVPNanddedicatedWANconnectionstoeachsiterequiresthatthenetworkdesignercarefullychoosetheIPaddressrangesthatareusedforeachsite.Itmaybenecessarytochangetheaddressrangesfortheremotesites.


CreatingthelogicalNetworkdesignforWANTheadditionofthenewWANconnectiontoeachofthesitesincreasesthenumberofpossiblepathstothestadiumnetworkfromonetotwo.Asaresult,staticroutingmaynotbethebestmethodusedtoensureconnectivitytotheservicesonthestadiumLAN.ItmaybenecessarytouseadynamicroutingprotocoltoenabletheremoteLANstomaintainconnectivityintheeventofaFrameRelaylinkfailure.Thenetworkdesignermakesanoteofthis,sothatitisconsideredwhenthestadiumroutingprotocolimplementationisdesigned.


CreatingthelogicalNetworkdesignforWAN


DesigningCoverageoptionsandmobility

AddingWirelessNetworkCoverage

Aprimarygoalofthenewdesignistoaddwirelessnetworkcoveragetothenetwork.

Inresponsetorequestsfromthelocalmedia,thestadiummanagementaddedaninexpensivewirelessAPtoprovidewirelessInternetinthepressbox.Someemployeesalsopurchasedwirelessaccessrouters,providinglowgradewirelesscoverageintheteamoffices.ThesetypesofdevicesarenotrobustenoughforanenterpriseLANwirelessimplementation.



WirelessNetworkCoverage

Tomeetthegoalsforthenewstadiumnetworkdesign,wirelesscoverageisnecessaryinfouridentifiedareas:

Pressbox

Teamloungeareas

Stadiumrestaurant

Luxurysuiteslocatedaroundthestadium

ThetwoexistingwirelessAPsneedtobereplacedwithmoremanageabledevices.Someareasrequireguestwirelessaccess.



Play5.4.1

file:///C:/CISCO_CCNA/Discovery4_English/index.html



UnifiedWirelessandWiredSolutions

IntegrationofthenewwirelessnetworkwiththewiredstadiumLANsimplifiesmanagementandmakesuseofthesecurityandredundancyoftheEthernetinfrastructure.

StandaloneAPsconnectedtotheEthernetswitchesinthewiringclosetcanprovidethenecessarywirelesscoveragetothefourpreviouslyidentifiedareasinthestadium.LimitedwirelessroamingcanbesupportedbycreatingwirelessVLANsthatspanthenetworkandwirelesscoverageareasthatoverlap.



Althoughthissolutionmeetsthecurrentstadiumnetworkgoals,thenetworkdesignerrecommendsthatthestadiumpurchaseLightweightAccessPointsLAPsandwirelessLANcontrollerstosupportthewirelessrequirements.LAPsarenotstandalonedevices;theyrelyonthewirelesscontrollerforconfigurationandsecurityinformation.

Unifiedwirelessnetworksolutionsthatincludewirelesscontrolsystemsoftwareofferadvancedfeatures,suchascentralizedmanagementandmultipleservicelevelsfordifferentuserandclienttypes.ThesesystemsallowdifferentlevelsofQoSandsecurityfordifferenttypesofwirelessuse.



Thewirelesssolutionproposedbythenetworkdesignermeetsthefollowingrequirementsforthestadiumnetworkupgrade:

ScalabilityNewLAPscanbeaddedeasilyandmanagedcentrally.

AvailabilityAPscanautomaticallyincreasetheirsignalstrengthifoneAPfails.



SecurityEnterprisewidesecuritypoliciesapplytoalllayersofawirelessnetwork,fromtheradiolayerthroughtheMACLayerandintotheNetworkLayer.Thissolutionmakesiteasiertoprovideuniformlyenforcedsecurity,QoS,anduserpolicies.Thesepoliciesaddressthespecificcapabilitiesofdifferentclassesofdevices,suchashandheldscanners,PDAs,andnotebookcomputers.SecuritypoliciesalsoprovidediscoveryandmitigationofDoSattacks,anddetectionanddenialofrogueAPs.ThesefunctionsoccuracrossanentiremanagedWLAN.



ManageabilityThesolutionprovidesdynamic,systemwideRFmanagement,includingfeaturesthataidsmoothwirelessoperations,suchasdynamicchannelassignment,transmitpowercontrol,andloadbalancing.ThesinglegraphicalinterfaceforenterprisewidepoliciesincludesVLANs,security,andQoS.



TheresultsofthestadiumwirelesssitesurveyindicatethattherestaurantrequiresatleasttwoAPstoprovidehighqualitywirelesscoverage.

Thenetworkdesignerdeterminesthattocontainthewirelesssignalwithintherestaurant,itisbesttomountdirectionalAPsagainstthetwooutsidewalls.

Thesitesurveydidnotuncoveranyissuesthatwouldcausewirelessinterferencewithintheeatingareas.However,thekitchenareamicrowaveovenmaycauseinterferencenearthebar.



Eachofthe20luxurysuiteslocatedaroundthestadiumrequiresasingle,ceilingmounted,lowpowerAPinthecenterofroom.

ThepressboxcurrentlyhasasinglestandaloneAPthatdoesnothaveadequatecoverage.TwonewlightweightAPsarerecommended.


RedundancyandresiliencyinawirelessNetwork

AvailabilityConsiderations

Theavailabilityofawirelessconnectionisdependentonthefollowingfactors:

LocationoftheAP

SignalstrengthoftheAP

NumberofuserssharingtheAPconnectivity

WirelessnetworksusingstandaloneAPsusuallyhavetheAPsconfiguredanddeployedwiththechannelandpowerstaticallyset.Thechannelandpowersettingsaredeterminedbythenetworkdesigner.



DynamicReconfiguration

IncontrasttotheautonomousAPs,wirelessLANcontrollersautomaticallydeterminethesignalstrengththatexistsbetweenlightweightAPswithinthesamenetwork.Thesecontrollerscanusethisinformationtocreateadynamic,optimalRFtopologyforthenetwork.

WhenaCiscoLAPboots,itimmediatelylooksforawirelessLANcontrollerwithinthenetwork.WhenitdetectsawirelessLANcontroller,theAPsendsoutencryptedneighbormessagesthatincludetheMACaddressandsignalstrengthofanyneighboringAPs.



CentralizationLoadBalancesUsers

Throughencryptedovertheairmessages,CiscowirelessLANcontrollersdetecttheentirenetwork.ThesecontrollersalsodetectsignalstrengthbetweenAPs.WhenaclientlooksforanAPtoconnectto,aprobeissenttothecontrollerfromeachAPthathearstherequestfromtheclient.ThecontrollerdetermineswhichAPrespondstotherequestfromtheclient,takingintoaccountthesignalstrengthoftheclientandsignaltonoiseratio.



Forexample,anadjacentAPmayprovideanequivalentservicebutatalowersignalstrength.ThecontrollerdetermineswhichAPshouldrespondtotheprobefromtheclient,basedonitssignalstrength,orReceiverSignalStrengthIndicator(RSSI).

ThesemeasuresimprovetheavailabilityofwirelessserviceswithintheWLAN.WirelesscontrollerscentrallylocatedinthedatacenterbenefitfromthehighavailabilityandredundantconnectionscontainedinthewiredLAN.


CreatingtheLogicalNetworkDesignforaWAN

IPAddressinginaWLAN

ThenetworkdesignermustalsoconsidertheIPaddressingstructurewhenplanningwirelessroaminginaWLAN.InthecaseofstandaloneAPs,asingleVLANiscreatedandextendedtoallofthewiringclosetstoconnecttheAPsinthesameLayer3IPnetwork.However,ifalargenumberofwirelessusersconnecttothenetwork,broadcastsbecomeaproblem.Thenetworkisnolongerscalable.



Layer3Roaming

WhenusingthewirelesscontrollersandlightweightAPs,Layer3roamingcanbeintroducedintoanetwork.ItisnotnecessarytoextendVLANstoalloftheAPsinthenetworktokeepaflatwirelesssubnet.

Withthewirelesscontroller,thelightweightAPsareinstalledinthenormalsubnetinfrastructureandaregivenanIPaddressthatislocaltothesubnettowhichtheyaredeployed.AlltrafficthatcomesfromwirelessclientsisplacedintoapacketthatistunneledthroughtheunderlyingnetworktothewirelessLANcontroller.



Play5.4.4

file:///C:/CISCO_CCNA/Discovery4_English/index.html


Placingsecurityfunctionsandappliances

Threatstonetworkscancomeinmanydifferentforms,andfrombothinternalandexternalsources.Simplyplacingafirewallattheenterpriseedgedoesnotensurenetworksecurity.Thenetworkdesignermustidentifywhichdataandcommunicationsareatriskandwhatthepotentialsourcesofattacksare.Securityservicesthenneedtobeplacedatappropriatepointsthroughoutthenetworkdesigntopreventlikelyattacks.


Placingsecurityfunctionsandappliances Theecommerceserversonthestadiumnetworkcontaincustomer

informationthatmayincludecreditcardandbankingdetails.UsersaccesstheseserversfromwithinthestadiumnetworkandthroughtheInternet.

Thestadiummanagementandteamadministrativeserverscontainpersonnelandpayrollinformation.Theseservers,andtheinfrastructurethattransportsthedatatheycontain,mustbesecuredadequatelytoprotectthisinformationfromunauthorizeduse.

Securitymeasuresrelatingtothestadiumwirelessnetworkneedtobeconsideredaswell.



Securityserviceshelpprotectthedevicesandthenetworkfromintrusion,tampering,alteringofdata,anddisruptionofservicesthroughDenialofService(DoS)attacks.Theprimarycategoriesofsecurityservicesinclude:

Infrastructureprotection

Secureconnectivity

Threatdetection,defense,andmitigation



InfrastructureProtection

Networksecuritybeginswithsecuringthenetworkdevicesthemselves.ThisinvolvessecuringCiscoIOSsoftwarebasedrouters,switches,andappliancesfromdirectaswellasindirectattacks.Thisprotectionhelpstoensureavailabilityofthenetworkfordatatransport.

SecureConnectivity

Itiscriticaltopreventunauthorizedusersfromaccessingthenetwork.Thiscanbedonebyensuringthatthephysicalnetworkissecure,andbyrequiringauthenticationtogainaccesstowirelessservices.



ThreatDetection,Defense,andMitigation

Firewalls,IDS,IPSandACLsprovideprotectionfromthreatsandattackers.ACLsandfirewallrulesfiltertraffictopermitonlydesirabletrafficthroughthenetwork.



ImplementingSecurityServices

Securityservicesarenoteffectiveiftheyarenotimplementedatthecorrectlocationsthroughoutthenetwork.FirewallsandfiltersplacedattheenterpriseedgedonotprotectserversfromattacksfromwithintheLAN.Thenetworkdesigneranalyzesthetrafficflowdiagramsthatwerecreatedearlierthatshow:

Resourcesthatareaccessedbyinternalusers

Resourcesthatareaccessedbyexternalusers

Pathsthatthisaccesstakesthroughthenetwork



UsingIntegratedServices

Whereverpossible,thenetworkdesignerusesintegratedservices,suchasIOSbasedfirewallfeaturesandIDSmodulestoeliminatetheneedforadditionalsecuritydevices.Inalargernetwork,itisnecessarytouseseparatedevicesbecausetheadditionalprocessingcancauseroutersandswitchestobecomeoverloaded.


ImplementingAccessControlListandFilters

ThenetworkdesignerworkswiththestadiumITstafftodefinethefirewallrulesetstobeimplementedinthestadiumnetworkupgrade.

Examplesoffirewallrulesetsincludethesestatements:

DenyallinboundtrafficwithnetworkaddressesmatchinginternalregisteredIPaddressesInboundtrafficshouldnotoriginatefromnetworkaddressesmatchinginternaladdresses.

DenyallinboundtraffictoserverexternaladdressesThisruleincludesdenyingservertranslatedaddresses,withtheexceptionofpermittedports.



DenyallinboundICMPechorequesttrafficThisrulepreventsinternalnetworkhostsfromreceivingpingrequestsgeneratedfromoutsidethetrustednetwork.

DenyallinboundMicrosoftDomainLocalBroadcasts,ActiveDirectory,andSQLserverportsMicrosoftdomaintrafficshouldbecarriedoverVPNconnections.

AllowDNS(UDP53)toDNSserverPermitexternalDNSlookups.

Allowwebtraffic(TCP80/443)fromanyexternaladdresstothewebserveraddressrange.



Allowtraffic(TCP21)toFTPserveraddressrangesIfFTPservicesareprovidedtoexternalusers,thisrulepermitsaccesstotheFTPserver.Asareminder,whenusingFTPservices,useraccountandpasswordinformationistransmittedincleartext.UseofpassiveFTP(PASV)negotiatesarandomdataportversustheuseofTCPport20.

Allowtraffic(TCP25)toSMTPserverPermitexternalSMTPusersandserversaccesstointernalSMTPmailserver.

Allowtraffic(TCP143)tointernalIMAPserverPermitexternalIMAPclientsaccesstointernalIMAPserver.



Thesecuritypoliciesofthestadiummanagementdictateuserandgrouppermissionstoresources.Thedesigneralsocomplieswiththerecommendedpracticesdefinedbytheserveroperatingsystemvendors.Thesepracticeshelptoidentifyandfiltertrafficthatisknowntobemalicious.

WhendesigningfirewallrulesetsandACLs,thegeneralpolicyistodenyalltrafficthatiseithernotspecificallyauthorizedorisnotinresponsetoapermittedinquiry.



RuleSetsandAccessControlLists

FirewallrulesetsareusedtocreatetheACLstatementsthatareimplementedontheroutersandfirewallappliances.EachfirewallrulesetmayrequiremorethanoneACLstatementandmayrequirebothinboundandoutboundplacement.


UpdatingtheLogicalNetworkDesignDocumentation

ThedesigndocumentationincludesallfirewallrulesetsandACLsanddefineswheretheyareimplemented.Rulesetstatementsbecomepartofthestadiummanagementsecuritypolicydocumentation.

DocumentingthefirewallrulesetsandtheACLplacementoffersthesebenefits:

Providesevidencethatthesecuritypolicyisimplementedonthenetwork

Ensuresthatwhenchangesarenecessary,allinstancesofapermitordenyconditionareknownandevaluated

Assistsintroubleshootingproblemswithaccesstoapplicationsorsegmentsofthenetwork

CCNA Discovery 4.0 Designing and Supporting Computer NetworksObjectivesAnalyzing Business goals and technical requirementsSlide 4Slide 5Slide 6Requirements for scalabilitySlide 8Slide 9Slide 10Slide 11Requirements for AvailabilitySlide 13Slide 14Slide 15Slide 16Slide 17Slide 18Slide 19Slide 20Slide 21Requirement for network performanceSlide 23Slide 24Slide 25Slide 26Requirements for securitySlide 28Slide 29Slide 30Making Network Design TradeoffsSlide 32Slide 33Designing an Access Layer TopologySlide 35Slide 36Slide 37Slide 38Slide 39Slide 40Slide 41Slide 42Slide 43Slide 44Designing Distribution Layer TopologySlide 46Slide 47Slide 48Slide 49Slide 50Designing Core Layer TopologySlide 52Slide 53Slide 54Slide 55Creating the logical network Diagram for the WANSlide 57Slide 58Determining Connectivity for the remote sitesSlide 60Slide 61Slide 62Slide 63Slide 64Slide 65Slide 66Slide 67Defining Traffic Patterns and application supportSlide 69Slide 70Designing VPN and End point Connectivity OptionsSlide 72Slide 73Creating the logical Network design for WANSlide 75Slide 76Designing Coverage options and mobilitySlide 78Slide 79Slide 80Slide 81Slide 82Slide 83Slide 84Slide 85Slide 86Slide 87Slide 88Redundancy and resiliency in a wireless NetworkSlide 90Slide 91Slide 92Slide 93Creating the Logical Network Design for a WANSlide 95Slide 96Placing security functions and appliancesSlide 98Slide 99Slide 100Slide 101Slide 102Slide 103Slide 104Implementing Access Control List and FiltersSlide 106Slide 107Slide 108Slide 109Slide 110Slide 111Updating the Logical Network Design Documentation

ccna discovery 4.0 designing and supporting computer...

Documents