DCS835 Compute Network and the Internet CSIS DCS835 Compute Network and the Internet VLANS Team 0 Maria Sette Roshan Shaikh 8/2/2011 Team 0

Outline Motivation Design Operation Security Conclusion References Q/A CSIS Outline Motivation Design Operation Security Conclusion References Q/A 8/2/2011 Team 0

Motivation – VLAN Contemporary LANs Need Segmentation CSIS Topology (All Within 802.3 Ethernet - TP) Geographic Organizational Functional Load [1] Functional Network Mis-configured Network (Broadcast Storms) Broadcast [2] Efficient Use of Available Ports 8/2/2011 Team 0

CSIS VLANS Ethernet 802.1Q [2] Group Of LANs That Have Different Physical Connections – Virtual Broadcast Domains [3] Communicate As If They Are Connected On A Single Network Segment [3] Unicast Or Broadcast Data Transmission Is Limited - Traffic Is Reduced [4] Software Based Solution Allows IT Administrators To Adapt To Changes 8/2/2011 Team 0

Advantages Ease of administration [8] Confinement of broadcast domains CSIS Advantages Ease of administration [8] Confinement of broadcast domains Reduction in network traffic Enforcement of security policies [10] 8/2/2011 Team 0

Design Ethernet 802.1Q New Frame Format (1995) CSIS Design Ethernet 802.1Q New Frame Format (1995) Ethernet Header (802.3) + VLAN Tag 802.3 VLAN Tag 802.1 Q (1998) Dest. Address Source Address Len Data Pad FCS Pri CFI VLAN Identifier Dest. Addr. Source Addr. V-Tag VLAN Protocol 0 x 8100 Len Data Pad FCS 8/2/2011 Team 0

Design Number of VLANS Port Name & ID (Color) Topology CSIS Switch Computer Topology Geographic Organizational Functional Hybrid 8/2/2011 Team 0

Types Backward Compatibility CSIS How a packet gets assigned to a VLAN-Aware Switch [5] Port-based MAC address-based L3 protocol-based Backward Compatibility Only VLAN Switches 802.1 Q NICs 8/2/2011 Team 0

Requirements > 200 devices on LAN? CSIS Requirements > 200 devices on LAN? Groups of users need more security? [2] Slow Network by too many broadcasts? [3] Groups of users need to be on the same broadcast domain running the same applications - VoIP phones? 8/2/2011 Team 0

CSIS Operation Logical Broadcast Domains In A Single Switch Or Multiple Switches, Regardless Of Physical Proximity Configuration (CISCO) [7] VLAN Trunk Protocol (VTP) Mode, Domain Name, Which Ports On The Switch Belong To Which VLAN Linking VLANS Layer 3 Routing Device (WS−X4232 For Catalyst 4500/4000 Switches ) Built−in Support For Inter−VLAN Routing Catalyst 3550/3750/6500 8/2/2011 Team 0

[7] CSIS 8/2/2011 Team 0

[7] 8/2/2011 Team 0

VLAN Security Considerations CSIS Inadequate Switch Configuration [5] Best Practices -The SAFE Blueprint [6] Security Audit Inadequate Access Control Documentation, Policies, Procedures Firmware Controls Appropriate HW / SW Implementation 8/2/2011 Team 0

Threats [9] CSIS Availability Confidentiality Integrity Authenticity Interruption Confidentiality Interception Integrity Modification Authenticity Fabrication 8/2/2011 Team 0

Identifying Risks to Data CSIS Public Web Site Data Internal Payroll Data Marketing Data Confidential Type of Data What is at Risk Public Prestige, Trust, Revenue Internal Operations Confidential Operations, Internal Trust Secret Intellectual Property [9] Secret Trade Secrets 8/2/2011 Team 0

Prevention [5] Physical Access System passwords IP permit filters CSIS Prevention [5] Physical Access System passwords IP permit filters Login Banners Other tools: RADIUS TACACS+ Kerberos SSH SNMPv3 IDS / IPS 8/2/2011 Team 0

Conclusion Contemporary LANs Need Segmentation Design Security CSIS Topology , Load, Broadcast Design Group Of LANs That Have Different Physical Connections – Virtual Broadcast Domains Ethernet 802.1Q Security Threats, Risks, Prevention 8/2/2011 Team 0

CSIS References 8/2/2011 Team 0 Tanenbaud, A. and Wetherall, D., Compter Network, Pearson, Fifth Edition, pp. 838-840, 2011. Siefert and Edwards, The all New Switch Book, NY, John Wiley, 2008 http://www.frokwon.net/essays/VLAN.htm http://www.petri.co.il/csc_setup_a_vlan_on_a_cisco_switch.htm Research Report: Secure Use of VLANs: An @stake Security Assessment—August 2002, http://www.cisco.com/warp/public/cc/pd/si/casi/ca6000/tech/stake_wp.pdf SAFE: A Security Blueprint for Enterprise Networks, http://www.cisco.com/go/safe/ Best Practices for Catalyst 4500, 5000, and 6500 Series Switch Configuration and Management, http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a0080094713.shtml Blum, Howard, Lecture Notes for Course DCS835 Networking and the Internet , Pace University, 2011. Unpublished course lecture notes. Shaikh, R, Network Security, MUET – 2011. Unpublished notes. http://www.cisco.com/warp/public/cc/pd/si/casi/ca4000/prodlit/ca450_wp/ca450_w6.jpg 8/2/2011 Team 0

DCS835 Compute Network and the Internet CSIS DCS835 Compute Network and the Internet Questions Team 0 Maria Sette msette@pace.edu Roshan Shaikh 5452w@pace.edu 8/2/2011 Team 0