April 11, Implementation of Virtual LANs for Virus Containment Aaron Soto April 11, 2005 In partnership with: New Mexico Tech Information Services Department

April 11, Outline Problem Statement –What is a VLAN? –How can it help? Proposed Solution –Layout –Implications –Details Future Expansion

April 11, Problem Statement Universities are prone to viruses PCs are frequently not running AV software Staff constantly monitors network traffic –Ports disabled if viruses are detected Students unable to clean / patch PC –Without Internet, more effort is necessary –Students frequently frustrated

April 11, Background: VLANs SWITCH

April 11, Background: VLANs SWITCH

April 11, Proposed Solution Implement two VLANs: –Default: Quarantined, DHCP –Secure: Safe, Virus-free, Static IP Automated tools can switch VLANs Traffic can be redirected/forwarded –Allow sites like Windows Update, SARC, etc. –Redirect other traffic to quarantined server

April 11, Current Layout SWITCH 2 SWITCH 1 SWITCH 0 FIREWALL IN-BUILDING INTERNET

April 11, Proposed Layout: Overview SWITCH 2 SWITCH 1 SWITCH 0 IN-BUILDING INTERNET QUARANTINE SERVER SECURE DEFAULT

April 11, Proposed Layout: In-Building IN-BUILDING DEFAULTPACKET SECUREPACKET

April 11, Proposed Layout: Backbone INTERNET QUARANTINE SERVER DEFAULT SECURE FIREWALL

April 11, Proposed Layout: Server QUARANTINE SERVER DEFAULT FIREWALL DHCP Server Apache Web Server IP Masquerading (ipChains)

April 11, Proposed Design: ipChains... # ALLOW NMT WEB REQUESTS THROUGH -A PREROUTING --dst mailhost.nmt.edu -p tcp --dport 110 -j ACCEPT -A PREROUTING --dst externalweb.nmt.edu -p tcp --dport 80 -j ACCEPT -A PREROUTING --dst webmail.nmt.edu -p tcp --dport 80 -j ACCEPT -A PREROUTING --dst webmail.nmt.edu -p tcp --dport 443 -j ACCEPT # IF IT HASN'T BEEN ALLOWED THROUGH ABOVE, CAPTURE IT -A PREROUTING -i eth1 -j DNAT --to-destination XXX.XXX # IF IT WAS ALLOWED ABOVE, THEN ROUTE IT THROUGH -A POSTROUTING -p tcp -s XXX.XXX/24 -j MASQUERADE...

April 11,

April 11, Possible Implications Firewall –Forward traffic depending on VLAN tag Quarantine Server –Must be frequently re-evaluated to…  Be kept secure from viruses/worms  Select valid traffic to forward –Is not designed to take full load Switches –Must have VLAN support

April 11, Future Expansion Automated Port Activation Requests –Allow students to register with ISD online  Integration with Banner? Automated Virus Detection and Quarantine –Detect virus activity and switch VLANs  In progress More detailed communications –Specific information / instructions –Would require multiple VLANs  For a later stage

April 11, Implementation of Virtual LANs for Virus Containment Questions? Aaron Soto (505)