TCP/IP Addressing Design

Objectives Choose an appropriate IP addressing scheme based on business and technical requirements Identify IP addressing problems and describe strategies for resolving them Describe different address management tools -Secondary addressing -DHCP/DNS -Address translation Describe methods for implementing TCP/IP security features

Hierarcical Addressing

Prefix Length Determined from Context Variable-length prefixes are not a new invention – Prefix field identifies a network number – Host field identifies a device number 32 bits Prefix length = 8Host Prefix length = 16Host Prefix length = 24Host Class A Class B Class C

Prefix Length for classful & classless Routing “Classful” routers accept only a few prefix lengths / / /24 Class A Class B Class C /21Class C “Classless” routers accept any prefix length Prefix length is carried with an IP address

Subnetting Extends Prefix to the Right 32 bits Prefix Prefix length Host Assigned network address Subnetmask Hosts126 Subnets Need 510 Hosts Need 2 Hosts Good address utilization Poor address utilization RIP and IGRP require the same subnet mask on all interfaces

Classful Routing Protocols Do Not Advertise Prefix Length Subnetsmust be contiguous when using classful routing protocols / / /24 A advertises B advertises A C B Router C: Where is network ?

Classless Routing Protocols Allow Flexible Addressing

VLSM Saves Subnets in the WAN / / / / /

Route Summarization (Aggregation) Subnetting extends prefix to the right Prefix Prefix length Host Summarization collapses prefix to the left Prefix Prefix length Host

Classless Routing and Prefix Routing I will just tell you about a summary route to /21. CIDR used by BGP4 Prefix routing used by EIGRP and OSPF

A Classless Routing Protocol Looks for the Longest Match /32host /27subnet /24network /16block of networks /0default IP routers support host-specific routes, blocks of networks, default routes

Secondary Addressing Useful in switched networks – Router may relay packets, acting as a default gateway – Host may communicate directly, using ARP for learning

Host Address Assignment Static Dynamic – BOOTP – DHCP Address request Address response

Name-to-Address Translation Cisco DNS/DHCP Manager – Manages domain names – Synchronizes IP addresses – Supports secondary addressing Client_1Client_2 DNS/DHCP Server Client_ Client_ : : : : : : : Next avail DNS Table DHCP Table

Private versus Registered Addresses Three address blocks reserved for private networks – (1 Class A) – to (16 Class B) – to (256 Class C) Address translation must occur to reach the Internet Private network (for example, ) Public network (for example, Internet) Address translation gateway

Network Address Translation Cisco router provides – Network address translation only Private network (for example, ) Public network (for example, Internet)

Cisco Private Internet Exchange Private Internet Exchange platform provides – Address translation – Firewall service Private network (for example, ) Public network (for example, Internet) PIX Private servers Public servers

IP Security Considerations Private Network Public Network Policy Establish a security policy Implement firewall features Control access –Local –Remote

Implementing IP Security Policy drives implementation choices Private network (for example, ) Public network (for example, Internet) Firewall System Policy

Policy Considerations for Security Determine how much security you need Trade off ease of use and configuration with security demands Determine what data outsiders need to reach Quantify the cost of the proposed security system Implement a simple, robust design

Many Aspects of Security Authorization, authentication, data integrity, privacy issues Firewalls are just one piece of the puzzle Firewalls Access Management Host Security Encryption Policy

Firewall System with Isolated LANs prevent unauthorized and improper access from external networks Public servers on outside LAN I cannot access the private network. Untrusted User Public Firewall System Private servers Public servers Private

Additional Firewall Functionality Network address translation Application proxy Packet filter Audit trail Login protection InternetFirewall System InterNIC registered address

Disable All Unnecessary Features Disable Telnet, TFTP, and proxy services Outside filter FTP, WWW, Internet No VTYs No TFTP No finger Physical console port Public server Firewall System

Be Specific About Access Allowed Allow specific services to specific hosts on DMZ LAN only HTTP to host B only FTP to host A only DNS to host C only

Block Traffic from Firewall Routers, Hosts I have cracked the firewall!Where can I get to from here? Do not trust Telnet from firewall systems I am getting aTelnet from the firewall! I guess that’s OK! Telnet Untrusted User

Avoid IP Spoofing Deny packets from outside your network that claim to have a source address inside your network Filter source X.X Untrusted User