The Washington School District Mike, Mark, Joy, Armando, & Mona

Overview n R E Miller, Acacia, Desert View, & Mountain Sky n Class B Address n WAN - PPP, Frame Relay, ISDN, OSPF n LAN - Extended Star, TCP/IP, IGRP n Security n Cost

Addressing n Class B n VLANS for Administrative and Students n Administrative and network printers will be static n Students will use DHCP

Class B Subnet mask Used 8 bits for subnets (total usable 254) 8 Bits left for hosts/subnet (total usable 254) Wan routers Desert View E0= Admin Addresses Students Printers

Mountain Sky E0= Admin Addresses Students Printers RE Miller E0= Admin Addresses Students Printers Acacia E0= Admin Addresses Students Printers

WAN n T1 using Frame Relay to the Internet n 4 T1’s between District Office, Shaw Butte, Service Center –upgrade to DS3 for growth –PPP n T1 from each school to its District hub –Backup TSU ESP n Each District hub will be an Area Border Router; this provides for the requirement of one AS number n Additional router at Data Center going to the Internet, along with access lists fulfills requirement for double firewall.

Area Border Routers

LAN –Gigabit Backbone –Fiber from MDF to each BLDG –Fiber from IDF to IDF and from MDF to IDF within building –Router connects WAN link (T1) and provides security and routing for VLANS

LAN (cont’d) n MDF - switch with router capabilities –Server Central n DNS/DHCP n n Administrative n Student n Print n Application and CD Stack n Misc. - DLT Tape Drives, UPS, Racks

LAN (cont’d) n IDF –7 drops to each class –28 ports - students (24), teacher (3), network printer (1) –100Mbps to each node –full duplex

RE Miller

RE Miller

RE Miller (cont’d)

Security n Administrative user ID and Password n VLANS n Access Lists

VLANS n VLAN 1 - Administration n VLAN 2 - Students n Configure ports on switch for each VLAN –use ethernet sub interfaces - E0/1 n Configure uplinks to trunk each VLAN n Full duplex n Use Spanning Tree Protocol (STP) –creates a transparent switch

VLANS (cont’d) n IGRP - AS# (Internet Assigned Numbers Authority) n Configure router with virtual interfaces –virtual ethernet sub interfaces must be configured to match switch ethernet sub interfaces –this is needed because of the 5500 series router/switch we are using

Access Lists n Used for double firewall n WAN –use access lists to allow traffic from Internet and Intranet to access servers located in DMZ –examples: n access-list 101 permit tcp any any eq 80 in S1 n access-list 101 permit tcp any any eq 25 in S1 n access-list 101 permit tcp any any eq 53 in S1 n access-list 101 permit tcp any any eq 21 in S1 n access-list 101 deny tcp any any n access-list 101 deny udp any any n access-list 102 permit tcp any any eq 80 in E1 n access-list 102 permit tcp any any eq 25 in E1 n access-list 102 permit tcp any any eq 53 in E1 n access-list 102 permit tcp any any eq 21 in E1

Access List - LAN n Access-list 105 deny tcp student subnet to administrative server and deny student access to administrative subnet n example: –access-list 105 deny tcp –Access list 105 deny tcp –access-list 105 permit any any –applied on E0 interface inbound

Cost