1. DCS835 Compute Network and the Internet
CSIS
DCS835 Compute Network and the Internet
VLANS
Team 0
Maria Sette Roshan Shaikh
8/2/2011
Team 0

2. Outline Motivation Design Operation Security Conclusion References Q/A
CSIS
Outline
Motivation
Design
Operation
Security
Conclusion
References
Q/A
8/2/2011
Team 0

3. Motivation – VLAN Contemporary LANs Need Segmentation CSIS
Topology (All Within Ethernet - TP)
Geographic
Organizational
Functional
Load [1]
Functional Network
Mis-configured Network (Broadcast Storms)
Broadcast [2]
Efficient Use of Available Ports
8/2/2011
Team 0

4. CSIS
VLANS
Ethernet 802.1Q [2]
Group Of LANs That Have Different Physical Connections – Virtual Broadcast Domains [3]
Communicate As If They Are Connected On A Single Network Segment [3]
Unicast Or Broadcast Data Transmission Is Limited - Traffic Is Reduced [4]
Software Based Solution
Allows IT Administrators To Adapt To Changes
8/2/2011
Team 0

5. Advantages Ease of administration [8] Confinement of broadcast domains
CSIS
Advantages
Ease of administration [8]
Confinement of broadcast domains
Reduction in network traffic
Enforcement of security policies
[10]
8/2/2011
Team 0

6. Design Ethernet 802.1Q New Frame Format (1995)
CSIS
Design
Ethernet 802.1Q New Frame Format (1995)
Ethernet Header (802.3) + VLAN Tag
802.3
VLAN Tag
802.1 Q (1998)
Dest. Address
Source Address
Len
Data
Pad
FCS
Pri
CFI
VLAN Identifier
Dest. Addr.
Source Addr.
V-Tag
VLAN
Protocol
0 x 8100
Len
Data
Pad
FCS
8/2/2011
Team 0

7. Design Number of VLANS Port Name & ID (Color) Topology CSIS Switch
Computer
Topology
Geographic
Organizational
Functional
Hybrid
8/2/2011
Team 0

8. Types Backward Compatibility CSIS
How a packet gets assigned to a VLAN-Aware Switch [5]
Port-based
MAC address-based
L3 protocol-based
Backward Compatibility
Only VLAN Switches
802.1 Q NICs
8/2/2011
Team 0

9. Requirements > 200 devices on LAN?
CSIS
Requirements
> 200 devices on LAN?
Groups of users need more security? [2]
Slow Network by too many broadcasts? [3]
Groups of users need to be on the same broadcast domain running the same applications - VoIP phones?
8/2/2011
Team 0

10. CSIS
Operation
Logical Broadcast Domains In A Single Switch Or Multiple Switches, Regardless Of Physical Proximity
Configuration (CISCO) [7]
VLAN Trunk Protocol (VTP) Mode, Domain Name, Which Ports On The Switch Belong To Which VLAN
Linking VLANS
Layer 3 Routing Device (WS−X4232 For Catalyst 4500/4000 Switches )
Built−in Support For Inter−VLAN Routing
Catalyst 3550/3750/6500
8/2/2011
Team 0

11. [7]
CSIS
8/2/2011
Team 0

12. [7]
8/2/2011
Team 0

13. VLAN Security Considerations CSIS Inadequate Switch Configuration [5]
Best Practices -The SAFE Blueprint [6]
Security Audit
Inadequate Access Control
Documentation, Policies, Procedures
Firmware Controls
Appropriate HW / SW Implementation
8/2/2011
Team 0

14. Threats [9] CSIS Availability Confidentiality Integrity Authenticity
Interruption
Confidentiality
Interception
Integrity
Modification
Authenticity
Fabrication
8/2/2011
Team 0

15. Identifying Risks to Data
CSIS
Public
Web Site Data
Internal
Payroll Data
Marketing Data
Confidential
Type of Data
What is at Risk
Public
Prestige, Trust, Revenue
Internal
Operations
Confidential
Operations, Internal Trust
Secret
Intellectual Property
[9]
Secret
Trade Secrets
8/2/2011
Team 0

16. Prevention [5] Physical Access System passwords IP permit filters
CSIS
Prevention [5]
Physical Access
System passwords
IP permit filters
Login Banners
Other tools:
RADIUS
TACACS+
Kerberos
SSH
SNMPv3
IDS / IPS
8/2/2011
Team 0

17. Conclusion Contemporary LANs Need Segmentation Design Security CSIS
Topology , Load, Broadcast
Design
Group Of LANs That Have Different Physical Connections – Virtual Broadcast Domains
Ethernet 802.1Q
Security
Threats, Risks, Prevention
8/2/2011
Team 0

18. CSIS References 8/2/2011 Team 0
Tanenbaud, A. and Wetherall, D., Compter Network, Pearson, Fifth Edition, pp , 2011.
Siefert and Edwards, The all New Switch Book, NY, John Wiley, 2008
Research Report: Secure Use of VLANs: Security Assessment—August 2002,
SAFE: A Security Blueprint for Enterprise Networks,
Best Practices for Catalyst 4500, 5000, and 6500 Series Switch Configuration and Management,
Blum, Howard, Lecture Notes for Course DCS835 Networking and the Internet , Pace University, Unpublished course lecture notes.
Shaikh, R, Network Security, MUET – Unpublished notes.
8/2/2011
Team 0

19. DCS835 Compute Network and the Internet
CSIS
DCS835 Compute Network and the Internet
Questions
Team 0
Maria Sette
Roshan Shaikh
8/2/2011
Team 0