2. Washington School District Computer Network System Threaded Case Study Jim, Jeff, Pete, Adam, Chris  100X LAN Growth  2X WAN Growth  1.0 Mbps to any host computer  100 Mbps to any server  TCP/IP will be implemented  3 Regional Hubs: District Office, Service Center and Shaw Butte Elementary

3. LAN Design Goals  Initial Throughput to Network Hosts – The minimum requirement for initial implementation design will be 1.0 Mbps to any host computer  Initial Throughput to Network Servers – Each Regional Hub connected via 4 T-1 Data Lines  Each connected site connected to its corresponding Regional Hub with T-1 Data Line  Minimum requirement of 100 Mbps to any server host  Fast WAN Core Network – Three Regional Hubs

4. LAN Design Goals  Internet Connectivity – Frame Relay T1 Data Line  Non-Dedicated Connectivity – ISDN WAN connectivity for the Community School

5. Access Summary  District Office Network will use a double firewall Design  All Internet traffic into District’s private network is refused  Two Internal networks created: Administrative & Curriculum  All traffic from Curriculum LAN is prohibited on the Administrative LAN

6. Access Summary  E-Mail and DNS allowed unlimited access to District’s private network  All computers in the District allowed full access to Internet

7. ADDRESSING & NETWORK MANAGEMENT  Administrative Network – All computers on the Administrative Network will have static addresses  Curriculum Network – All computers on the Curriculum Network will use DHCP to obtain network addresses  Master Network Management Host – Located at District Office

8. Washington Cutsheet/Overview

13. IP ADDRESSING CLASS C INTERNAL

14. IP ADDRESSING CLASS C INTERNAL (CONTINUED)

16. ROYAL PALM HostIP Address Curriculum File Server192.168.102.1 Administration File Server192.168.26.1 Dns/Email Server192.168.26.2 Application Server192.168.26.3 Spare Server Address192.168.26.4 - 192.168.26.15 Router Interfaces192.168.26.16 - 192.168.26.30 Spare Interface Address192.168.26.31 - 192.168.26.49 Administration Host Address192.168.26.50 - 192.168.26.254 Curriculum host add. Net 1192.168.102.2 - 192.168.102.254 Curriculum host add. Net 2192.168.103.1 - 192.168.103.254

17. SUNSET HostIP Address Curriculum File Server192.168.76.1 Administration File Server192.168.13.1 Dns/Email Server192.168.13.2 Application Server192.168.13.3 Spare Server Address192.168.13.4 - 192.168.13.15 Router Interfaces192.168.13.16 - 192.168.13.30 Spare Interface Address192.168.13.31 - 192.168.13.49 Administration Host Address192.168.13.50 - 192.168.13.254 Curriculum host add. Net 1192.168.76.2 - 192.168.76.254 Curriculum host add. Net 2192.168.77.1 - 192.168.77.254

18. SUNNYSLOPE HostIP Address Curriculum File Server192.168.54.1 Administration File Server192.168.2.1 Dns/Email Server192.168.2.2 Application Server192.168.2.3 Spare Server Address192.168.2.4 - 192.168.2.15 Router Interfaces192.168.2.16 - 192.168.2.30 Spare Interface Address192.168.2.31 - 192.168.2.49 Administration Host Address192.168.2.50 - 192.168.2.254 Curriculum host add. Net 1192.168.54.2 - 192.168.54.254 Curriculum host add. Net 2192.168.55.1 - 192.168.55.254

19. Security Order Secure ID Card with Badge Number, Department and Name User given PIN by Information Services Dial into Network Through Firewall After Using Secure ID# off Card with PIN Need 2 items for outside dial-in access: PIN (Personal ID Number) plus something unique that the user must possess at the time of attempted entry--secure pin pad token that generates random one-time only access codes.

20. Internal Routing District Office will maintain user passwords, routers & Lan Switches District Office will be the only point of contact between external routing and the internal networks Password checking policy will be implemented with Password Policy Enforcer software Non-compliant passwords will be rejected and the user will be prompted to enter a new password. Such software requires that users choose compliant passwords.

21. Outside Access Allow everyone DNS access to your DNS server, 192.168.13.2 (192.168.26.2, 192.168.2.2, 192.168.02) (config)# access-list 107 permit UDP any 192.168.13.2 eq DNS Do not allow students to use FTP to the Internet (config)#access-list 107 deny tcp 192.168.50.0 0.0.70.255 any eq FTP Allow Internet access (config)#access-list 107 permit IP any any IP is required to reach the Internet.

22. Internet Router Allow established connections back to users. Any user on the Internet can connect to the mail server and to the Web server. Public(config)#access-list 103 permit tcp any any established Public(config)#access-list 103 permit tcp any any eq www Public(config)#access-list 103 permit tcp any any eq 25 (e-mail) Public(config)#access-list 103 permit tcp any any eq 53 (DNS) Public(config)#access-list 103 deny ip any any Public(config)#int s0 Public(config-if)# ip access-group 103 in

23. District Office Allow everyone Web access to the web server, 192.168.0.4 District(config)#access-list 105 permit tcp any to 192.168.0.4 eq HTTP Permit E-Mail & Directory services; permit Internet access; deny student access to Administrative network District(config)#access-list 105 permit tcp any 192.168.0.0 0.0.0.255 eq 25 District(config)#access-list 105 permit tcp any 192.168.0.0 0.0.0.255 eq 53 District(config)#access-list 105 permit IP 192.168.0.0 0.0.0.255 any District(config)#access-list 105 deny tcp 192.168.50.0 0.0.70.255 192.168.0.0 0.0.0.255 District(config)#access-list 105 deny ip any any (explicit deny all) District(config)#int e0 District(config-if)#ip access-group 105 out

24. Sunny Slope Permit E-mail and DNS traffic and deny Student access Sunny(config)#access-list 103 permit tcp any 192.168.2.0 0.0.0.255 eq 25 (E-mail) Sunny(config)#access-list 103 permit tcp any 192.168.2.0 0.0.0.255 eq 53 (DNS) Sunny(config)#access-list 103 deny tcp 192.168.50.0 0.0.70.255 192.168.26.0 0.0.0.255 Sunny(config)#access-list 103 deny ip any any (implicit deny all) Sunny(config)#int e0 Sunny(config-if)#ip access-group 103 out

25. Royal Palm Permit E-mail and DNS traffic and deny Student access Royal(config)#access-list 101 permit tcp any 192.168.26.0 0.0.0.255 eq 25 (E-mail) Royal(config)#access-list 101 permit tcp any 192.168.26.0 0.0.0.255 eq 53 (DNS) Royal(config)#access-list 101 deny tcp 192.168.50.0 0.0.70.255 192.168.26.0 0.0.0.255 Royal(config)#access-list 101 deny ip any any (implicit deny all) Royal(config)#int e0 Royal(config-if)#ip access-group 101 out

26. Sunset Permit E-mail and DNS traffic and deny Student access Sunset(config)#access-list 102 permit tcp any 192.168.13.0 0.0.0.255 eq 25 (E-mail) Sunset(config)#access-list 102 permit tcp any 192.168.13.0 0.0.0.255 eq 53 (DNS) Sunset(config)#access-list 102 deny tcp 192.168.50.0 0.0.70.255 192.168.13.0 0.0.0.255 Sunset(config)#access-list 102 deny ip any any (implicit deny all) Sunnset(config)#int e0 Sunset(config-if)#ip access-group 103 out

27. TOTAL COST