1. April 11, 20051 Implementation of Virtual LANs for Virus Containment Aaron Soto April 11, 2005 In partnership with: New Mexico Tech Information Services Department

2. April 11, 20052 Outline Problem Statement –What is a VLAN? –How can it help? Proposed Solution –Layout –Implications –Details Future Expansion

3. April 11, 20053 Problem Statement Universities are prone to viruses PCs are frequently not running AV software Staff constantly monitors network traffic –Ports disabled if viruses are detected Students unable to clean / patch PC –Without Internet, more effort is necessary –Students frequently frustrated

4. April 11, 20054 Background: VLANs SWITCH

5. April 11, 20055 Background: VLANs SWITCH

6. April 11, 20056 Proposed Solution Implement two VLANs: –Default: Quarantined, DHCP –Secure: Safe, Virus-free, Static IP Automated tools can switch VLANs Traffic can be redirected/forwarded –Allow sites like Windows Update, SARC, etc. –Redirect other traffic to quarantined server

7. April 11, 20057 Current Layout SWITCH 2 SWITCH 1 SWITCH 0 FIREWALL IN-BUILDING INTERNET

8. April 11, 20058 Proposed Layout: Overview SWITCH 2 SWITCH 1 SWITCH 0 IN-BUILDING INTERNET QUARANTINE SERVER SECURE DEFAULT

9. April 11, 20059 Proposed Layout: In-Building IN-BUILDING 1 2 3 4 5 6 13 14 15 16 17 18 7 8 9 10 11 12 19 20 21 22 23 24 DEFAULTPACKET SECUREPACKET

10. April 11, 200510 Proposed Layout: Backbone INTERNET QUARANTINE SERVER DEFAULT SECURE FIREWALL

11. April 11, 200511 Proposed Layout: Server QUARANTINE SERVER DEFAULT FIREWALL DHCP Server Apache Web Server IP Masquerading (ipChains)

12. April 11, 200512 Proposed Design: ipChains... # ALLOW NMT WEB REQUESTS THROUGH -A PREROUTING --dst mailhost.nmt.edu -p tcp --dport 110 -j ACCEPT -A PREROUTING --dst externalweb.nmt.edu -p tcp --dport 80 -j ACCEPT -A PREROUTING --dst webmail.nmt.edu -p tcp --dport 80 -j ACCEPT -A PREROUTING --dst webmail.nmt.edu -p tcp --dport 443 -j ACCEPT # IF IT HASN'T BEEN ALLOWED THROUGH ABOVE, CAPTURE IT -A PREROUTING -i eth1 -j DNAT --to-destination 129.138.XXX.XXX # IF IT WAS ALLOWED ABOVE, THEN ROUTE IT THROUGH -A POSTROUTING -p tcp -s 129.138.XXX.XXX/24 -j MASQUERADE...

13. April 11, 200513

14. April 11, 200514 Possible Implications Firewall –Forward traffic depending on VLAN tag Quarantine Server –Must be frequently re-evaluated to…  Be kept secure from viruses/worms  Select valid traffic to forward –Is not designed to take full load Switches –Must have VLAN support

15. April 11, 200515 Future Expansion Automated Port Activation Requests –Allow students to register with ISD online  Integration with Banner? Automated Virus Detection and Quarantine –Detect virus activity and switch VLANs  In progress More detailed communications –Specific information / instructions –Would require multiple VLANs  For a later stage

16. April 11, 200516 Implementation of Virtual LANs for Virus Containment Questions? Aaron Soto asoto@admin.nmt.edu (505) 835-5945