1. 1 Semester 3 Threaded Case Study Royal Palm 41306-3A/3B Ip Siu Tik Tsang Man Wu Wai Hung Wong Lai Ting

2. 2 Wide Area Network

3. 3 LAN Area Network

4. 4 LAN Wiring Scheme

5. 5

6. 6 Addressing and Network Management Class A private address 10.3.48.0/20 is assigned 7 subnets for two administrative network and five student network 10.3.48.0/23 - Administrative Network 10.3.50.0/23 - Administrative Network 10.3.52.0/23 - Student Network 10.3.54.0/23 - Student Network 10.3.56.0/23 - Student Network 10.3.58.0/23 - Student Network 10.3.60.0/23 - Student Network

7. 7 Addressing and Network Management Administrative Network 10.3.48.1/23Router Interface E0 (Admin LAN) 10.3.48.2->10.3.49.254Switches 10.3.49.10Domain Name Server 10.3.49.11Email Server 10.3.49.12Web Server 10.3.49.13Administration File Server 10.3.49.14Administration Server 10.3.49.20->10.3.49.254Staff PC's Static Addresses 10.3.50.1/23Router Sub-Interface E0 (Admin LAN) 10.3.50.20->10.3.51.254Staff PC's Static Addresses

8. 8 Addressing and Network Management Student Network 83 classrooms and each classroom support maximum 24 computers. 1992(83X24) IP addresses are needed

9. 9 Addressing and Network Management 10.3.52.1/23Router Interface E1 (Student LAN) 10.3.52.10Library Server 10.3.52.11Application Server 10.3.52.12Student File Server 10.3.52.13DHCP Server 10.3.54.1Router Sub-Interface E1 (Student LAN) 10.3.56.1Router Sub-Interface E1 (Student LAN) 10.3.58.1Router Sub-Interface E1 (Student LAN) 10.3.60.1Router Sub-Interface E1 (Student LAN) 10.3.52.20->10.3.53.254DHCP addresses for IDF 1 10.3.54.2->10.3.55.254DHCP addresses for IDF 2 10.3.56.2->10.3.57.254DHCP addresses for IDF 3 10.3.58.2->10.3.59.254DHCP addresses for IDF 4 10.3.60.2->10.3.61.254DHCP addresses for IDF 5

10. 10 Security Access Lists 101: Student VLAN has no access to admin server or admin file server -- E0 in – router(config) # access-list 101 permit ip 10.3.48.0 0.0.3.255 any router(config )# acces-list 101 deny ip any any router(config )# interface e0 router(config-if) # ip access-group 101 in

11. 11 Security Access Lists 102: Any traffic leaving administration VLAN not from a valid address on that VLAN is denied Permit Web Server (port 80), DNS(port53) and SMTP(port 25) to be accessible from the student VLAN --E0 out – router(config) # access-list 102 permit tcp any any eq 80 router(config) # access-list 102 permit tcp any any eq 25 router(config) # access-list 102 permit tcp any any eq 53 router(config) # access-list 102 permit udp any any eq 53 router(config) # access-list 102 deny ip 10.3.0.0 0.0.255.255 router(config) # access-list 102 permit ip any any router(config) # interface e0 router(config-if) # ip access-group 102 out

12. 12 Security Access Lists 103: Any traffic leaving student VLAN not from a valid address on that VLAN is denied --E1 in— router(config) # access-list 103 permit ip 10.3.52.0 0.0.3.255 any router(config) # access-list 103 permit ip 10.3.56.0 0.0.3.255 any router(config) # access-list 103 permit ip 10.3.60.0 0.0.3.2555 any router(config) # interface e1 router(config-if) # ip access-group 103 in

13. 13 Internet Connectivity Double firewalls for protection Access Control Lists (ACLs) is utilized in routers tcp port 53(DNS service), 80 (web server) and 110(e-mail service) available only Admin server cannot be accessed by student VLAN

14. 14 Internet Connectivity Side effect of using ACLs: increase the latency of traffic increase the CPU utilization of the routers ACL latency effect slow down accessing to e-mail, internet & intranet browsing, log on process

15. 15 User Counts Location Student/Curriculum Runs Administrative/Teacher Runs Total Runs Building 1 602080 Building 2 361248 Building 3 331144 Building 4 15520 Building 5 24832 Science building, 628 Computer building 628 7 double portable classroom 421456 Multipurpose building 18624 Cafeteria 9312 Total332

16. 16 ~The End~