Komang

a. Use word processing software to create a new Project Constraints document.

b. The identified constraints that set limits or boundaries on the network upgrade project should be

entered into the Gathered Data field of the constraints document. Brainstorm ideas with other

students to identify additional constraints.

Classify each constraint as one of the following four types:

a. Using the list of constraints discovered from the FilmCompany case study, apply appropriate

comments on how the constraints affect the design.

b. Enter the comments into a table

c. Save your Project Constraints checklist.

a. Use word processing software to create an addition to the Project Constraints document.

b. The identified constraints that set limits or boundaries on the network upgrade project will require

potential trade-offs. Discuss ideas with other students regarding trade-offs for proposed designs.

c. Record the trade-offs in your Project Constraints checklist.

d. Save your Project Constraints checklist.

The constraints imposed on this network design project are determined by the internal requirements of the FilmCompany. Consider and discuss the identified constraints and potential trade-offs. Do the trade-offs pose a significant obstacle to the design? Are there alternate methods that can be employed to achieve the success criteria without a significant budget?

a. Use word processing software to create a new document called “Design Strategies.”

b. Use the identified constraints that set limits or boundaries on the network upgrade project and the

potential trade-offs to assist in the discussion with other students.

The strategy should cover the following areas:

Using the list developed from the group discussion, create an Access Layer module (design only).

a. Create your design using the existing equipment.

2 x 1841 Routers (FC-CPE-1, FC-CPE-2)

3 x 2960 Switches (FC-ASW-1, FC-ASW-2, ProductionSW)

Several servers

1 x Linksys WRT300N Wireless Router (FC-AP)

1 x ADSL Modem for Internet Access

b. Using the list of equipment, identify modules that can be added to the existing equipment to support

new features and devices without requiring major equipment upgrades.

c. Save your Design Strategies documentation.

a. Use word processing software to create an addition to the Design Strategies document.

b. Use the identified Access Layer module diagram to create the Distribution Layer design. Equipment

selected must include existing equipment. Use Layer 3 devices at the Distribution Layer to filter and

reduce traffic to the network core.

c. With a modular Layer 3 Distribution Layer design, new Access Layer modules can be connected

without requiring major reconfiguration. Using your documentation, identify what modules can be

added to increase bandwidth.

d. Save your Design Strategies document.

The constraints and trade-offs identified for the FilmCompany pose many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified strategies. Do all of the strategies designed accomplish the task the same way?

Would one be less expensive or less time-consuming than the other?

a. Use word processing software to create a new document called “Availability Strategies.”

b. Use the identified constraints that set limits or boundaries on the network upgrade project and the

potential trade-offs to assist in brainstorming ideas with other students.

The strategy should cover the following areas:

a. Using the list developed from the brainstorming session, create a list of equipment that will be

incorporated into the availability strategy.

The FilmCompany network equipment includes:

2 x 1841 Routers (FC-CPE-1, FC-CPE-2)

3 x 2960 Switches (FC-ASW-1, FC-ASW-2, ProductionSW)

Several servers

1 x Linksys WRT300N Wireless Router (FC-AP)

1 x ADSL Modem for Internet Access

b. Using the list of equipment, identify modules and redundant power supplies that will increase

availability for the switches.

c. Identify potential hot swappable cards and controllers that can be used. Create a list that identifies

each with cost and features.

d. Develop a diagram that shows potential redundant links that can be incorporated into the network

design.

e. Identify at least two possible UPS devices that can be incorporated into the design. Create a list that

identifies the cost and features of each.

f. Save your Availability Strategies document.

a. Use word processing software to create an addition to the Availability Strategies document.

b. Using the list of equipment, identify redundant power supplies that will increase availability for the

switches.

c. Identify potential redundant devices and links that can be used. Create a list that identifies each with

cost and features.

d. Create a diagram that displays the redundant connections.

e. Develop a list of potential routing protocols that will facilitate fast convergence times.

f. Save your Availability Strategies document.

a. Use word processing software to create an addition to the Availability Strategies document.

b. Identify options available that would allow for dual ISP or dual connectivity to a single provider.

c. Create a design that will co-locate the servers to allow for redundancy and ease of maintenance.

d. Save your Availability Strategies document.

The creation of availability strategies poses many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified strategies. Do all of the strategies designed accomplish the task the same way?

Would one be less expensive or less time-consuming than the other?

a. Use word processing software to create a new document called “Security Strategies.”

b. Using the documents created in previous labs and the existing topology; identify potential

weaknesses in the existing design. (No firewalls, no VPNs)

c. Create a list of recommended security practices that should be employed in the FilmCompany

network.

d. Save your Security Strategies document.

a. Using the list developed from the brainstorming session, create a finalized list of recommended

security practices for the FilmCompany.

networks, such as the Internet. Configure firewalls to monitor and control the traffic, based on

a written security policy.

through third-party or unprotected networks.

systems scan the network for harmful or malicious behavior and alert network managers.

spyware, and spam.

granting access.

network devices and facilities.

b. Identify what devices and software will need to be purchased to facilitate the recommended security

practices. (Hardware firewalls, intrusion detection systems etc.)

c. Save your Security Strategies document.

a. Use word processing software to create an addition to the Security Strategies document.

b. Using the list of identified equipment, develop a chart of costs and features of the recommended

devices.

c. Using the list of identified software needed, develop a chart of costs and features of the

recommended software.

d. Save your Security Strategies document.

a. Use word processing software to create an addition to the Securities Strategies document.

b. Identify which types of access to the network should be secured by incorporating VPNs.

c. Identify methods for controlling physical security at the FilmCompany building and at the stadium.

d. Identify potential ACLs that can be created to filter unwanted traffic from entering the network.

(Standard ACLS or Extended need to be identified.)

e. Identify methods for securing the wireless Access Points. Determine the best method for the

FilmCompany network. (128 bit encryption etc.)

f. Save your Security Strategies document.

The creation of a security strategy creates many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified challenges. Do all of the proposed strategies accomplish the task the

same way?

Would one be less expensive or less time-consuming than the other?

How could implementing a physical security plan into an existing company be difficult?

a. Use word processing software to create a new document called “Core Layer Diagram.”

b. Use the identified topology and associated equipment to determine Core Layer design requirements.

High-speed connectivity to the Distribution Layer switches

24 x 7 availability

Routed interconnections between Core devices

High-speed redundant links between Core switches and between the Core and Distribution Layer

devices

c. Brainstorm with other students to identify areas that may have been missed in the initial requirements

document.

Using the list developed from the group discussion, create an Access Layer module (design only).

a. Create your design using the existing equipment.

2 x 1841 Routers (FC-CPE-1, FC-CPE-2)

3 x 2960 Switches (FC-ASW-1, FC-ASW-2, ProductionSW)

1 x ADSL Modem for Internet Access

b. Using the list of equipment, identify modules that can be added to the existing equipment to support

new features, such as redundancy.

c. Save your Core Layer Diagram document.

a. Use word processing software to create an addition to the Core Layer Diagram document.

b. The identified Core Layer module diagram will be used to adjust the Distribution Layer design.

Equipment selected must include existing equipment. Use Layer 3 devices at the Core Layer in a

redundant configuration.

c. Save your Core Layer Diagram document.

a. Use word processing software to create an addition to the Core Layer Diagram document.

b. Design a redundancy plan that combines multiple Layer 3 links to increase available bandwidth.

c. Create a design that incorporates redundancy

d. Save your Core Layer Diagram document.

The design strategies for the FilmCompany pose many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified strategies. Do all of the strategies designed accomplish the task the same way?

Would one be less expensive or less time-consuming than the other?

a. Use word processing software to create a new document called “LAN Diagram.”

b. Use the identified topology and associated equipment to determine LAN design requirements.

High-speed connectivity to the Access Layer switches 24 x 7 availability

High-speed redundant links between switches on the LAN and the Access Layer devices

Identifying available hardware for the LAN

The current network has two VLANs.

1. General VLAN consisting of:

12 Office PCs

2 Printers

This VLAN serves the general office and managers, including reception, accounts and administration.

Addressing:

Network 10.0.0.0/24

Gateway 10.0.0.1

Hosts (dynamic) 10.0.0.200 – 10.0.0.254

Hosts (static) 10.0.0.10 – 10.0.0.20

2. Production VLAN consisting of:

9 High Performance Workstations

5 Office PCs

2 Printers

c. Brainstorm with other students to identify areas that may have been missed in the initial requirements

document.

Using the list developed from the brainstorming session create a LAN based on technical requirements

(design only).

a. Create your design using the existing equipment.

2 x 1841 Routers (FC-CPE-1, FC-CPE-2)

3 x 2960 Switches (FC-ASW-1, FC-ASW-2, ProductionSW)

1 x ADSL Modem for Internet Access

b. Using the list of equipment, identify modules that can be added to the existing equipment to support

new features, such as redundancy.

c. Save your LAN Diagram document.

a. Use word processing software to create an addition to the LAN Diagram document.

b. The identified LAN diagram will be used to adjust the Access Layer design. Equipment selected must

include existing equipment.

c. Save your LAN Diagram document.

a. Use word processing software to create an addition to the LAN Diagram document.

b. Design a redundancy plan that combines multiple Layer 2 links to increase available bandwidth.

c. Create a design that incorporates redundancy.

d. Save your LAN Diagram document.

The design strategies for the FilmCompany LAN pose many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified strategies. Do all of the strategies designed accomplish the task the same way?

Would one be less expensive or less time-consuming than the other?

Would the chosen LAN design allow for future growth and the addition of the WLAN?

a. Use word processing software to create a new document called “WLAN Diagram.”

b. Use the identified topology and associated equipment to determine WLAN design requirements.

c. Brainstorm with other students to identify areas that may have been missed in the initial requirements

document.

Using the list developed from the brainstorming session create a WLAN based on technical requirements

(design only).

a. Begin by creating your design using the existing equipment.

2 x 1841 Routers (FC-CPE-1, FC-CPE-2)

3 x 2960 Switches (FC-ASW-1, FC-ASW-2, ProductionSW)

1 x Network and Business Server

1 x Linksys WRT300N Wireless Router (FC-AP)

1 x ADSL Modem for Internet Access

b. Using the list of equipment, identify the model of wireless router. Identify the features and range of the

device. Identify whether there are upgrades that can be made to extend the range, security, and existing features.

c. Create a list of features and potential upgrades and compare them to other models of wireless router.

Determine the device that can easily meet the technical requirements of the WLAN. (Standalone

Access Points for ease of installation or wireless controllers for security and management)

d. With the previous list estimate the range of coverage available with the existing wireless router.

Determine if the wireless router can provide thorough coverage of the work area. Determine if standalone access points or wireless controllers are needed for the design.

e. Save your WLAN Diagram document.

a. Use word processing software to create an addition to the WLAN Diagram document.

b. The identified WLAN diagram will be used to determine the type of wireless device that will be

included into the proposed network.

c. Ensure that the chosen wireless equipment meets the following requirements:

d. Save your WLAN Diagram document.

a. Use word processing software to create an addition to the WLAN Diagram document.

b. Design a WLAN that provides scalability. Annotate on the WLAN Diagram document how the design

provides scalability.

(Scalability – New lightweight Access Points can be added easily and managed centrally)

c. Design a WLAN that provides availability. Annotate on the WLAN Diagram document how the design

provides availability.

(Availability – Access Points can automatically increase their signal strength if one Access Point fails)

d. Design a WLAN that provides security. Annotate on the WLAN Diagram document how the design

provides security.

(Security – Enterprise-wide security policies apply to all layers of a wireless network, from the radio

layer through the MAC Layer and into the Network Layer. This solution makes it easier to provide

uniformly enforced security, QoS, and user policies. These policies address the specific capabilities of

different classes of devices, such as handheld scanners, PDAs, and notebook computers.

Security policies also provide discovery and mitigation of DoS attacks, and detection and denial of

rogue Access Points. These functions occur across an entire managed WLAN.)

e. Design a WLAN that provides manageability. Annotate on the WLAN Diagram document how the

design provides manageability.

(Manageability – The solution provides dynamic, system-wide radio frequency (RF) management,

including features that aid smooth wireless operations, such as dynamic channel assignment,

transmit power control, and load balancing. The single graphical interface for enterprise-wide policies

includes VLANs, security, and QoS.)

f. Save your WLAN Diagram document.

The design strategies for the FilmCompany WLAN pose many challenges for the designer. What were a few of the more difficult challenges you encountered?

Consider and discuss the identified strategies. Do all of the strategies designed or hardware identified

accomplish the task the same way?

Would one be less expensive or less time-consuming than the other?

Would the current topology allow for future growth and the addition of the WLAN?

NOTE: If the PCs used in this lab are also connected to your Academy LAN or to the Internet, ensure that you record the cable connections and TCP/IP settings so that these can be restored at the conclusion of the lab.

a. Connect and configure the devices in accordance with the given topology and configuration.

Routing will have to be configured across the serial links to establish data communications.

b. Configure Telnet access on each router.

c. Ping between Host1, Host2, and Production Server to confirm network connectivity.

Troubleshoot and establish connectivity if the pings or Telnet fail.

a. Configure the network devices according to the following guidelines:

b. Confirm Application Layer connectivity by telneting to all routers.

Using the security policy information for the FilmCompany remote access, create the firewall rules that must be implemented to enforce the policy. After the firewall rule is documented, create the access list statement that will implement the firewall rule. There may be more than one statement necessary to implement a rule.

Security Policy 1: Remote users must be able to access the Production Server to view their schedules

over the web and to enter new orders.

Firewall Rule: Permit users on the 10.1.1.0/24 access to the Production Server (172.17.1.1) on TCP

port 80.

Access List statement(s): permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 80

Access List placement: Inbound on router SR1 Fa0/1 (remember that extended ACLs should be

placed close as possible to the source of the traffic). For each of the following security policies:

a. Create a firewall rule.

b. Create an access list statement.

c. Determine the access list placement to implement the firewall rule.

Security Policy 2: Remote users must be able to FTP files to and from the Production Server.

Firewall Rule: Permit users on the 10.1.1.0/24 access to the Production Server (172.17.1.1) on TCP

ports 20 and 21.

Access List statement(s): permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 range

20 21 or two separate access-list statements, each permitting one of the ports.

Access List placement: Inbound on router SR1 Fa0/1 (remember that extended ACLs should be

placed close as possible to the source of the traffic)

Security Policy 3: Remote users can use the Production Server to send and retrieve email using IMAP

and SMTP protocols.

Firewall Rule: Permit users on the 10.1.1.0/24 access to the Production Server (172.17.1.1) on TCP

ports 143 and 25

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 25

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 143

Access List placement: Inbound on router SR1 Fa0/1 (remember that extended ACLs should be

placed close as possible to the source of the traffic)

Security Policy 4: Remote users must not be able to access any other services available on the

Production Server.

Firewall Rule: Deny all other IP protocols between users on the 10.1.1.0/24 network to the

Production Server (172.17.1.1)

Access List statement(s): deny ip 10.1.1.0 0.0.0.255 host 172.17.1.1.

Access List placement: Inbound on router SR1 Fa0/1

Security Policy 5: No traffic is permitted from individual workstations at the main office to remote worker

workstations. Any files that need to be transferred between the two sites must be stored on the

Production Server and retrieved via FTP.

Firewall Rule: Deny all IP protocols from users on the 10.3.1.0/24 to the 10.1.1.0/24 network.

Access List statement(s): deny ip 10.3.1.0 0.0.0.255 10.1.1.0 0.0.0.255

Access List placement: Inbound on router BR4 Fa0/1

Security Policy 6: No traffic is permitted from workstations at the remote site to workstations at the main

site.

Firewall Rule: Deny all IP protocols from users on the 10.1.1.0/24 to the 10.3.1.0/24 network.

Access List statement(s): deny ip 10.1.1.0 0.0.0.255 10.3.1.0 0.0.0.255

Access List placement: Inbound on router SR1 Fa0/1

Security Policy 7: No Telnet traffic is permitted from the remote site workstations to any devices,

except their local switch.

Firewall Rule: Deny all TCP traffic from users on the 10.1.1.0/24 network on port 23.

Access List statement(s): deny tcp 10.1.1.0 0.0.0.255 any eq 23

Access List placement: Inbound on router SR1 Fa0/1

a. Review the access list placement information that you created to implement each of the

FilmCompany security policies. List all of the different access list placements that you noted above.

Based on the placement information, how many access lists do you have to create?

On Router SR1

On Router Edge2

On Router BR4

b. Based on the access list statements you developed in Task 3, create each access list that is needed

to implement the security policies. When creating access lists, remember the following principles:

list statement will be dropped.

c. Use a text file to create the access lists, or write them here. Evaluate each access list statement to

ensure that it will filter traffic as intended.

Access list to be placed on SR1 Fa0/1 inbound:

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 80

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 range 20 21

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 25

permit tcp 10.1.1.0 0.0.0.255 host 172.17.1.1 eq 143

deny ip 10.1.1.0 0.0.0.255 host 172.17.1.1

deny ip 10.1.1.0 0.0.0.255 10.3.1.0 0.0.0.255

deny tcp 10.1.1.0 0.0.0.255 any eq 23

permit ip any any

Access list to be placed on BR4 Fa0/1 inbound:

deny ip 10.3.1.0 0.0.0.255 10.1.1.0 0.0.0.255

permit ip any any

Why is the order of access list statements so important?

untuk mengurangi beban prosesor router dan menurunkan latency