graded unit - lily chandlerlilymchandler.co.uk/documents/graded unit final.pdf · 2018-03-14 ·...
TRANSCRIPT
Table of contentsPlanning 2
1.1 Analysis of the project assignment brief 2
1.1.1 Problem analysis 2
1.1.2 Aims of the project assignment 3
1.1.3 Requirements 4
1.1.4 Key factors 7
1.1.5 Resources and materials 7
1.1.6 Information sources 8
1.1.7 Analysis 10
1.2 Project plan 12
Development 15
2.1 Developing 15
2.1.1 Implementing the planned solution 15
2.1.1.1 PC Choice & Monitor Choice 15
2.1.1.2 IP Phone Choice 17
2.1.1.3 Printers 17
2.1.1.4 Router choice 18
2.1.1.5 Switches 19
2.1.1.6 Cabling 21
2.1.1.7 Servers 22
2.1.1.8 Firewall 24
2.1.1.9 Wireless Access Points 24
2.1.2 Network devices 25
2.1.3 Network redesign 27
2.1.4 Common Protocols 30
2.1.5 Implementing wireless network in a secure manner 31
2.1.6 Threats and Vulnerabilities 32
2.1.6.1 Common malware 32
2.1.6.2 Types of attacks 32
2.1.6.3 Mitigation and Deterrent techniques 33
2.1.6.4 Penetration testing versus vulnerability scanning 33
2.1.7 Review Application, Data and Host Security 33
2.1.8 Review Access control and identity management 34
1
2.2 Testing the implemented solution 35
2.3 Managing the Project 36
Evaluation 37
3.1 Outline of the Assignment 37
3.1.1 Growth and network 37
3.1.2 Access to software 38
3.1.3 Security and restrictions 38
3.1.4 Access to services 38
3.2 Strengths and Weaknesses 39
3.3 Recommendations 39
3.4 Modifications 40
3.5 Knowledge and skills 41
Sources 41
Planning
1.1 Analysis of the project assignment brief
1.1.1 Problem analysis
The company TechRep is a computer repair and reseller in the East of Scotland. They have asked our
company to redesign their network in readiness for their planned expansion. Currently they operate
in the UK, but are looking to expand globally, and will need to systems in place to facilitate this. At
the moment, they have 56 members of staff spread across 3 locations in South East Scotland. Their
current network is too slow and unreliable for present members, let alone their planned expansion.
At present, they have an ad-hoc network, which means all computers are connected to each other in
a peer-to-peer fashion. This is unsuitable for any network of reasonable size which is shown by the
unreliability of their current network. They plan to expand by 80% in the next 5 years, and so need a
network that can keep up with their needs and works properly.
They have also brought up the issue of security. As discussed in the project brief, they have recently
been prone to denial of service attacks. This will need to be sorted if they are due to grow their
company, as they will be more of a target. Data corruption was also outlined, and as have had
problems in the past, which has affected their profits. They wish to mitigate this as they have seen an
increase in attacks on their network.
2
The managers have also requested that they have separate permissions on files and folders so they
can access staff files as they please. The network should also have the ability to control what
different members of staff have access to.
1.1.2 Aims of the project assignment
The two major aims of the project is network security and future proof the network for the
company's projected growth.
Network security will be achieved by implementing firewalls and access control lists. These firewalls
will prevent unauthorized access to the network from the internet. Another feature that will be
added is DDoS and DoS protection, so that TechRep will be less susceptible to attacks, minimising
down time so they can keep working. Another aspect to consider is the physical security of the
network. A password policy that is secure enough to deter potential attackers, but simple enough
that people can remember them, without writing them down. This also raises the security of the
building. If we have a server onsite to hold AD and other services, these are prone to being targets of
potential thieves. If we use a data centre/cloud service, onsite security is handled by them.
The aim of future proofing the network and other hardware, should be able to at least last 5 years
with the projected 80% expansion. We will know if we have achieved this if the PC’s meet the
requirements listed below. Before TechRep approached us, they did an internal survey of how their
staff use their current PC’s, here are the results.
This shows us how to best optimize our budget, and the best way to get the best PC’s for the job. The
best way to achieve this is to purchase new networked PC’s which are capable of basic tasks and
enough for them to last for the predicted expansion of about 5 years. These tasks will include the use
3
of an Office suite which the PC will need to be able to run at the very minimum. The details of these
will be outlined in requirements.
1.1.3 Requirements
These are main points they have asked us to take into consideration, along with an idea for a solution
● Each member of staff should have their own networked PC. ○ This can be solved by procuring the right PC for the job. This will include assuring
that the specifications of the PC meets TechRep’s minimum requirements. Getting
decent hardware though will future proof the company's hardware for expansion.
○ In order to run an Office suite, a basic computer is needed at minimum. These
generally do not cost much and meet most requirements, however they tend not to
be very future proof and often break easily due to low manufacturing costs. These
can come in form factors of tiny (Credit card sized), to small (shoebox size). However,
there is also the option to run thick and thin clients, which means running a small
computer (Book size) with a keyboard, mouse and monitor, but the actual compute
power is on a server somewhere else in the building. This sort of setup is generally
expensive to setup, but is one of the easiest to expand as all you have to do to add
another computer is buy another ‘thin client’ which are cheaper than standalone
PC’s.○ Mid-tier prebuilt computers (towers) are more suited for light to medium tasks such
as running an office suite, browsing the internet, and perhaps running some
proprietary software such as a website builder or accounting software. These can be
fitted out to be fairly future proof, meaning they will last for a good amount of time,
while still being fairly inexpensive. The downside of these is they cost a fair amount
per computer, and are harder to manage than other solutions, but often are best
suited to resource intensive tasks such as using Chrome. ○ Each PC will require a monitor. Common sizes can be 19”, 21” or 24”. The larger
screen sizes will have a better resolution, and therefore a clearer view of the work a
member of staff is doing. These can vary wildly depending on screen technology (IPS
or TN). IPS is a more expensive option, but is known for its better colours and angles.
This will be important to someone who works with colour such as photo editing and
to screens in conference rooms, so everyone can see properly. TN is a more mature
technology, and is cheaper, but doesn't have as good a colour reproduction and it as
slightly worse viewing angles. Screen size is also a factor, a bigger screen will be
easier to work with as it has more screen space, but a smaller screen is cheaper and
more space efficient. Those employees who are working on space intensive work
such as spreadsheets and website building, may benefit from more than one monitor
to increase productivity. Generally, the common aspect ratio of screens tend to be
16:9, to give the best compatibility with programs. Screen resolutions depend on
screen size.
4
○ Another option for the PC’s, is laptops. These can be used by employees who want
mobility and want to move around, such as managers. These often cost more for the
same specifications as their desktop counterparts, and are smaller.○ As for the PC operating system, Microsoft Windows is the most widely used. This is
an advantage when looking at program compatibility, but because of this it is also
susceptible to malware, which then requires anti-malware software, which is often a
subscription. Windows also costs per PC, which when buying for a lot of PC’s can be
quite a lot of the budget. Apple’s macOS is a ‘proprietary’ operating system that
comes with all of their PC’s. These are often looked upon as more expensive than
what you get, but they are used among creators as they provide a nice workflow, and
are not to prone to malware. The last option is a Linux distribution, which is free.
However, they are often the least compatible with programs, as they make up a tiny
proportion of users. Because there is not a lot of program compatibility, there is no
need for an anti-malware, and since programs are maintained through repositories,
it can easily maintained. Some common distributions are Ubuntu, Mint, Debian and
Arch. Other options include Apple macOS and Linux. ● All staff require access to a generic office suite
○ Microsoft Office is available either by subscription (Office 365), or as a one off
payment. Other suites are available such as WPS Office, OpenOffice or LibreOffice.
These can be installed on most PC’s, depending on their operating system. ● Sales staff require access to sales ledger software and a specialised contact management and
sales tracking package. ○ Sage ledger software is a popular suite used by many companies used all over the
world. They also offer other packages such as Payroll and accounting software. ● Each member of staff should have their own private file storage.
○ Currently, staff have access to files in an ad-hoc fashion, where they browse others
computers, all using the same admin username and password. This is very insecure
and can easily be intercepted or misused. It also gets very complicated having to
know which computer has which file on it. To share files with other offices, they have
to email them, but with increasing file sizes this is evermore becoming impossible to
do. My plan is to have all staff to have a private file storage server, this can be
achieved many ways. The main ways of doing this include a single drive for each
employee, which would be easy to set up, but be very costly and unresourceful.
Using virtual drives per employee which can divvied up depending on how much
storage there is available and can easily be changed if a new employee is taken on.
The last option is to have a file server per location and assign each employee space
on that file server depending on their job role or needs. This is good as it is very agile
and can be easily added to if a new employee joins and does not interrupt others
users if someone leaves, as unused space can be picked up by users who are using
more storage. ● Managers require access to all files, including private files, belonging to staff within their
department.○ Permissions can be given to managers depending on the way the file system is setup.
If each employee has a single drive, then the permissions for each drive can have
multiple users with each permission. If the system is setup with virtual drives, this
can be done the same way as single drives. But if a user is allocated space with a
5
drive, folder permissions can be setup with multiple users. This can be done through
active directory. ● The Managing Directors also requires access to all files, including private files, for the entire
company.○ Permissions can be given to manager directors depending on the way the file system
is setup. If each employee has a single drive, then the permissions for each drive can
have multiple users with each permission. If the system is setup with virtual drives,
this can be done the same way as single drives. But if a user is allocated space with a
drive, folder permissions can be setup with multiple users. This can be done through
active directory.
The permissions for each system should have a hierarchical model put into place to
achieve their goal. ● The Sales Manager requires access to website development software.
○ Website development software can be as simple as a text editor, or specialized
software. Starting at the bottom, a simple text editor with plain HTML and CSS will
get the job done but is not very friendly to new users. Enhanced text editors such as
Notepad++ or Vim, will allow for colouring to help show variables and other
important details stand out making it more readable. Specialized software for
website building such as Adobe DreamWeaver will make it easier to write code for
the website and ● Suggestions are required for hosting of the web server.
○ Options for web hosting include having a dedicated server to handle web traffic with
possibly another internet connection so it doesn't interrupt your work. Another
option is cloud hosting, which is usually preferable as it is cheaper to set up. The
advantage to having your own server is complete control over everything, where in
cloud hosting you just provide the website you want to host. ● DNS, AD, DHCP, Email, Web, Backup, Storage require consideration.
○ Usually an onsite server handles most of these services, as it is the fastest and you
have the most control over it. Other alternatives include cloud services, or data
centre. However, not all services can be handled off site, but some such as DNS and
DHCP can be handled by a router. ● Purchasing staff require access to purchase ledger software.
○ DeFacto Software and other companies provide software made specially for
purchase ledger and sales software. ● One member in each branch of the accounts department should have access to a standard
accounting package. Another member should have access to a payroll○ Sage Accounting offer software, but there are other options if this does not suit.
● All staff should have full internet access with the exception of the Warehouse staff all social
media sites should be restricted○ To separate the two levels of internet access, Access Control Lists will be used to
control which type of websites can be accessed per each department. ● All staff apart from the Warehouse staff should have IP Phones on each of their desks.
Warehouse Staff will have 2 positioned within the Warehouse.○ The IP phones can be installed in switch mode so we will only need to install one
cable for both the PC and the IP phone, reducing costs.● Full email facilities are required for all staff.
6
○ Email facilities such as Microsoft Outlook, Gmail, or owned under a custom domain.
Microsoft Outlook and Gmail have a monthly cost associated with them, as a trade-
off for feasibility and usability. Having a custom domain is harder to set up, but
usually has lower operating costs in the long run. Applications such as Mozilla
Thunderbird, Microsoft Outlook can facilitate the front end of the email system. ● Each department should have its own printer, with access restricted to members of that
department.○ A printer will be bought for each department, then by using Access Control Lists we
can restrict each printer to the specified department. ● The Managing Director has a printer which is restricted to his own personal use.
○ A printer will be bought for the director, then by using Access Control Lists we can
restrict it to their own personal use.
We asked TechRep what their budget would be for a project like this, and they replied with “A budget
of £750,000-£850,000”. Also, as we have agreed with TechRep, this project is an upgrade only and
will not include long term support for the system we install. Another requirement of the project is
that the new network must be able to handle a growth of 80% over the next five years. Along with
the growth of the company, the concern for security becomes ever more important as the more of a
target they become. The network requires enough security to be able to function on a daily basis and
be protected against malicious attackers.
1.1.4 Key factorsManagement have identified a number of key factors that they think will affect the project. . They
have asked us to address these to meet the aims of this project.
They believe that network security is not as good as it can be, and we need to address this. This is
brought up after a number of attacks on their network, slowing, or even shutting down their
network, affecting profitable work time. We will know if we have achieved this, if the new network is
less prone to attacks, and there are less intrusions.
Also, since TechRep have been expanding rapidly, their network hasn't had a chance to catch up and
so, is fairly unreliable for a company of their size. This is shown by the peer-to-peer fashion of their
network, which is only good for very small networks. We will know if we have achieved this if the
new network, is faster, and has less down time.
Since they are a technology company, they under near constant threat from attackers, they wish to
mitigate this as much as possible, so they can continue working. This needs to be reflected upon the
network which they are coming more and more dependant. We will have achieved this if we also
achieve the first key factor.
1.1.5 Resources and materials
TechRep have asked us to design an upgrade to their network, with the primary focus being security.
As the network is an integral part of their business, upgrading the network will unfortunately create
certain downtimes, so we need to think of working times as a resource. Also, since we are upgrading
7
their PC’s and redesigning Active Directory, users will also experience some differences, causing
potential downtime and delays.
Resources:
● Staff - There are currently 5 people assigned to the project, including for the planning,
development, and evaluation stages. In total the project plan has detailed that the project
finishes in 4 weeks, however an additional two will be needed to finish the development on
the other offices. The staff at TechRep will not be needed, however they may be affected by
work being done. ● Transport - In order to transit the equipment and tools needed to install everything, we will
need a van. However if we get the equipment delivered straight to the appropriate office,
this will be negated, and the only transport needed will be for our staff to get to the office
they are working on. ● Time - As TechRep is a working company, and as I said earlier, the network is an important
part of business and so any downtime is an issue. To mitigate this, we will try and work
around the working hours of TechRep, or at the very least try to lessen the amount of
disruption caused.
To do this, we plan to work in the evenings, setting up the new equipment each night, then
on the final night, switching all the PC’s over, and removing the old network. In order to
achieve this, we may need the office of TechRep we are currently working on, to finish
slightly earlier than they would usually do, so we still have time to do everything we want to
do for that evening.
Materials:
● Switches - These will be used to interconnect the PC’s to the router. ● Router - Will be used to connect all the switches together and to connect to the other
offices, the internet, all through the new firewall● Firewall - Will be used to limit and filter traffic, increasing security.● Server - Can be used for Active Directory, DHCP, DNS, and other services such as the file
server. Will be in a central logical location so all can access it easily. ● Cabling - Used to connect everything together, existing cabling is only Category 5, so an
upgrade is needed. ● IP Phones - These will be used in place of old phones, which will be easier to manage.● ISP - Will look at current contract for the Internet Service Provider to see if the best plan is
being used. ● PC’s - New PC’s will be purchased in order to cope with the network upgrade, and also to
futureproof them for the planned expansion. ● Testing - To test the network, and cable testing, we will need a number of small devices such
as cable testers, bootable USB drives to configure the new PC’s, and our own laptops to work
with should any small problem need to be resolved.
1.1.6 Information sources We were given the current network topology so we could work on seeing which parts needed
upgrading. The current cabling is only Category five (Maximum of 100 MB/s), which is limiting for
local file transfers, and sometimes all internet traffic depending on the internet connection. The
current router is a no brand router, which explains the massive amount of attacks on the network.
The current PC’s have a 160GB 5400RPM hard drive, 2048MB of RAM, 1.6 GHz AMD single core CPU,
and 800x600 monitors. The operating system is Windows Vista, which according to emails from
8
TechRep, is very unstable as it crashes on a daily basis. These obviously will not keep up with work
demand, and so need to be upgraded. One piece of documentation used was the survey done by
TechRep before we were contracted to determine the specs of the new PC’s. This survey was
conducted on their own staff to see how they mainly use their PC’s, so we could accurately get the
best PC’s designed for the job. To see the results, go back to Aims of the Project assignment. This
outlined what sort of PC’s we will need to get. The picture below was sent to us by a manager of
TechRep to show us the specifications of the current computers.
The project brief asked how we will be obtaining the materials needed to complete this project. As
we are an established networking design company, we have formed strong bonds with vendors and
can recommend the best ones to use for different projects.
The ones we recommend for this project are:
Cisco Systems - https://www.cisco.com/c/en_uk/index.html
Cisco will be used as a reference for best practices, documentation, switches, routers, and servers
Netgear - http://www.netgear.co.uk/
Netgear will be used for documentation and switches
Ubiquiti Networks - https://www.ubnt.com/
Ubiquiti will be used for documentation, routers, switches and wireless access points
Ruckus Wireless - https://www.ruckuswireless.com/uk
Ruckus will be used for documentation and wireless access points
Dell - http://www.dell.co.uk/
Dell will be used for documentation, PC’s and servers
SuperMicro - https://www.supermicro.com/index_home.cfm
9
SuperMicro will be used for documentation and servers
Hewlett Packard - http://www8.hp.com/uk/en/home.html
Hewlett Packard will be used for documentation, PC’s and servers
1.1.7 AnalysisAs a conclusion based off the research I have conducted, I have been able to create a rough idea of
what the network will look like, the layout of the devices and which devices to put in their place. This
diagram shows a logical layout of how I plan to design the network.
I have a single router in the centre, which has a link to the internet/VPN to other offices, via a
firewall. The logical topology above shows how each of the three offices is going to be laid out, some
may differ slightly but it is all roughly the same. The physical network for each office will be different
however. The firewall will connect to an ISP shared by all three offices, then a VPN will be used in a
triangle formation between the three as to get the best connectivity and some redundancy if one of
10
the links fail. Leased lines were considered but for a company this size, it would deem far too
expensive for the reward. Off the router, I have 3 switches for the different departments. The PC’s are
connected to the switches via an IP phone which has a pass through enabling them to act like a
switch. I then also have a printer for each department, along with a Wireless Access point in the
warehouse for the use of BYOD, however it may be worth considering to expand the wireless
coverage over the whole office to allow for the managers and directors to use laptops. The main
server is also linked off one of the switches. I am considering either Cisco, Netgear or Ubiquiti for the
Switches, then Cisco or Ubiquiti for the router. At this stage I am thinking the IP phones should be
Cisco, however the model is not yet decided, as different models may fit different departments
differently. The PC’s have been decided to have good enough specifications to run basic tasks such as
word processing and fast boot up times.
11
Development
2.1 Developing
2.1.1 Implementing the planned solution
Continuing from the analysis from the planning stage of the project, in this section we will be
outlining the exact features and specifications of the network design.
2.1.1.1 PC Choice & Monitor ChoiceAs outlined in the project brief, the PC’s have to meet a minimum requirement to run programs such
as an office suite, and accounting software. It was considered to have a thick and thin client setup,
where employees would use a smaller PC which would then connect to a larger server, offloading
resources to a central site, reducing the need for a large team of support staff for each separate
machine, and reduces cost somewhat by congregating most costs into one server. This is referred to
as virtualisation. We looked into getting a SuperMicro Ultra Server[1], and fitting it with twelve 4 TB
drives. Potentially, the drives we would get, could either be Western Digital Red’s [3], or Seagate
IronWolf[5]. The cost of the server is around £2,300[2], the cost of 12 x 4 TB WD Red Drives is about
£1,680[4].
The cost for 12 x 4 TB Seagate IronWolf Drives is about £1,440.
So the total price for a virtualization server would be about £3,800, without the cost of server
components and thin clients to add on.
However after some deliberation, this was decided not be used as it is cheaper in the short term and
is more suited for the planned rapid growth of the company. Standalone machines will last longer per
employee, and is more modular (you can just buy another computer), if more employees are taken
on. With this in mind, the PC’s we buy need to be able to last at a minimum of 5 years, with the
possibility of Operating System upgrades, which could make the system slower over time. This means
the PC’s will be more powerful now, so that down the line, they will still hold up to standards that are
workable.
After some research on both manufacturers that we outlined in the planning stage (Hewlett Packard
and Dell), HP was found to not have sufficient enough specifications for the level of future proofing
that we require. Turning to the Dell website yielded more accurate results to what we were hoping to
13
achieve. Dell offer small form factor PC’s which are especially suited for office use. This means that
they are able to fit on the desk rather than under it allowing for better access to the USB ports and
maintenance. Subsequently, we found a PC that fits our needs. The Dell OptiPlex 7040 [7] is shown
below.
We decided to go for this PC as it comes with 8GB of DDR4 RAM which is enough memory to handle
lightweight tasks such as web browsing for the foreseeable future. The system also has an Intel Core
i7 CPU which will be enough to handle accounting software and other software they wish to use.
Unlike traditional PC’s this system comes with a 256GB PCIe NVMe SSD, which means that boot up
time will be significantly reduced, minimizing downtime. Another advantage of a Solid State Drive is
that everything will run quicker so there is less waiting and more work can be done. It also comes
with Windows 10, which is completely useless.
Since we are buying from Dell directly, they offer a discount if you also buy a monitor with them. We
chose the Dell Ultrasharp U2414H[8]. This is a 24 inch monitor with IPS technology, which means the
colours will be more accurately represented and will look clearer.
14
2.1.1.2 IP Phone Choice We have chosen to use IP phones in our network as they are more easily integrated with the services
we will be using such as VoIP (Voice over Internet Protocol). This will allow us to move away from the
old system of traditional telephones which are harder to maintain and are longer suitable for a
modern working environment. We have also designed the network to use the IP phones as a switch
for the PC’s to reduce the amount of cabling needed to wire everything together.
Our vendor of choice for IP phones is Cisco, as they are known to be good quality and to work with a
wide array of systems. According to our plan, each PC will have an IP phone which is connected
through its built in single port gigabit switch. We wanted a model that offered a full size keypad, a
moderate screen size for information to be displayed. Eliminating those models that offered more
features than we needed, thus increasing price. However we needed to keep the gigabit switch for
our servers and other services to work to their fullest. After browsing the Cisco site for a while we
decided upon the Cisco 6945 Unified IP Phone[9][10], as it has all the features we need, without
unnecessary add-ons which would increase the price. The price is shown below.
2.1.1.3 PrintersCurrently, TechRep only have a single inkjet home printer which is not handling their current
workload and keeps malfunctioning. If they are to expand they will require a more stable printer that
can print more jobs and last longer.
The current inkjet printer in each office consumes a lot of ink and so is quite costly. For this reason
TechRep have expressed great interest in buying laser printers as an alternative as they have better
price to print ratio. The marketing department has also put in a request for a colour printer so they
can print out graphs as before charts were difficult to distinguish if multiple colours were used.
The common protocols used in printing over the network are Line Printer Remote (LPR) which runs
on client PC’s and is used to send files to a print server running a Line Printer Daemon (LPD). LPD is
used on a print server which is used to receive print jobs from client PC’s running LPR. Internet
Printing Protocol (IPP) is also a consideration, although maybe not totally relevant since each office
15
will have more than one printer at least, however if managers/directors are away from the office, this
protocol may come in handy if they need to print something urgently.
The main manufacturers we have been considering are HP and Brother. After some research it has
been found that Brother have a good reputation of good quality printers that are not prone to break
easily. As with IP phones, we want to meet the requirements of TechRep, but not go too overboard
with unnecessary features as to keep the cost down.
After browsing the brother website and eliminating those printers with unnecessary features, we
found one that fits the needs. The Brother HL-3170CDW is a colour laser printer, so management can
print out in colour, and the cost for toner/ink will be reduced as it is a laser printer. It is connected via
Ethernet, which will make it easily manageable through Active Directory and Virtual Local Area
Networks (VLANs). Printers will be bought for each department to reduce the printer queue so work
can be carried out more efficiently.
2.1.1.4 Router choiceIn the planning stage, we set out three switches and a single router. The internet connection would
be managed through a firewall. This means that there will need to be a minimum number of
Ethernet ports on the router. Additionally, if we want to futureproof, it may be worth considering the
use of 10 Gigabit interfaces not just 1 Gigabit, however the price will severely dictate the use of
these. It may also be worth considering the use of Cisco Meraki, since they have VPN and firewall
capabilities built in, negating the need for an additional device. However, this could be a drawback
since if the router goes down, it will be more expensive to replace and there is more to go wrong.
Since the selection of Meraki routers are limited, it was fairly easy to find one that would fit the
needs of TechRep. The Cisco Meraki MX100[12][13] is a firewall and VPN router that has 8 Gigabit
Ethernet LAN ports, a single WAN Ethernet port and a management port. This will make it easy to
setup a VPN between the three offices if all routers are the same model. The built in firewall also has
a throughput of 750 Mbps which will greatly improve the speed and security of the network. The
VPN has a throughput of 500 Mbps, which sounds low, but we will split the traffic so that only the
traffic intended for the other offices will need to travel down the VPN, freeing up bandwidth for
other users on the internet connection. Since we are using a VPN, IPsec will definitely be used to help
16
keep the VPN part secure. Other protocols we will use is IPv4 to help with addressing internally, and
possibly the use of IPv6 to aid in the future proofing of the network. SSH will also be used to
remotely manage the router once it has been deployed. The LAN ports may come in handy, however
it also includes two SFP ports which plays a big part in our decision for switches.
2.1.1.5 SwitchesAccording to the logical topology from the planning stage, we were going to have three switches
connected to the router, which would service at least one department, if not more. However, the
options of interfaces on routers and thereby switches, have made it uneconomical to have all three
switches connect to the router at once. Because of this, we have decided to also acquire a
distribution switch to aggregate all the access switches. This also gives us the option to upgrade to 10
gigabit so that users will be able to access the server(s) at faster speeds and be able to work more
efficiently. To gain access to the 10 gigabit speeds, we will need to use the “small form-factor
pluggable” connector.
Since the distribution switch will need to aggregate all the access switches, it will need to primarily
be made of 10GBASE-T SFP+ ports. For this I looked on the Ubiquiti website and Cisco website. Upon
eliminating those products who offer more than we need I narrowed the search down to the Ubiquiti
EdgeSwitch 16 port switch[14][15]. This offers 12 SFP+ (10GBASE-T) ports that will be used to connect to
the other switches at 10 Gigabit speed. However, since there will only be about 3 access layer
switches, it may be possible to aggregate SFP+ ports so that two connections are made to each
switch, increasing bandwidth from 10 Gigabit, to a theoretical 20 Gigabit. At this data range, we are
struggling to get read/write speeds from/to the SSD’s in our potential file server, so to aggregate a
third SFP+ port may not be useful.
17
In the case of the distribution switch, this means the access switches need to have at the minimum
two SFP(+?) ports to be able to connect to the distribution layer. All other ports need to be Ethernet
ports operating at 1000BASE-T (Gigabit). Since the distribution layer will be operating at a theoretical
20 Gbps, this will allow multiple users to access the server and services while maintaining relatively
fast speeds. Another consideration is Power over Ethernet, which will need to be used for the
Wireless Access Point(s). Also since we were going with Ubiquiti for the distribution switch, to
maintain continuity, it would be preferable to use another switch from the same company. The UniFi
switch with PoE (Ubiquiti UniFiSwitch)[16][17] fits the specifications perfectly, and still allows us to keep
the 20 Gigabit speeds maintained through the two SFP+ ports.
These switches will be the access switches that will connect to the IP phones and the PC’s. The
switch also supports PoE up to 500W which will be more than enough to power the IP phones and
Wireless Access Points.
New switch layout after revisions:
18
2.1.1.6 CablingCurrently, TechRep only have Category 5 cabling, which can only support up to 100 Mbits/s. This will
become an issue when employees are accessing the new file server and trying to retrieve files. It will
also be an issue when employees from other offices need to access the file server also. It is also very
difficult to manage as none of the wires are labelled, so troubleshooting will be difficult. We intended
to replace most of the Category 5 cable with Category 6, which will give the end user Gigabit access.
However, some of the cabling will be replaced with SFP+ cables[18]. These will primarily be placed
from the access switches, to the distribution switch and to the main router. We will also be
aggregating two SFP+ cables going to and from each switch and router. Depending on the mode
used, this will either increase speeds from 10Gbit/s to 20Gbit/s, or can be used as a failover in case
one fails.
19
2.1.1.7 ServersCurrently, for sharing files between computers, employees either email them to each other, or use
the default file sharing using peer-to-peer. This is a very unsecure and unstable way to store files.
TechRep also do not have any way to backup files, however sometimes employees may save files to
flash drives to ‘save’.
The plan is to get a server for each office, and then to set up active directory on each and assign
users file storage space in active directory. To manage all user profiles over all offices, we will use an
active directory controller, and then link up the other servers. The Edinburgh office will be the Active
directory master, so it will be the main source of all the profiles that the other offices use to login
with and will act as the slaves. We will also use folder redirection, to help employees get used to
saving files on the server. To save costs, we will use one physical server to host both the active
directory server (with file server), and the onsite backups. In our planning we outlined using
SuperMicro servers as they have a good reputation and reliability. We have selected the SuperServer
6028U-TNR4T+[19] as a candidate, as it is not overkill on its specifications but has enough drive bays to
support both roles. Half of the drives will be used to form a cluster in RAID 1, copying the other half.
The other half, a half of that will be active directory file storage, and then the other half will be a
backup of that.
This server configuration will be deployed in each office, the only difference in Edinburgh will be the
Active directory controller master.
Since this server only comes with the caddies and the motherboard, we will need to fit out the server
with all the other components. For a server this size, 32GB of Error Correcting Code (ECC) [20] memory
should be sufficient for day-to-day use. The advantages of ECC over normal memory is that there is
less memory corruption over normal memory that would otherwise have caused a program or the
system to crash. This ensures the server is always available.
20
Another component we need is a processor, or CPU. The server supports Intel Xeon’s E5 Server
processors, and for this sort of workload, where we do not need to virtualize, we don't need a huge
number of cores. To keep the cost low and the clock speed high, we have chosen the Intel Xeon
Processor E5-1660 v4[21]. The hard drives we discussed in the PC’s section, and we were going to get 3
x 2 TB drives for the active directory (green), then 3 x 4 TB drives for the backup (blue), and 6 x 4 TB
drives for the RAID 1 area (red).
For the website and we have decided that the best course of action would be to store the html files
on a cloud service such as Amazon Web Services or Google cloud. This means that the website has a
lower chance of going down than if we were to store it on local servers which are prone to more
accidents and downtime. We have decided to use Amazon Web Services due to their low cost and
easy to use interface.
The mail server will also be in the active directory server, added as a role. Because the mail server is
a vital part of the company, it will be placed in the Edinburgh server, the active directory master, so
all email will be replicated on the slaves. We will then use an application such as Thunderbird on the
client PC’s. Since the mail server is an important role in the company, a Uninterruptible Power Supply
(UPS)[22] may be a consideration, to stop unwanted power fluctuations and power outages from
adversely affecting the server to go down.
21
2.1.1.8 FirewallSince we have chosen to go with a Cisco Meraki, the router we have chosen, includes a firewall built
in which makes it easier to manage and reduces cost. See above in router if you would like to know
more.
2.1.1.9 Wireless Access PointsSince the planning stage, we have discovered that the single wireless access point in the warehouse
for Bring Your Own Device is not enough, and that the employees in the rest of the office would also
benefit from a more widespread coverage for internet. This would allow them to access the internet
on their mobile devices, and we would also keep the Bring Your Own Device policy. However those
that would benefit from mobile devices such as laptops could be managers and directors might be a
consideration.
In our planning, we outlined two potential manufacturers to buy our wireless access points from.
Ubiquiti who we are getting the switches from, and Ruckus wireless. Ruckus have a good reputation
for reliability, and since we need future proofing, we have decided to use them.
To future proof the offices, 802.11ac should be used to ensure speeds are adequate enough from
now even through 5 years’ time. Because AC Wi-Fi uses dual band radios (2.4 GHz and 5GHz), the
speeds depend on which version of the spectrum you are using. 2.4GHz offers speeds up to 300
Mbps, whereas 5GHz can currently offer up to 1300 Mbps on higher end models, but only 867 Mbps
on lower end models. The 2.4GHz only operates in the 802.11n standard it should be noted. The
addition of MIMO, or even MU-MIMO is always welcome as to serve more clients at once and reduce
interference with others. QoS support is a must, so that VoIP can be used easily, however on higher
end models this is usually standard.
There are many different types of wireless security, however usually the newest version of security is
the most preferred as they usually offer the strongest encryption and therefore the strongest
security. Wireless Protected Access II (WPA2) is the newest version of the 802.11 protocol security
suite. However, authentication with active directory and/or RADIUS also adds a layer of security.
Taking all these factors into consideration and looking into the Ruckus website, we have found a
suitable access point that will last the planned 5 year upgrade. The Ruckus ZoneFlex R500 is a 2x2:2
MIMO dual band 802.11ac Wi-Fi access point. It can be used in either a standalone or autonomous
mode to support a bigger range of wireless. It comes with support with RADIUS and Active directory,
so we will not have to create another set of user groups, but will just be able to use the ones we use
for the PC’s.
We plan to deploy two access points in the warehouse, and two in the office. At this time we do not
think it is necessary for a wireless controller, however one may be of use in the future.
2.1.2 Network devices The firewall that we have decided to get is the Cisco Meraki MX100. As it is an all in one router,
firewall and VPN concentrator, most of the configuration will be done on this one device. The
firewall will be set up with an explicit deny rule so that any unmet traffic is dropped. Rules in place
will ensure only safe and predetermined types traffic get through. The types of traffic that will be
added to the allow rule will be discussed later in common protocols.
22
Network Address Translation (NAT) is used to conserve space for IP addresses. The internal
network address range is used to assign to devices with a unique address to the private network.
Then to access the internet, that private address gets translated with a predefined pool of public
address’ that is provided by an ISP. Since we will be using ISP connections to access the internet,
these addresses will be given to TechRep to add to the configuration of the router. Depending on the
amount of addresses we receive from the ISP, we will also implement NAT overload, which uses only
one or two address and each time a user needs to access the internet, is assigned a port for the
client. This is known as Port Address Translation (PAT). A consideration with NAT is its compatibility
with IPv6, using NAT64, along with DNS64.
Security on switches will mainly be MAC address security. Three modes can be assigned to a port
ensuring the right user is connected. Static address security ensures that only a list of computers can
use that port, stopping unauthorized devices connecting to the network. This mode will probably be
used on the ports that are not yet in use.
The next mode is dynamic in which devices are learned on the go and will be lost when the port is
shutdown. Sticky MAC addresses are learned dynamically from the port and also entered into the
running configuration so it is not lost when the port goes down. This is the mode that will be used on
end user devices.
If a violation occurs, the port will enter one of three states. Shutdown, closes the port to all traffic.
Protect allows traffic from known address while dropping those from unknown, and Restrict does the
same as protect but also sends a message showing a violation as happened.
Network Intrusion Protection System is a monitoring and protection system used to detect
unusual network traffic and adjust the firewall rules accordingly. This is a more advanced version of
Network Intrusion Detection System which only monitors the network, however this may be
preferable if TechRep would like manual adjustment.
The spam filter we will be implementing comes preinstalled along with our email client of choice,
Thunderbird[23]. It dynamically learns what messages are junk mail according to the users’ habits and
places those in a folder. This should reduce the amount of spam received if also the user is train
appropriately.
For URL filtering, we will be implementing OpenDNS[24], which is equivalent to Cisco Umbrella[25] on
Cisco’s Integrated Service Routers. OpenDNS analysis traffic to try and detect threats. It also has the
ability to block certain types of traffic, but this will be dealt with by our firewall. However a useful
feature will be the ability to block certain types of websites or just individual websites. This will be
used in the warehouse if TechRep want to block. OpenDNS can also block certain types of malware
from joining a botnet.
Virtual Local Area Networks (VLAN’s) will be used on the network to help break up users into
manageable groups. ID numbers will be assigned to departments’ incrementing by a number each
time. This will also help create a useable and semi-readable IP address scheme.
23
We will be implementing security features on the routers to lockdown unauthorised access.
Standard procedures such as password encryption on plaintext passwords, encrypted secret
passwords, and console line passwords will be added. Giving each appropriate technician a separate
SSH login will not only make it more secure, but easier to audit since we can see which tech was
logged in if an issue occurs. SSH is far more secure than the unencrypted plain text Telnet. It may
also be worth shutting down the console port to increase security even further.
For a Denial of Service flood guard, the Cisco Meraki MX100 we have used for our router and
firewall also includes a basic Intrusion Prevention System (IPS) which acts as a flood guard against
DoS attacks.
Spanning Tree Protocol will need to be implemented to mitigate looping. This is important as we
have three loops each with two links to accommodate LACP.
Remote access will be used to transfer files between sites using the domain controller through the
VPN. Users should not have a need to access the other sites FTP servers manually due to folder
redirection. If two users want to share files, the file should be put into the not private area of the
server where they can both access it, and folder redirection should do the rest.
2.1.3 Network redesignThe current network consists of ~20 users per office, connected to an old-style hub, via Category 5
cabling. This causes collisions and instability. They do not currently have a wireless network, and the
PC’s are low end machines running Windows Vista. The router they currently have is a no brand
router from their ISP which keeps malfunctioning. Below is a logical topology of what we believe to
be the current network at TechRep. It represents one office with 19 PC’s, one backbone hub and
three access hubs.
24
This is a physical topology of the proposed network, with upgraded cables (blue).
This is a hierarchical model of how the network devices are going to be distributed.
IP address table for the new network topology.
Edinburgh Dundee Glenrothes
Location base IP address
10.10.0.0255.255.0.0
10.20.0.0255.255.0.0
10.30.0.0255.255.0.0
26
Subnet mask
SalesSubnet mask
10.10.10.0255.255.255.0
10.20.10.0255.255.255.0
10.30.10.0255.255.255.0
PurchasingSubnet mask
10.10.20.0255.255.255.0
10.20.20.0255.255.255.0
10.30.20.0255.255.255.0
AccountingSubnet mask
10.10.30.0255.255.255.0
10.20.30.0255.255.255.0
10.30.30.0255.255.255.0
WarehouseSubnet mask
10.10.40.0255.255.255.0
10.20.40.0255.255.255.0
10.30.40.0255.255.255.0
Management/DirectorsSubnet mask
10.10.50.0255.255.255.0
10.20.50.0255.255.255.0
10.30.50.0255.255.255.0
WirelessSubnet mask
10.10.60.0255.255.255.0
10.20.60.0255.255.255.0
10.30.60.0255.255.255.0
GatewaySubnet mask
10.10.100.1255.255.255.248
10.20.100.1255.255.255.248
10.30.100.1255.255.255.248
NATSubnet mask
Provided by ISPProvided by ISP
Provided by ISPProvided by ISP
Provided by ISPProvided by ISP
ServerSubnet mask
10.10.100.5255.255.255.252
10.20.100.5255.255.255.252
10.30.100.5255.255.255.252
2.1.4 Common Protocols● IPsec provides security to packets heading over the network. It encrypts and authenticates
the packets. It is especially useful for uses such as VPN’s, which we will be using to connect
and secure the sites, a fairly important role. ● SNMP (Simple Network Management Protocol) (Port 161) is used to monitor and gather
statistics from events occurring on the network. This will be used to collect data on the
running data of the network, and be very useful in auditing. ● Secure Shell (SSH) (Port 22) is a more secure version of Telnet which allows users to login to
devices using a username and password. Each authorized technician will be given a unique
username and password so it will be easier to audit if something happens. ● Domain Name System (DNS) (Port 53) is a system of assigning IP addresses to name servers
to make websites and other systems more readable and memorable. This will be used in our
network to assign the servers(s) with domain names as to make the servers more accessible
to users. It will also be sued for the website. ● Secure Socket Layer (SSL) is used in conjunction with HTTPS to create a secure tunnel from
end user to end user. This will be used in our network to help keep website data secure. ● Transmission Control Protocol/Internet Protocol (TCP/IP) is how most packets are formed to
traverse the network.
27
● File Transfer Protocol (FTP) (Ports 20 and 21) is used to transfer files. We will be using this
extensively on our servers to transfer files to and from them. There are secure options for
FTP that include File Transfer Protocol Secure (FTPS) (Port 21 and 22) and Secure File Transfer
Protocol (SFTP) (Port 21 and 22). FTPS uses SSL for its encryption and security whereas SFTP
uses SSH. We will be using SFTP to allow users to write and read files from the file servers. ● Hyper Text Transfer Protocol (HTTP) (Port 80) is a way of exchanging web content between
browsers. Hyper Text Transfer Protocol (HTTPS) (Port 443) is a way of exchanging web
content between browsers but in a secure manner, often using SSL. This will be used on all
PC’s using a web browser. ● Secure Copy Protocol (SCP) (Port 22) is a way to transfer files securely from a file server
through SSH.● Internet Control Message Protocol (ICMP) is a way of sending error messages and other
types of messages over the network. The traceroute and ping utility also makes use of ICMP.
We will use this in our network to monitor and diagnose problems. ● Internet Protocol version 4 (IPv4) is the most common protocol in networking. We will be
using this in our network as it is easy to read and manage. However Internet Protocol version
6 is an ever growing standard which may be worth considering to futureproof the network.
These are going to be the mostly used protocols on the network, along with their port numbers. Well
known ports are usually 0-1023. Ports after that and ranging to 41,951 are registered ports. Then
ports ranging to 65,535 are dynamic/private/unregistered. We will be blocking all ports apart from
the ones we have be using by the explicit deny any/any command in our firewall and if TechRep
would like specified ports unblocked we can do that easily.
2.1.5 Implementing wireless network in a secure mannerA more in depth look at wireless in general is discussed earlier. Wired Equivalent Privacy (WEP) was
the first type of security for wireless and which aim was to bring some level of basic security. WEP
was released in 1997 and the security derived from the security of its wired counterparts, giving its
name. Since it is so old, it is now considered deprecated and too easy to break, therefore we will not
be using WEP to secure out wireless network. It is now superseded by WPA.
Wireless Protected Access (WPA) was the next iteration of security made for wireless networks. WPA
introduces multiple means of authentication accommodating to different deployment types. WPA-
Pre-shared key (WPA-PSK) is a mode of authentication used by homes and small offices that makes
use of a password to join the network. Normal WPA mode is used in conjunction with a third party
authentication server such as a RADIUS server. This requires a valid username and password on the
server. For its encryption, WPA uses Temporal Key Integrity Protocol (TKIP) meaning it generates a
128-bit key per each packet. WPA was also superseded by WPA2 with a stronger encryption
algorithm.
Wireless Protected Access 2 (WPA2) is the successor to WPA bringing with it stronger encryption
algorithms. WPA incorporates the Advanced Encryption Standard (AES) as part of its security. This
ensures the passwords in the pre-shared key are securely parsed and exchanged. AES-256 is the most
common type of encryption with WPA currently, however AES-512 is starting to be used more often.
28
The type of security we will be implementing in the network is WPA2 with AES-256 using a RADIUS
server linked to our active directory server, so users will have a seamless use of both the desktop
PC’s, and the Bring Your Own Device plan provided by the wireless network.
We will not be disabling the SSID broadcast as to more easily allow employees to connect, however
the placement and arrangement of the antennas will be installed in such a way that will try to
eliminate interference with other businesses nearby.
2.1.6 Threats and Vulnerabilities
2.1.6.1 Common malware
Adware is the least dangerous type of malware, as it just injects ads onto your computer, these are
fairly easy to remove providing a reputable anti-malware program is installed.
Spyware is malware that spies on you and can be disastrous to a business as it can track internet
activities and sensitive information such as billing and sales.
Viruses are programs that are spread from user to user often through emails or messages, and
replicates itself when executed. Viruses often slow down or destroy the host computer if not dealt
with.
Worms is very much like a virus, however these often have a more malicious intent such as deleting
or corrupting files.
Trojans are the most dangerous type of malware. They often present themselves as innocent
programs that will then run a malicious program in the background such as consuming system
resources.
For these reasons we will be implementing user account controls and installing an anti-malware
program such as MalwareBytes or Sophos.
2.1.6.2 Types of attacksPhishing attacks are when a legitimate looking request for some type of data is sent to an
employee. These requests often pose as official correspondence from companies such as banks and
will be asking you to verify details to do with money or personal information. They are often sent via
email and can look very convincing so the proper training in ways to spot a phishing attempt is
valuable. Things to look out for are valid SSL/HTTPS certificates
A Denial of Service (DoS) is an attack that objective is to disrupt normal service as much as
possible. These attacks can be done in many different ways but the goal is the same. A very popular
way of a DoS attack is by sending a huge amount of traffic requests to your network. A form this can
take is a Distributed Denial of Service (DDoS) which is very similar to a DoS, but using multiple
computers to send traffic. Usually attackers do not target smaller companies, however the Cisco
Meraki MX100 still comes with a basic prevention system.
Man In the Middle attacks often occur on wireless networks, usually if they have been able to gain
access to the network and have maliciously made themselves a ghost router, so that all traffic is now
sent to them before it is sent to the real router. They can then inspect packets for information to
steal. As we will be using RADIUS for our authentication, this should not be an issue.
29
Rogue Access Points are third party access points that do not belong in the company Network.
They often have the same SSID as the legitimate network and so users can connect to it without
knowing it is not the real network. If they have already joined the legitimate network through
RADIUS, device should automatically connect to the legitimate one. If it is the first time the device is
trying to connect to the network, and they try to connect through the rogue access point, the
request to the RADIUS server will fail due to invalid credentials.
Zero-day attacks are very hard to protect against as they are bugs in code of software or firmware
that have been found and exploited so that attackers can use the bugs maliciously. The best way to
prevent these are just to always keep software up to date whenever possible.
Flash cookies are pieces of data stored on your computer which websites use to make the website
easier to use more personalised. However flash has been known to contain lots of exploitable code,
and for this reason we will be blocking flash on the end user PC’s, only allowing the use of HTML5.
Browser add-ons can contain malicious code if not validated correctly. For this reason we will only
be allowing add-ons from official sources such as the Chrome Web Store and Mozilla's add-ons for
Firefox.
2.1.6.3 Mitigation and Deterrent techniquesEvent logs are generated usually on the host Operating System, showing events that have occurred
such as new software installs. These show if the system has been compromised.
Audit logs are very similar to event logs however they are usually listening for one thing, such as
updates on the Operating System or USB driver installs.
Security logs are like event and audit logs, but focused on security. These can include changes or
updates to the PC’s firewall, and downloads from the internet.
Access logs are logs that show who (Active directory user) accessed what (files and folder) at certain
times. These can be useful to diagnose who did what if something occurs.
The Network Intrusion Protection System is discussed above, this is used like auditing on the
network.
2.1.6.4 Penetration testing versus vulnerability scanningVulnerability scanning checks for vulnerabilities on your network such as open ports that could be
used to connect to the network without permission. A vulnerability can should be performed on the
network mostly to see if there are any issues. A vulnerability scan helps identify potential points of
access or exploitation on the network.
A penetration test actively tries to find exploits in your network. Penetration testing is often
performed by an independent team as to get a fresh look on the network, and to eliminate any
internal exploits. Whereas vulnerability scanning is detective, penetration testing tries to be
preventative.
30
2.1.7 Review Application, Data and Host SecurityApplication security is solved by always keeping applications up to date whenever possible. On
Windows, a program will let you know if an update is available, however these usually require
administrative privileges to change data on the install drive. On Linux all applications are updated
through a package manager such as Pacman or Apt, and do not require an immediate restart which
may be useful to deploy updates globally. The application we will be using for the accounting is call
GNUCash and can be installed on Arch Linux as shown:
$ sudo pacman -Sy yaourt$ yaourt -S gnucash
Another way to keep applications secure is to install them to a directory where normal users do not
have write/change permissions, only read, however some exceptions will have to be made for
programs that require write permissions to work. The operating system will update at the end of
each working day.
To keep the rest of the applications secure, and by extension the host computer secure, the ability to
install programs however will be restricted to power users only, such as directors and managers.
In terms of antivirus, if we are using Linux we do not require an anti-malware as most malware is
written for Windows, and any that are written for Linux, we will only be allowing software installs
from the package manager to make sure they are signed officially.
Physical security will be handled by a Kensington lock on both the PC and monitor. In the BIOS, all
USB ports will be disabled apart from the mouse and keyboard port. All data transfers should be
done via the file server.
Mobile device security will only apply to the wireless device network, and to secure it, users will not
be able to connect to the servers (file server etc.), but still use RADIUS as a form of authentication.
Backups will be done at the same time as updates. Updates will be downloaded, then backups to the
backup server on the file server, then updates are installed so if an update breaks anything, there is a
working backup with the update already downloaded.
We are planning on encrypting the drives on the server as that is where all the sensitive data is
stored. This means if the drives are stolen the information cannot be used. Linux Unified Key Setup
uses AES-256 so all data will be encrypted until the drive is mounted by system.
In terms of physical security for the server room, the servers, switches and router will all be stored in
a rack which is locked and only the director will have a key for. The room in which the rack is in will
also be locked.
2.1.8 Review Access control and identity managementActive Directory will be used as authentication for the desktop PC’s, this will ensure no unauthorized
users try and log onto the network. As for the wireless, RADIUS will be used to authenticate with
active directory to again ensure no unauthorised access is granted, however those devices on the
wireless network will not be allowed access to the servers as it is a Bring Your Own Device policy.
A Bluetooth device will be used as a second form of authentication[26]. The device will be paired to
the login of the user and will have to be nearby to unlock the account. The account will also lock if
the device moves too far away. The device can be the user's phone if they wish, this will possibly
31
increase the likelihood of users just not leaving the device nearby, or it can be a small keyring
attachment on a lanyard.
Log on times will also be applied to employees’ accounts so that attackers cannot use accounts
during non-working hours to gain access. The working times will be 0830 to 1830, and out with those
times, users will be logged off and not be able to log in.
The file server will be split up into two main areas; the active directory folder redirection, and a main
shared network drive. The active directory folder redirects will be where most of the data is stored so
it is structurally easy to read. The shared folder will be for public files and sharing between users. A
managers/directors account permission will need to be required to write to the shared folder,
however all users will have read/change permissions.
2.2 Testing the implemented solutionThe way we will be installing the network is asking the office we are working on to finish working
about an hour early and then installing parts bit by bit over a week, then the transition will happen
on the last day. Installing offices in stages will allow us to see if there is something wrong with the
solution before we start on the next two offices.
Network testing will involve testing the cables with a cable tester.
This will ensure the cables are working correctly when they are installed.
32
We will test random desktop PC’s to check they are part of the domain and the user accounts are
working with folder redirection. We will store some test files such as PDF’s and PNG’s on user
accounts to test folder redirection is working on not just saving it on the local machine.
The aggregated SFP+ links will be tested in both bonded mode and failover mode to ensure the links
can handle both modes. After testing we have discovered that the bonded mode will not give a huge
advantage over the single link, so the other link will be put into Active-backup mode to ensure the
users do not lose access to the servers.
Software testing will include downloading the applications from the Arch User Repository (AUR) [27]
and making sure they run properly by asking an employee to try and do some basic tasks.
Security testing will be done both in-house and we will also get independent security penetration
testers to test the security if the network. We also need to make sure all passwords meet a minimum
requirement. This means a minimum length of 8 characters, including uppercase, lowercase, a
number and a symbol. We will enable minimum and maximum age of 30 days and 90 days
accordingly.
To test the network performance we will transfer a number of large files such as videos from the file
server and end user PC and vice versa.
2.3 Managing the ProjectAccording to the project plan, everything went well, apart from the deliveries of one of the
shipments to the Glenrothes office was missed by three days and so we had to work on the Dundee
office that week then go back to the Glenrothes office when the delivery of switches had arrived.
Apart from this all tasks were met on time and as shown below, under budget.
Device name Device cost Number needed Total
Dell OptiPlex 7040 £652 (20 x 3) = 60 £39,120
Dell UltraSharp Monitor U2414H
£259 (20 x 3) = 60 £15,540
PC and Monitor Bundle
£911 (20 x 3) = 60 £54,660
Cisco 6945 Unified IP Phone
£138 (20 x 3) = 60 £8280
Brother HL-3170CDW Printer
£240 (6 x 3) = 18 £4320
Cisco Meraki MX100 £3000 (1 x 3) = 3 £9000
Ubiquiti ES-16-XG EdgeSwitch
£500 (1 x 3) = 3 £1500
Ubiquiti UniFi 48 port PoE Switch
£700 (3 x 3) = 9 £6300
SPF+ cables £10 (6 x 3) = 18 £180
33
SuperServer 6028U-TNR4T+
£2500 (1 x 3) = 3 £7500
Western Digital Red 4 TB NAS drives
£136 (12 x 3) = 36 £4896
ECC server memory £176 (2 x 3) = 6 £1056
Intel Xeon E5-1660 v4 £960 (2 x 3) = 6 £5760
APC Back-UPS 700
Watt
£115 (1 x 3) = 3 £345
Cat 6 Ethernet cable £150 (1 x 3) = 3 £300
Total cost £104,096
This was considerably under the budget of £750,000.
Any problems that arose from the first installation site, we were able to prevent against at the
coming sites after that. One such problems was the access to the file server was slow, and it was
discovered that the RAID configuration had not been applied properly, but after it had been applied,
normal speed and access was resumed.
Evaluation
3.1 Outline of the AssignmentThe project that was given to us by TechRep came with a project brief. This document contained all
the things TechRep wanted to be achieved by the end of the project. The original requirements laid
out my TechRep was to also include at least an 80% expansion in the next 5 years.
3.1.1 Growth and networkTechRep’s old network was outdated and needed upgrading badly. They are expected to grow up to
80% in 5 years’ time. However as the numbers of each office is around 18 or 19, we have decided to
include a projected 100% growth so that estimates will be rounded off. We have decided to acquire
new PC’s for each user as the existing ones would not hold up with the new network. This will ensure
that the PC’s will be fast enough for at least the next 5 years, if not more. The PC’s all come with
gigabit Ethernet which will be adequate for each user. To restrict the warehouse staff from accessing
social media sites we have decided to put in a program called OpenDNS on our router which will
dynamically filter out sites it thinks are social media, but it will only be applied to those on the
warehouse VLANs. The VLANs will be set up so that the normal office staff can access all sites,
34
however warehouse users will not be able to access social media sites. We have also bought IP
phones for each desk to connect through their PC connection, this means it will reduce the amount
of wiring needed to use IP phones. We will be replacing the single printer with a printer for each
department. It will be networked so that all users will be able to print at once (subject to a print
queue) without the need to print from one PC in the office. The managing director will also get a
printer for their personal use, and to stop others from printing to it, the printer permissions will be
restricted so that only the managing director login will be able to print to it.
3.1.2 Access to softwareUsers currently have Microsoft Office 2003, and we will be replacing it with LibreOffice 5 on the new
PC’s. This will allow for a more stable and faster working experience for each user. Sales ledger
software will be available to the sales staff with a program called GNUCash. This program also
includes sales tracking capabilities. Contact management will be included in the email client. The
sales manager will have access to website development software such as Vim or Emacs, however all-
inclusive solutions are also available. The purchasing staff will have access to purchase ledger
software, which is also included in GNUCash. Email facilities will be provided by Thunderbird, from
the email server. Thunderbird is a feature rich client with advanced and basic capabilities.
3.1.3 Security and restrictionsOne of the main things that TechRep wanted to address was the issue of Distributed Denial of Service
attacks. To address this we have implemented the Cisco Meraki MX100 which has a built in Intrusion
Prevention System (IPS) so that you can easily set up rules and block attackers easier and with less
hassle. Managers will require access to all files of the employees, including private files belonging to
persons in different departments. This has been achieved by distributing Active Directory hierarchical
permissions, so that each department head will be able to access those in their department, but not
anyone above them. Each user will have special permissions giving them access to certain files and
folders at different permissions. The warehouse staff will have restricted internet access to social
media sites, whereas the office staff will have full access. We will be using OpenDNS to restrict the
sites. OpenDNS will use a predetermined list of sites it thinks is classed as social media. These rules
can be changed dynamically so that if any problems are found they can be changed as necessary.
3.1.4 Access to servicesMembers of staff will have access to their own private file storage made available through Active
Directory. This file storage will be reflected across all sites through folder redirection and a Domain
Controller. This will allow for staff to move from location to location without needing to take their
files with them. This file storage will have permissions set through Active Directory as mentioned in
Security and Restrictions. This will be hierarchical so that managers and directors will have access in
the case of an emergency. Hosting of the web server will be handled by an online cloud storage
provider. In this instance we have decided to use Amazon Web Services, which will mean that there
will be next to no down time in the event of an outage at the offices. This is very achievable as it is
35
low cost and easy to manage from any computer.
For DNS we will be using the Google DNS servers so that there is less chance for failure if the servers
in the office go down. This will ensure some level or normal operation and will still be usable. Active
Directory will be used on our servers to serve employees with their logins, including usernames and
passwords, and with managing their file server storage options. DHCP will be handled by our router,
the Cisco Meraki MX100, this will serve all devices on wired and wireless apart from the server,
printers and wireless access points which will have a static IP address. Email has been achieved by
setting up an email service on the AD server, and an email client on the host PC’s, we will be using
Thunderbird. Email address’ will be used from the old system, and new email address’ will be based
off the employee's initial and surname @ techrep.co.uk. Backups will be used on site in a RAID 1
configuration on the same AD server. This will ensure failure of disks will not affect day to day
running of the company. Also since the Domain Controller reflects all changes to all other servers in
the company, these act as off-site backups.
3.2 Strengths and WeaknessesThis section will outline the strengths and weaknesses of the project outcome. A weakness we
encountered in the planning stage was that we did not account for all of the office space when
deciding on how many Wireless Access Point we needed to give good coverage for all of the office
and warehouse. The warehouse had a lot of obstacles in the building which provided less than
favourable interference with the access points, so to fix this we added another access point in both
the office and the warehouse so that good coverage was achieved throughout the buildings. We also
did not acquire the devices necessary for the 100% growth we put into our calculations. We only
bought the devices needed for the current members of staff, however we did keep in mind the
budget TechRep gave us and we purposely went well under budget so that TechRep can buy the
devices as needed. The devices we did not buy for the 100% growth include the end devices such as
the workstations and maybe perhaps the Wireless Access Points, however to avoid later unnecessary
upgrades in the future which would disrupt business working hours once again, we did intentionally
oversize the distribution layer of the network and the access layer of the network so that devices can
just be plugged into the network without the need for upgrades once again. The 3 access layer
switches per office allow a total of 144 Ethernet connections, all of which can be used to connect end
devices since we are using SFP+ to connect the access layer to the distribution layer. We recommend
to lockdown the unused ports for security reasons when not in use.
The modular design of the server we have chosen allows for hot-swappable drives, which means
since due to our RAID configuration, if you pull a drive out while the server is still running, the other
drives will be able to compensate, and if a replacement drive is added, the other drives will be able
to rebuild the data on the new drive. The way the server is set up will also allow for another to be
added if need be in the future if more storage is needed, however we do not recommend upgrading
the drive capacities unless really needed as the less drives there are, the higher chance there is for
one of them to fail. In the event of storage running out another server is preferred.
Another weakness we encountered while finishing up the install of the network is we did not account
company wide attacks in our network when choosing a backup solution, these are usually very rare
and the backup solution at present is good enough to provide a data recovery solution for most
common failure issues such as driver failure or other device failure.
36
3.3 RecommendationsTechRep has projected an 80% growth in their company over the next 5 years. Their current
employee numbers are 18-19 people per office, and so to make things easier we have accounted for
a 100% growth as well. So the total number for the offices combined are 60 employees, so we have
factored in an increase of up to 120 people. Since our company are only providing the installation of
the equipment, we will not be providing Long Term Support (LTS) of the running of the network, so it
is our advice to acquire some support package from a third party company. This will assure that any
issues that arise from the running of the network will be handled and fixed without hefty one-off
costs. However this is only if an abnormal issue arises, if the issue is to do with the devices, as long as
they are within warranty the Original Equipment Manufacturers (OEM’s) such as Cisco/Ubiquiti, then
they should be replaced/fixed with no extra charge.
Another recommendation I would make is that at some point, if after the 5 year upgrade projection,
another server could be added if space is becoming an issue on the server. An extra server could be
implemented easily by us if need be, and it would dramatically increase the storage capacity for your
employees, as well as the security of the servers as there is a lower chance of data being lost if it is
striped across multiple drives.
On last recommendation would be to implement some sort of off-site backup. Now with the Active
Directory Domain Controller in the main site, that synchronizes all the files on Active Directory with
folder redirection. This provides a backup of drive failure and per device failure (such as the server
failing) however it does not protect against company wide failure such as targeted attacks, physical
and digital. To mitigate this it would be advisable to get some sort of off-site backup such as Amazon
Glacier or Google Nearline, which provide a cheap (per GB used) plan for disaster recovery in the
event of a company wide failure.
It is also advisable to implement IPv6 at some point so that the network will be ready for full IPv6
support. This can be easily implemented on the local devices through DHCP, but will be harder to
achieve with the server communication through the VPN. For the future-proofing of the network
however, it is still highly advisable.
3.4 ModificationsDuring the project plan, the network was originally designed to have two Wireless Access Points, one
in the warehouse and one in the office. However we decided later on that an additional access point
was needed in each the office and warehouse. This was caught fairly early on and so it did not create
any disruptions. This reduced the amount of time needed later on in the project, and so kept the cost
down (so delivery was still the same as the others) and also the quality, so all the access points were
all the same model. Also during the development, when we were installing the network in the first
office, which was Edinburgh, the SFP+ cables had not arrived, so we could only install the main
network devices such as the switches and router, and then we moved onto the next office so that we
were not behind schedule. This mean we could then go back in the second week to install the SFP+
cables in the Edinburgh site. This was easily navigable as since we were doing the installation of the
hardware after office hours and not disconnecting the old network until the end of the install, the
37
new hardware could wait for the new cables without disrupting working hours. This slightly affected
the cost of the project as it meant we had to go back to the office to install the SFP+ cables when
initially we would have been able finish up and not need to go back, reducing fuel and transport
costs etc. The quality was not affected as the network was not completed and so was not under load
so could not experience quality of service. Time was slightly affected as we had to go back to
Edinburgh to install the cables.
3.5 Knowledge and skillsFrom designing and building this network I have gained some useful skills and built on others.
Designing and planning the network allowed me to research and gain insight into the networking
devices I was thinking of using. More time spent in the planning stage also allowed me to expand my
options for the later development stage. My skills in Cisco that I have gained over the past two years
doing my semesters one through four, granted me an easy insight into the devices I was to put to use
when I visited other vendor sites so I could recognise which features were needed in order to make
the network to the specifications I wanted, and that TechRep wanted. I have used and enhanced my
skills from doing project management before, and was able to make adjustments to the project plan
when problems arose. My personal experience with cloud computing systems such as Amazon Web
Services allowed me to recommend the use of cloud platforms for use in situations where systems
cannot go down and the other benefits that the cloud offers. My past background in troubleshooting
computers let me better analyse problems and implementing solutions to mitigate them before they
were a problem. The development stage also allowed me broaden my knowledge of areas I wouldn't
normally have to think about, such as a UPS to keep the server online. One area which I found
fascinating was learning how Active Directory handles folder redirection and also opened my eyes to
Domain Controllers, making me think in a different way and how I could make it work more
seamlessly with the rest of the equipment.
38
Bibliography[1] Potential Virtualization server
https://www.supermicro.nl/products/system/2U/6028/SYS-6028U-E1CNR4T_.cfm[2] Cost for virtualization server
http://www.broadberry.co.uk/superservers-supermicro-servers/sys-6028u-e1cnr4t-plus
[3] WD Red HDD’s
https://www.wdc.com/products/internal-storage/wd-red.html[4] Cost for WD Red HDD’s
https://www.amazon.co.uk/dp/B00EHBERSE/
[5] Seagate IronWolf HDD’s
http://www.seagate.com/gb/en/internal-hard-drives/hdd/ironwolf/[6] Cost for Seagate IronWolf HDD’s
https://www.amazon.co.uk/gp/product/B01LYHW9NI/
[7] Dell OptiPlex 7040
http://www.dell.com/uk/business/p/optiplex-7040-micro-desktop/pd?
oc=n016o7040mff&model_id=optiplex-7040-micro-desktop[8] Dell UltraSharp Monitor U2414H
http://www.dell.com/ed/business/p/dell-u2414h/pd
[9]Cisco 6945 Unified IP Phone
https://www.cisco.com/c/en/us/products/collaboration-endpoints/unified-ip-phone-
6945/index.html[10] Price for Cisco 6945 Unified IP Phone
https://www.pmctelecom.co.uk/cisco-6945-unified-ip-phone
[11] Brother HL-3170CDW Printer
https://www.brother.co.uk/printers/colour-laser-printers/hl3170cdw
[12] Cisco Meraki MX100 Firewall and VPN Router
https://meraki.cisco.com/products/appliances/mx100[13] Price for Cisco Meraki MX100
https://www.broadbandbuyer.co.uk/products/20238-meraki-mx100-hw/
39
[14] Ubiquiti ES-16-XG EdgeSwitch 16-Port switch
https://www.ubnt.com/edgemax/edgeswitch-16-xg/[15] Price for Ubiquiti ES-16-XG EdgeSwitch 16-Port switch
https://www.broadbandbuyer.co.uk/products/26485-ubiquiti-es-16-xg/
[16] Ubiquiti UniFi 48 port PoE Switch
https://www.ubnt.com/unifi-switching/unifi-switch-poe/[17] Price for Ubiquiti UniFi 48 port PoE Switch
https://www.broadbandbuyer.co.uk/products/21668-ubiquiti-us-48-500w-cloud/
[18] SPF+ cables
http://www.fs.com/products/30851.html
[19] SuperMicro SuperServer 6028U-TNR4T+ (Complete System Only)
https://www.supermicro.com/products/system/2u/6028/sys-6028u-tnr4t_.cfm
[20] ECC server memory
https://www.kingstonmemoryshop.co.uk/server/supermicro/supermicro-superserver-6028u-tnr4t-
super-x10dru-i-server/kingston-16gb-ddr4-2133mhz-reg-ecc-memory-ram-dimm-71556?
gclid=CjwKEAjw8OLGBRCklJalqKHzjQ0SJACP4BHr_Z1BpMuyGwGuusULQb87Eltk7IXlsxC0wWkcTCwrP
RoCrRbw_wcB
[21]Intel Xeon Processor E5-1660 v4
https://ark.intel.com/products/92985/Intel-Xeon-Processor-E5-1660-v4-20M-Cache-3_20-GHz
[22]APC Back-UPS 700 Watt
http://www.ebuyer.com/704438-apc-back-ups-700-watt-1400-va-230v-avr-iec-sockets-bx1400ui?
[23]Thunderbird spam filter
https://support.mozilla.org/t5/Basics/Thunderbird-and-Junk-Spam-Messages/ta-p/16272
[24]OpenDNS
https://www.opendns.com/[25]Use of OpenDNS on Cisco Meraki devices
https://meraki.cisco.com/lib/pdf/opendns_with_meraki_solution_guide.pdf
[26]BlueProximity Bluetooth software used for two-factor authentication on the PC’s
https://aur.archlinux.org/packages/blueproximity/
[27]Arch User Repository
https://aur.archlinux.org/
40