solution implementation - · pdf filespecifications of pci 2.0. cisco partnered with rsa,...

Cisco Compliance SolutioOL-27664-01

C H A P T E R4

Solution Implementation

OverviewCisco customers have asked Cisco to provide insight into how Cisco products can be used to address PCI DSS 2.0 requirements. To fully accomplish this goal, Cisco hired an auditor and went through the same process as organizations. To audit Cisco products for the capability to address compliance, they had to be installed and configured within a representative design.

This chapter demonstrates how the Cisco PCI solution was installed and configured to address the specifications of PCI 2.0. Cisco partnered with RSA, HyTrust, EMC, VCE, and Verizon Business to create a comprehensive design that reflected the framework and architectural principles discussed in earlier chapters.

The Cisco PCI solution was validated in the Cisco Lab in San Jose, California. The branches, data center, WAN, and Internet edge network infrastructures were built using Cisco best practice design guides, as represented by the Cisco enterprise architecture (http://www.cisco.com/go/designzone). The individual components were installed and configured to adhere to PCI 2.0 specifications. Verizon Business then conducted an assessment of the design and advised on remediation for specific configurations of individual components. After the remediation was complete, Verizon Business provided a detailed reference architecture report (see Appendix C, “Verizon Business Reference Architecture Report—Cisco PCI Solution.”)

Tip An architecture is a strategic structure for the consistent design, construction, and operation of systems to achieve a desired set of outcomes.

A design is a tactical implementation of an architectural strategy, using specific configurations of products to satisfy business requirements.

Chapter 3, “Solution Architecture,” describes the enterprise architecture with regards to compliance. This chapter demonstrates a design or, in other words, a specific implementation of components to achieve these principles. Various designs can result from the solution architecture. The design that was implemented is not intended to represent the only way that Cisco and partner products can be installed to address PCI. It is intended to provide an example showing how and what was used to achieve the principles described in Chapter 3, “Solution Architecture.”

4-1n for PCI DSS 2.0 Design and Implementation Guide

http://www.cisco.com/go/designzone

Infrastructure Infrastructure

Although every company has specific considerations that vary from this implementation, these designs and the configurations of the components in Appendix E, “Detailed Full Running Configurations,” provide an instructive example of what is needed to secure credit card data. Each component selected was audited for its capabilities, and that assessment is covered in the next chapter.

In each section, the reference architecture is shown with the corresponding design that was implemented and validated within the Cisco PCI laboratories. The full configurations of each individual component are available in Appendix E, “Detailed Full Running Configurations.”

InfrastructureThe infrastructure layer of the solution framework addresses the components such as routers, switches, firewalls, and security components, as shown in Figure 4-1.

Figure 4-1 Infrastructure Layer of the Solution Framework

The following sections describe the designs that were implemented from the reference architecture.

Figure 4-2 shows the enterprise-wide reference architecture.

Endpoints

Administration

Services

Infrastructure

• Point of sale: servers and applications • Voice: phones and contact center applications • Email: data loss prevention • Physical: surveillance and badge access

• Network: routers, switches, and wireless • Security: firewalls and intrusion detection

Branch | Data Center | Contact Center | Internet Edge

• Authentication • Management • Encryption • Monitoring

• Assess • Design • Implement • Audit

Endpoints

Administration

Services• Point of sale: servers and applications• Voice: phones and contact center applications• Email: data loss prevention• Physical: surveillance and badge access

• Authentication• Management• Encryption• Monitoring

• Assess• Design• Implement• Audit

2931

87

4-2Cisco Compliance Solution for PCI DSS 2.0 Design and Implementation Guide

OL-27664-01

Chapter 4 Solution Implementation Infrastructure

Figure 4-2 Enterprise-Wide Reference Architecture

Referencing the enterprise-wide architecture shown in Figure 4-2, the design shown in Figure 4-3 was created in the Cisco Lab.

QFP

QFP

QFP

QFP

Ecommerce/Internet Edge/Service Provider Edge(Demilitarized Zone)

2923

42

QFP

QFP

QFP

QFP

QFP

QFP

QFP

QFP

Partner Edge(Demilitarized Zone)

PublicInternetWAN

PartnerWAN

PrivateWAN Backstage

Locations

WAN Aggregation Layer

Data Center

Branches

Core Layer

Aggregation Layer

CorporateHQ

Mobile POS POS Manager PC IP Phone Surveillance

POS Server

www

Services Layer

Access Layer

Host/Server/Farm Layer and Storage

IP

QFPQFP


OL-27664-01


Figure 4-3 Cisco PCI Solution Lab Architecture

Note the following:

• Six branch designs were selected to represent Cisco and partner products.

• The data center consists of a single aggregation block based on the Data Center 3.0 architecture.

• The Internet edge is representative of both the e-commerce and partner edge for the purposes of validation.

The following sections describe this enterprise-wide design in more detail, and demonstrate what was implemented within the lab.

BranchesMultiple branch footprints were implemented that address a variety of business objectives. Each branch footprint section contains designs that were extracted from the reference architecture. Each design contains the following:

• Reference architecture

• Branch design

– Logical topology

– Addressing plan

– Components selected

IP IP

IP

MSE

www www

3750 3750

LargeBranch

MediumBranch

SmallBranch

MiniBranch

Managed ServiceBranch

ConvenienceBranch

Internet Edge Data Center

Access

Core

Service Aggregation

WAN Aggregation

Management Servers Application Servers

ServiceProviderInternet

DMZ Servers

DMZ

IronPortIronPort

Secure IDMobile Worker

ServiceProvider

Private WAN

2904

17


OL-27664-01


For component compliance functionality, see Chapter 5, “Component Assessment.”. For full device configurations, see Appendix E, “Detailed Full Running Configurations.”

Note Each of these branch designs includes a variety of components that can be interchangeably used between them, depending on business requirements. For validation purposes, it was not necessary to implement all possible components in each design.

Small Branch Architecture

The small branch network scenario, shown in Figure 4-4, meets the following design requirements:

• Branch size averages between 2000–6000 square feet

• Fewer than 25 devices requiring network connectivity

• Single router with firewall/IPS, integrated Ethernet switch, compact switch, and power-over-Ethernet (PoE)

• Preference for integrated services within fewer network components because of physical space requirements

• Wireless connectivity

Figure 4-4 Small Branch Architecture

CentralizedManagement

Servers

BranchWorker

PC

DataVLAN/WLAN

2931

95

MobilePoS

PoS CashRegister

PoS VLAN/WLAN

Cisco Integrated Services Router(IOS Security and Ethernet Switch)

PoSServer

InventoryManagement

Primary WANConnection

Cisco 802.11AGWLAN Access Point

Alternate WANConnection


OL-27664-01


The small branch reference architecture is a powerful platform for running an enterprise that requires simplicity and a compact form factor. This combination appeals to many formats that can include the following:

• Small branch—Specialty shops, discount businesses

• Mini branches—Fuel stations, mall outlet

• Convenience branches—Pop-up stores, health centers, mall kiosks

• Managed service provider branch—WAN access controlled by service provider

This network architecture is widely used and consolidates many services into fewer infrastructure components. The small branch also supports a variety of business application models because an integrated Ethernet switch supports high-speed LAN services. In addition, an integrated content engine supports centralized application optimization requirements such as Web Cache Communications Protocol (WCCP)-based caching, pre-positioning of data, local media streaming, and other application velocity services.

Advantages include the following:

• Lower cost per branch

• Fewer parts to spare

• Fewer software images to maintain

• Lower equipment maintenance costs

Limitations include the following:

• Decreased levels of network resilience

• Greater potential downtime because of single points of failure

Small Branch—Small Design

Figure 4-5 shows the small branch network design.


OL-27664-01


Figure 4-5 Small Branch Network Design

Components Selected

• Cisco 2921 Integrated Services Router (ISR)

• Cisco Catalyst 2960S 48-port PoE Switch

• Cisco Aironet 3502i Access Points

• Cisco Video Surveillance 4500 Series IP Cameras

• Cisco Physical Access Gateway

R-A2-SMALL-1

Small Branch IP Addressing

10.10.255.128/24

SRE1/0: 10.10.142.41/30

Cisco2921-VSECSRST/IPS/FWL0: 10.10.142.1/32

2923

49

Data Center

SimulatedPrivate

MPLS WAN

G0/3 G0/4 G0/5

G0/1

Stack

Stack

Branch Workstation10.10.128.82/24

HREAP

10.10.x.1for all vlans

Trun

kTr

unk

Voi

ce/D

ATA

CA

PW

AP

AIR-CAP3502IVLAN18:10.10.135.11/24Cisco7975

VLAN13:10.10.130.100/24

WS-C2960S-48FPD-LVLAN1000:10.10.143.11/24

WS-C2960S-48FPD-LSTACK


CIAC-GW-K910.10.137.201/24

CIVS-IPC-450010.10.137.101/24

CAPWAP

G0/0

G0/1

10.10.254.128/24

G0/1

10.10.128.0 255.255.240.0 Small Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) VLAN20 (Security Systems)(Future) (Future) (Future) (Future)Other- (Misc)R-A2-Small-1 Loop 0 (Future)(Future) (Future) (Future) VLAN 110 (SRE-SM)VLAN 111 (SRE-SM)VLAN1000 (Management)

10.10.128.0 /2410.10.129.0 /2410.10.130.0 /2410.10.131.0 /2410.10.132.0 /2410.10.133.0 /2410.10.134.0 /2410.10.135.0 /2410.10.136.0 /2410.10.137.0 /2410.10.138.0 /2410.10.139.0 /2410.10.140.0 /2410.10.141.0 /2410.10.142.0 /2410.10.142.1 /3210.10.142.16 /3010.10.142.20 /3010.10.142.24 /3010.10.142.28 /3010.10.142.32 /29 10.10.142.40 /3010.10.143.0 /24 S-A2-SMALL-1

S-A2-SMALL-2

MSE

WAAS/UCS-X

IP

IP

G0/2

Cisco9971VLAN13:

10.10.130.101/24

G0/4

G0/4


OL-27664-01


Small Branch—Mini Design

The mini branch represents an alternate design for the small branch architecture, using different components.

Figure 4-6 shows the mini branch network design.

Figure 4-6 Mini Branch Network Design

Components Selected


• Cisco Catalyst 2960 Switch

• Cisco Aironet 3502e Access Point

G0/0

R-A2-MINI-1

Mini Branch IP Addressing

10.10.255.144/24

CISCO1941WL0: 10.10.158.1/32

2923

50

Data Center

SimulatedPrivate

MPLS WAN

G0/2 G0/8

G0/8

G0/1


HREAP


Trun

kS

FP

-Fib

er T

runk

AIR-CAP3502EVLAN18:

10.10.151.11/24

WS-C2960G-8TC-LVLAN1000:10.10.159.11/24

G0/1

Trun

k

G0/1

10.10.144.0 255.255.240.0 Mini Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) (Future) (Future) (Future) (Future) (Future)Other- (Misc)R-A2-Mini-1 Loop 0 (Future)(Future) (Future) (Future) VLAN 110 (Wireless NM)VLAN 111 (WAE ManagementVLAN1000 (Management)

10.10.144.0 /2410.10.145.0 /2410.10.146.0 /2410.10.147.0 /2410.10.148.0 /2410.10.149.0 /2410.10.150.0 /2410.10.151.0 /2410.10.152.0 /2410.10.153.0 /2410.10.154.0 /2410.10.155.0 /2410.10.156.0 /2410.10.157.0 /2410.10.158.0 /2410.10.158.1 /3210.10.158.16 /3010.10.158.20 /3010.10.158.24 /3010.10.158.28 /3010.10.158.32 /29 10.10.158.40 /3010.10.159.0 /24

S-A2-MINI-1

WS-C2960-8TC-LVLAN1000:

10.10.159.12/24

S-A2-MINI-1

MSE


OL-27664-01


Small Branch—Convenience Design

The convenience branch represents an alternate design for the small branch architecture. Figure 4-7 shows the convenience branch network design.

Figure 4-7 Convenience Branch Network Design

Components Selected

• Cisco 891 Series Integrated Services Router (ISR)

• Cisco Catalyst 2960 Series Switch

• Cisco Aironet 1042N Access Point

R-A2-CONV-1

Convenience Branch IP Addressing

10.10.255.160/24

CISCO891W-AGNL0: 10.10.174.1/32

2923

51

Data Center

SimulatedPrivate

MPLS WAN

SimulatedPublic

Internet

F0/3 F0/2

F0/1


HREAP


DHCP

Trun

kTr

unk

AIR-CAP1042NVLAN18:

10.10.167.11/24

WS-C2960PD-8TT-LVLAN1000:10.10.175.11/24

CAPWAP

Fa0

Fa8

G0

10.10.160.0 255.255.240.0 Convenience Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) (Future) (Future) (Future) (Future) (Future)Other- (Misc)R-A2-Conv-1 Loop 0 (Future)(Future) (Future) (Future) (Future) (Future)VLAN1000 (Management)

10.10.160.0 /2410.10.161.0 /2410.10.162.0 /2410.10.163.0 /2410.10.164.0 /2410.10.165.0 /2410.10.166.0 /2410.10.167.0 /2410.10.168.0 /2410.10.169.0 /2410.10.170.0 /2410.10.171.0 /2410.10.172.0 /2410.10.173.0 /2410.10.174.0 /2410.10.174.1 /3210.10.174.16 /3010.10.174.20 /3010.10.174.24 /3010.10.174.28 /3010.10.174.32 /29 10.10.174.40 /3010.10.175.0 /24

S-A2-CONV-1

MSE


OL-27664-01


Small Branch—Managed Service Provider Design

The managed service provider branch represents an alternate design for the small branch architecture. Figure 4-8 shows the managed service provider network design.

Figure 4-8 Managed Service Provider Branch Network Design

Components Selected

• Cisco ASA 5510 Firewall with SSM-10

• Cisco Catalyst 3560E Switch

• Cisco Aironet 3502e Access Points

Managed Service Provider BranchIP Addressing

10.10.255.176/24

10.10.191.21

FW-A2-MSP-1ASA5515-X

2931

96

Data Center

SimulatedPrivate

MPLS WAN

G0/3 G0/2

G0/1


HREAP


Trun

kTr

unk

AIR-CAP3502EVLAN18:

10.10.183.11/24

WS-C2960S-PS-24VLAN1000:10.10.191.11/24

G0/1

G0/0

10.10.176.0 255.255.240.0 MSP Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) (Future) (Future) (Future) (Future) (Future)Other- (Misc)R-A2-MSP-1 Loop 0 SP to FW link (Future) (Future) (Future) (Future) (Future)VLAN1000 (Management)

10.10.176.0 /2410.10.177.0 /2410.10.178.0 /2410.10.179.0 /2410.10.180.0 /2410.10.181.0 /2410.10.182.0 /2410.10.183.0 /2410.10.184.0 /2410.10.185.0 /2410.10.186.0 /2410.10.187.0 /2410.10.188.0 /2410.10.189.0 /2410.10.190.0 /2410.10.190.1 /3210.10.190.16 /3010.10.190.20 /3010.10.190.24 /3010.10.190.28 /3010.10.190.32 /29 10.10.190.40 /3010.10.191.0 /24

S-A2-MSP-1

MSE

G0/11

M0/0


OL-27664-01


Medium Branch Architecture

The medium branch network scenario, shown in Figure 4-9, meets the following design requirements:

• Branch size averages between 6,000–18,000 square feet

• The physical size of the branch is smaller than a large branch, so a distribution layer of network switches is not required

• Number of devices connecting to the network averages 25–100 devices

• Redundant LAN and WAN infrastructures with firewall/IPS

• Wireless connectivity

Figure 4-9 Medium Branch Architecture

The medium branch reference architecture is designed for enterprise businesses that require network resilience and increased levels of application availability over the small branch architecture and its single-threaded, simple approach. As more mission-critical applications and services converge onto the IP infrastructure, network uptime and application availability are more important. The dual-router and dual-LAN switch design of the medium branch supports these requirements. Each of the Cisco ISR routers can run Cisco IOS Software security services and other branch communication services

BranchWorker

PC

DataVLAN/WLAN

MobilePoS

PoS CashRegister

PoS VLAN/WLAN

PoSServer Inventory

Management

2923

53

Partner Devicefor InventoryManagement

Personal Shopper/PDA for EnhancedCustomer Service

Cisco ISR(WLC and WAAS)

Cisco ISR IOS(VSOM/VSMS and UCS-X)

Vendor/GuestWVLAN

Cisco 802.11a/b/gWLAN Access Points

ManagementVLAN

Catalyst Switches(Power over Ethernet and Security)


Servers




OL-27664-01


simultaneously. Each of the Cisco ISR routers is connected to a dedicated WAN connection. Hot Standby Routing Protocol (HSRP) is used to ensure network resilience in the event that the network connection fails.

The access layer of the network offers enhanced levels of flexibility and more access ports compared to the small branch. Up to 12 wireless access points can be installed in the branch, supported by the Cisco Wireless Control System (WCS) controller as tested and without adding more controllers. The distributed Cisco Catalyst switches can support a combination of larger physical buildings or a larger number of endpoints than the small branch.


• More adaptive access layer with support for a greater number of endpoints and more diverse building requirements (multiple floors, sub-areas, and so on)

• Improved network resilience through parallel device design

• Improved network and application availability through parallel paths


• No distribution layer between core layer (the ISR) and the access layer switches

• Single WCS Controller decreases in-branch resilience of the wireless network; the recommendation is to have branch APs fallback to the central WCS controller if the local WCS controller fails, or to install dual-local WCS controllers.


OL-27664-01


Medium Branch—Design

Figure 4-10 shows the medium branch network design.

Figure 4-10 Medium Branch Network Design

Components Selected


• Cisco Catalyst 3750X 48-port PoE Switch

• Cisco Catalyst 2960 Compact Switch

• Cisco Aironet 3502e and 1262N Access Points

• Cisco Video Surveillance 2421 IP Dome Camera

• Cisco Video Surveillance 2500 Series IP Camera

• Cisco Operations Manager v4.1


S-A2-MED-1

S-A2-MED-3

S-A2-MED-2

2923

54

G20/1G20/2G1/0/1

G1/0/3

G1/0/4 G1/0/6

G10/2

Stack StackWS-C3750X-48PF-SSTACK

AIR-LAP1262N10.10.119.11/24

WS-C3750X-48PF-SVLAN1000:

10.10.127.11/24

WS-C2960CPD-8PT-LVLAN1000:

10.10.127.13/24

Voi

ce/D

ata


Cisco797510.10.114.100/24

IP

Cisco997110.10.114.101/24

IP

G1/0/5

CIVS-IPC-450010.10.121.101/24 CIVS-IPC-2421

10.10.121.102/24

CIVS-IPC-2500W10.10.121.103/24

CIVS-IPC-2530V10.10.121.105/24

CIVS-IPC-242110.10.121.104/24

CIAC-GW-K910.10.105.201/24

CA

PW

AP

Tru

nk

CA

PW

AP

Tru

nk

AIR-CAP3502I10.10.135.12/24

CISCO2951-VSECSRST/IPS/FW

L0: 10.10.126.1/32

CISCO2951-VSECSRST/IPS/FWL0: 10.10.126.2/32

R-A2-MED-1 R-A2-MED-2

10.10.254.112/2410.10.255.112/24

G0/0

G0/1 G0/2 G0/2 G0/1

G0/0

Data Center

SimulatedPrivate

MPLS WANCIAC-PAME

Medium Branch IP Addressing10.10.112.0 255.255.240.0 Medium Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) VLAN20 (Security Systems)(Future) (Future) (Future) (Future)Other- (Misc)R-A2-MED-1 Loop 0 R-A2-MED-2 Loop 0(Future)(Future) VLAN101 (Router Link)VLAN102 (Router Link)VLAN 110 (SRE-SM)VLAN 111 (SRE-SM)VLAN 112 (SRE-SM)VLAN 113 (SRE-SM)VLAN1000 (Management)

10.10.112.0 /2410.10.113.0 /2410.10.114.0 /2410.10.115.0 /2410.10.116.0 /2410.10.117.0 /2410.10.118.0 /2410.10.119.0 /2410.10.120.0 /2410.10.121.0 /2410.10.122.0 /2410.10.123.0 /2410.10.124.0 /2410.10.125.0 /2410.10.126.0 /2410.10.126.1 /3210.10.126.2 /3210.10.126.16 /3010.10.126.20 /3010.10.126.24 /3010.10.126.28 /3010.10.126.32 /29 10.10.126.40 /3010.10.126.44 /3010.10.126.48 /3010.10.127.0 /24

Trun

k

Trun

k

Trun

k

SRE2/0: 10.10.126.41/30

NME1/0: 10.10.126.33/30

WAAS

WLC

SRE2/0: 10.10.126.50/30

SRE1/0: 10.10.126.45/30

UCS-X

VSOM/VSMS

G1/0/7 G2/0/12

G2/0/13

G2/0/14

G2/0/15


OL-27664-01


Large Branch Architecture

The large branch network scenario, shown in Figure 4-11, meets the following design requirements:

• Branch size averages between 15,000–150,000 square feet

• More than 100 devices per branch requiring network connectivity

• Multiple routers with firewall/IPS for primary and backup network requirements

• Preference for a combination of network services distributed within the branch to meet resilience and application availability requirements

• Tiered network architecture within the branch; distribution layer switches are employed between the central network services core and the access layer connecting to the network endpoints (POS, wireless APs, servers)

Figure 4-11 Large Branch Architecture

MobilePoS


Servers

2923

61

InventoryManagement

Personal Shopper/PDA Customer

Service

Data VLAN/ WVLAN

Vendor/GuestWVLAN

Cisco 802.11a/b/gWLAN Access Points

WirelessControllers

ManagementVLAN


Cisco ISRs(IOS Security)

BranchWorker

PC

PoS

PoS VLAN/WLAN

PoSServer

Catalyst Switches(Distribution and Access)

Vendor Devicefor InventoryManagement



OL-27664-01


The large branch reference architecture takes some of the elements of Cisco campus network architecture recommendations and adapts them to a large branch environment. Network traffic can be better segmented (logically and physically) to meet business requirements. The distribution layer of the large branch architecture can greatly improve LAN performance while offering enhanced physical media connections (that is, fiber and copper for connection to remote access layer switches and wireless access points). A larger number of endpoints can be added to the network to meet business requirements. This type of architecture is widely used by large format organizations globally. Dual routers and distribution layer media flexibility greatly improve network serviceability because the network is highly available and scales to support the large branch requirements. Routine maintenance and upgrades can be scheduled and performed more frequently or during normal business hours because of parallel path design.


• Highest network resilience based on highly available design

• Port density and fiber density for large locations

• Increase segmentation of traffic

• Scalable to accommodate shifting requirements in large branches


• Higher cost because of network resilience based on highly available design

• These branch network designs are capable of helping an organization achieve PCI compliance, and also serve as the scalable platform for new services and applications


OL-27664-01


Large Branch Design

Figure 4-12 shows the large branch network design.

Figure 4-12 Large Branch Network Design

Components Selected


• Cisco Catalyst 3560X and 4500 switches

• Cisco Aironet 3502e and 3502i Access Points

• Cisco 5508 Wireless Controller

• Cisco 4500 Video Surveillance Camera


CISCO3945-VSECSRST/IPS/FW

L0: 10.10.110.1/32

CISCO3945-VSECSRST/IPS/FWL0: 10.10.110.2/32

R-A2-LRG-1 R-A2-LRG-2

S-A2-LRG-3 S-A2-LRG-4

S-A2-LRG-1 S-A2-LRG-2

G0/1.101:10.10.110.25/30

10.10.254.96/2410.10.255.96/24

G0/0.102:10.10.110.30/30

WS-4507R10.10.111.12/24

WAVE-A2-LRG-1WAVE547

10.10.104.150/24MSP-A2-LRG-1

CPS-MSP-1RU-K910.10.105.11

2923

55

G6/45

G0/2

G0/0 G0/1 G0/0 G0/1

G0/2

G6/47G6/47 G6/45

G2/3 G6/10 G2G6/18

G6/1 G1G6/17

G6/43

G0/2G0/1G0/1

G0/25

G0/2

G6/41G6/43G6/41

Data Center

SimulatedPrivate

MPLS WANCIAC-PAME

WS-4507R10.10.111.11/24

WS-C3560X-48PF-S10.10.111.14/24

WS-C3560CPD10.10.111.15/24

WS-C3560X-48PF-S10.10.111.13/24

WLC-A2-LRG-1AIR-CT5508-12-K9G1:10.10.103.10/24G2:Trunk Vlan14-17

G6/10G2 G6/18

G6/1G1 G6/17

G6/43G6/41


Voi

ce/D

ATA

Cisco7975VLAN13:

10.10.98.100

Branch Server VM10.10.96.81/24

UCS-C200SRV-A2-LRG-01 – ESXi

IP

Cisco9971VLAN13:

10.10.98.101

IP

G0/4 G0/6

CIAC-GW-K910.10.105.201/24

CIVS-IPC-450010.10.105.101/24

G0/5 G0/4 G0/7G0/3G0/11

AIR-CAP3502E10.10.103.11/24

AIR-CAP3502I10.10.135.12/24

Large Branch IP Addressing10.10.96.0 255.255.240.0 Large Branch Aisle 2

VLAN11 (POS)VLAN12 (Data)VLAN13 (Voice)VLAN14 (Wireless)VLAN15 (Wireless POS)VLAN16 (Partner)VLAN17 (Wireless Guest)VLAN18 (Wireless Control)VLAN19 (WAE) VLAN20 (Security Systems)(Future) (Future) (Future) (Future)Other- (Misc)R-A2-LRG-1 Loop 0 R-A2-LRG-2 Loop 0(Future)(Future) VLAN101 (Router Link)VLAN102 (Router Link)VLAN 110 (SRE)VLAN 111 (WAE Management)VLAN1000 (Management)

10.10.96.0 /2410.10.97.0 /2410.10.98.0 /2410.10.99.0 /2410.10.100.0 /2410.10.101.0 /2410.10.102.0 /2410.10.103.0 /2410.10.104.0 /2410.10.105.0 /2410.10.106.0 /2410.10.107.0 /2410.10.108.0 /2410.10.109.0 /2410.10.110.0 /2410.10.110.1 /3210.10.110.2 /3210.10.110.16 /3010.10.110.20 /3010.10.110.24 /3010.10.110.28 /3010.10.110.32 /29 10.10.110.40 /3010.10.111.0 /24


OL-27664-01


Data CenterThe data center is where centralized data processing, data storage, and data communications take place (see Figure 4-13). The data center is also the place where management systems are deployed. The data center provides centralized control from an administrative perspective because it is typically where the tools that are used to monitor and enforce compliance are deployed.

Figure 4-13 Data Center Architecture

Design considerations are as follows:

• Centralized solution management supports all aspects of network, security, and systems management; and supports remote access from anywhere on the network.

• Standardized equipment and software images, deployed in a modular, layered approach, simplify configuration management and increase the systems availability.

• The highly available data center design permits highly resilient access from branches to core data and storage services.

• WAN aggregation alternatives allow flexible selection of service provider network offerings.

• The service aggregation design allows for a modular approach to adding new access layers and managing shared network services (for example, firewall, IPS, application networking, wireless management)

Branches

QFP

QFP

QFP

QFP

Ecommerce/Internet Edge/Service Provider Edge(Demilitarized Zone)

2931

94

QFP

QFP

QFP

QFP

QFP

QFP

QFP

QFP

Partner Edge(Demilitarized Zone)

PublicInternetWAN

PartnerWAN

PrivateWAN Backstage

Locations

WAN Aggregation Layer

Data Center

Core Layer

Applications

Aggregation Layer

CorporateHQ

www

Services Layer

Access Layer

Host/Server/Farm Layer and Storage

CiscoNAC/ISE

CiscoACS

CiscoPrime LMS

RSAenVision

RSAKey Manager

HyTrustAppliance

NTP DNS ActiveDirectory

CiscoSecurityManager

CiscoWCS

Cisco VoiceSolutions

InfrastructureServicesRSA

ArcherRSA

AuthenticationManager

VMwarevSphere

CVP

ICM

CC

M

QFPQFP


OL-27664-01


• Firewall, IPS, and application networking services are available at the service and aggregation layers of the data center.

• Scalability to accommodate shifting requirements in data center compute and storage requirements.

• WAN access speeds are typically the limiting factor between the branch network systems and the WAN aggregation layer.

• It is typical for organizations to over-subscribe the WAN circuits between the branches and the WAN edge aggregation router. Over-subscription can cause inconsistent results and packet loss of payment card information in the event that more traffic enters the WAN circuit simultaneously.

• Backup network connections from branch networks to the data center are recommended when payment card information is transported via the WAN.

Figure 4-14 shows the data center design.

Figure 4-14 Data Center Design

Data centers can house many types of functions and the term itself can encompass narrow and broad aspects. For the purposes of this guide, data centers include the following functions:

• WAN aggregation layer—Aggregates the branch and backstage WAN connections to the core

• Core layer—Highly available, high-speed area that is the central point of connectivity to all data center areas

• Aggregation block—Aggregates the services of one area and connects that area to the core, including Vblock1 design

• Internet edge—Secure connectivity to the Internet

MSE

www www

3750 3750

Internet Edge Data Center

Access

Core

Service Aggregation

WAN Aggregation

Management Servers Application Servers

DMZ Servers

DMZ

IronPortIronPort

2914

79


OL-27664-01


WAN Aggregation Layer Design

Figure 4-15 shows the WAN aggregation layer design.

Figure 4-15 WAN Aggregation Layer Design

Components Selected

• Cisco ASR 1002-Fixed Router

• Cisco ASA 5540 Adaptive Security Appliance

• Cisco Catalyst 3750X Switch

HSRP192.168.11.1/24

2931

97

G0/0/0

G1/0/1 G2/0/1

G1/0/2 G2/0/2

G1/0/2 G2/0/2

G1/0/11 G2/0/11

G2/0/1 G1/0/1

G0/0/0

G0/0 G0/0

G0/1

G0/3 G0/3

M0/0 M0/0G0/1

G0/0/2 G0/0/2

192.168.11.2

192.16.11.24192.16.11.23

192.168.11.3

10.10.1.6 10.10.2.6

Failover-link

WAN Aggregation

RWAN-1

ASA-WAN-1192.168.11.20(21)Transparent-mode

SWAN-1(2)192.168.11.14 /24

SWAN-3(4)192.168.11.13/24

RWAN-2

ASA-WAN-2Standby

Service ProviderSimulated Private MPLS Cloud

Branches


OL-27664-01


Core Layer Design

Figure 4-16 shows the core layer design.

Figure 4-16 Core Layer Design

Components Selected

• Cisco Catalyst 6500-E Switch

2914

81

T2/3-4 T2/3-4

G1/1 G1/1

192.168.11.11 192.168.11.12

192.168.10.29/30 192.168.10.29/30

HSRP192.168.11.10

Core Layer

RCORE-1L0: 192.168.1.1/32

RCORE-2L0: 192.168.1.2/32


OL-27664-01


Aggregation Block Design

Figure 4-17 shows the aggregation block design.

Figure 4-17 Aggregation Block Design

Components Selected

• Cisco ASA 5585-X Adaptive Security Appliance

• Cisco Nexus 7010 Switch


– Cisco ACE 20

– Cisco IDSM-2

• Cisco Nexus 5020 Switch

• Cisco Catalyst 4948 Switch

T1/29-32

T2/3-4 T2/3-4

T1/29-32

T1/21-24

T1/11-12T1/9-10T1/6&8T1/2&4

E2/1-2 E2/3-4 E2/1-2 E2/3-4 E1/33-34 E1/35-36 E1/35-36 E1/33-34 G1/0/48 G1/0/47

T1/14

T1/18

T1/17

T1/1 T1/2 T1/1 T1/2

T2/6

T2/5

T2/2

T2/1

T2/6

T2/5

T2/2

T2/1T1/16

T1/15

T1/20

T1/19

T1/18

T1/17

T1/16

T1/15

T1/20

T1/19

T1/7

T1/5

G2/3

G2/1

T1/7

T1/5

G2/3

G2/1

G0/1

G0/0

T0/7

T1/1 T1/3 T1/1 T1/3

T2/1 T2/2 T2/1 T2/2

T0/6

G0/1

G0/0

T0/7

T0/6

T0/9

T0/8

T0/9

T0/8

T1/13 T1/11-12T1/9-10T1/6&8T1/2&4 T1/14T1/13

G2/14

G2/13 G2/13

G2/14

T1/21-24

vPC99

VDC-1L0: 192.168.1.11

Ports:T1/1-8, 25-32, G2/1-12

VDC-1L0: 192.168.1.12

Ports:T1/1-8, 25-32, G2/1-12

T1/1-9-24

PC-111 PC-112 PC-1 PC-2 PC-3 PC-4

T1/1-9-24

VDC-2L0: 192.168.1.31

VDC-2L0: 192.168.1.32

VLAN 172 = State VLANVLAN 171 = Failover VLAN

VLAN 172 = State VLANVLAN 171 = Failover VLAN

192.168.42.39

Active/ActiveService Chassis

Design

Active/ActiveService Chassis

Design

VLAN152

VLAN154

VLAN164,42,804

VLAN172

VLAN171

VLAN162

VLAN162

VLAN152

VLAN152

VLAN151

VLAN161

VLAN42,164,803VLAN154

VLAN172

VLAN171

VLAN162

VLAN152

VLAN162VLAN152

VLAN151

VLAN161

VLAN154VLAN162

VLAN164

VLAN163 VLAN156

Access Layer

Core Layer

Services LayerServices Layer

Aggregation Layer

PC99

PC99

L3

F-UCS-1Fabric-6120

192.168.42.41

F-UCS-2Fabric-6120

192.168.42.42

SACCESS-1Catalyst 3750-X192.168.42.33


SACCESS-3Nexus 5020

M: 192.168.42.31

SACCESS-4Nexus 5020

M: 192.168.42.32


RSERV-2L0: 192.168.1.22/32

RSERV-1L0: 192.168.1.22/32

ACE20

VDC-2

VDC-1

VDC-2

VDC-1

IDSM2

192.168.42.38

ACE20

IDSM2

RAGG-2Nexus7010

M0: 192.168.42.37

RAGG-1Nexus7010

M0: 192.168.42.36

RCORE-1Catalyst6509-E

L0: 192.168.1.1/32

RCORE-2Catalyst6509-E

L0: 192.168.1.2/32

ASA-DC-2ASA5585-X

M0: 192.168.42.22To SACCESS-5

G1/14

ASA-DC-1ASA5585-X

M0: 192.168.42.21To SACCESS-5

G1/13

192.168.10.26/30192.168.10.14/30

192.168.10.25/30192.168.10.13/30

192.168.10.18/30192.168.10.22/30

192.168.10.17/30

192.168.10.29/30 192.168.10.30/30

192.168.10.21/30

2931

98


OL-27664-01


Vblock Design

Figure 4-18 shows the Vblock design.

Figure 4-18 Vblock Design

Components Selected

• Cisco UCS 5108 Blade Server Chassis

– Cisco UCS B200 Blade Server

• Cisco UCS 6120 Fabric Interconnect

• Cisco MDS 9506 Multilayer Director

• EMC CLARiion CX4 Model 240

2904

20

E1/2&4 E1/6&8

G1/1 G1/1

192.168.41.40

F-UCS-CLUSTER

PC-11

vPC

Nexus 7010RAGG-1

Nexus 7010RAGG-2

MDS 9506MDS-DC-1

192.168.41.51

MDS 9506MDS-DC-2

192.168.41.52

Fabric-6120F-UCS-1

192.168.41.41

UCS 5108DC-UCS-1

UCS 5108DC-UCS-2

Fabric-6120F-UCS-2192.168.41.42

PC-111

E2/1-2

E1/9-12 E1/13-16

E2/3-4

E1/2&4 E1/6&8

PC-12

PC-112

PC-11PC-12

E1/2&4

TG1/29-32 TG1/29-32

L1-L2

E1/1-4Left

E1/1-4Right

E1/1-4Right

E1/1-4Left

A2

2/36

2/362/122/12

2/252/25

2/262/262/24

2/482/48

F1F2 B2 A3 B3 A2 B2 A3 B3

F1

F2

2/24

E1/2&4

E1/9-12 E1/13-16

L1-L2


OL-27664-01


Internet Edge Design

Figure 4-19 shows the Internet edge network design.

Figure 4-19 Internet Edge Network Design

Components Selected

• Cisco 7200 Series Router


– Cisco ACE 20

– Cisco IDSM-2

• Cisco Catalyst 3750X Switch

• Cisco MDS 9204i Switch

• Cisco IronPort C670

2932

82

MTG

AGN

AggregationBGP Community

RAN RegionBGP Community

RAN RegionBGP Community

iBGPIPv4+label

iBGPIPv4+label

AggregationBGP Community

iBGPIPv4+label MPC

BGPCommunity

CN-ABR

CN-ABR

CN-ABR

CN-ABR

PAN

CN-RR

PAN

AGN

AGN AGN

RR

iBGP Hierarchical LSP

LDP LSP LDP LSP LDP LSP

RANTDM/PacketMicrowave

FAN

CSG

AccessIP/Ethernet


OL-27664-01


Addressing and Routing Disclosure

PCI requirement 1.3.8 states that merchants must not disclose private addressing and routing information. An enterprise contains two segments:

• Public—Where Internet services are hosted

• Private—Where internal systems reside that are not directly accessible from outside the company

Both may be deployed internally within an enterprise data center or other PIN. The private information must be protected and not propagated out to untrusted parties.

In 2013, it is common for enterprises to deploy an IPv6 Internet presence by using the Server Load Balancing (SLB) to do protocol family translation; that is, when the SLB receives an IPv6 inbound connection from the Internet, the SLB translates this connection on the fly into an IPv4 connection to the real servers.

In this solution, PCI 1.3.8 was met because all the security pieces for IPv4 are also used for IPv6 connections. Moreover, the servers where the information resides have no IPv6 addresses and cannot be reached over IPv6. The attack surface of the servers is strictly the IPv4 attack surface.

Note For more information on the Cisco ACE Application Control Engine Module, see the following URL: http://www.cisco.com/en/US/products/ps6906/index.html.

A best practice when implementing IPv6 is a phased approach. Figure 4-20 illustrates the scenario described above as the first phase of an IPv6 deployment.


OL-27664-01

http://www.cisco.com/en/US/products/ps6906/index.html

Chapter 4 Solution Implementation Administration

Figure 4-20 IPv6 Phased Approach

Administration The administration layer of the solution framework addresses the components such as authentication, encryption, management, and monitoring, as shown in Figure 4-21.

293281

Core NodeCN-ABR

Core NodeCN-ABR

Core NodeCN-ABR

AggregationNode (AGN)


Core NodeCN-ABR

Core NetworkIP/MPLS Domain

Aggregation NetworkIP/MPLS Domain


FAN

CSGAggregationNode (AGN)

Aggregation Area/LevelOSPF x/IS-IS L1

Core Area/LevelOSPF 0/IS-IS L2

Single AS

Aggregation Area/LevelOSPF x/IS-IS L1

Pre-AggregationNode (PAN)

Pre-AggregationNode (PAN)

Aggregation NetworkIP/MPLS Domain

AccessIP/Ethernet

LDP LSP LDP LSP LDP LSP

RANTDM/PacketMicrowave


OL-27664-01

Administration Administration

Figure 4-21 Administration Layer of the Solution Framework

Authentication

Components Selected

• Cisco Secure Access Control Server (ACS)

• Cisco Identity Services Engine (ISE)

• RSA Authentication Manager

• Windows Active Directory

Encryption

Components Selected

• Cisco Security Manager

• Cisco Key Manager

• RSA Data Protection Manager

Management

Components Selected

• Cisco Prime LAN Management Solution (LMS)

Endpoints

Administration

Services

Infrastructure






2931

88

Endpoints Services

Infrastructure

• Point of sale: servers and applications• Voice: phones and contact center applications• Email: data loss prevention• Physical: surveillance and badge access

• Network: routers, switches, and wireless• Security: firewalls and intrusion detection




OL-27664-01

Chapter 4 Solution Implementation Endpoints

• Cisco Security Manager

• Cisco Wireless Control Server Manager

• EMC Unified Infrastructure Manager

• VMware vSphere vCenter

• Cisco Video Surveillance Manager

• Cisco Physical Access Manager

• RSA Archer

Monitoring

Components Selected

• RSA enVision

• HyTrust

EndpointsThe endpoints layer of the solution framework addresses the components such as voice, e-mail, and physical security, as shown in Figure 4-22.

Figure 4-22 Endpoints Layer of the PCI Solution Framework

Voice

Components Selected

• Cisco Unified Communications Manager

Endpoints

Administration

Services

Infrastructure






Administration

Services

Infrastructure • Network: routers, switches, and wireless• Security: firewalls and intrusion detection


• Authentication• Management• Encryption• Monitoring


2931

89


OL-27664-01

Endpoints Endpoints

• Cisco IP Phones (9971, 7975)

• Cisco Survivable Remote Site Telephony (SRST)

E-mail

Components Selected

• Cisco IronPort Email Security Appliance with Data Loss Prevention

• Microsoft Exchange Server 2008

Physical

Components Selected


• Cisco Video Surveillance Cameras (2421, 2500, 4500)

Note For a complete Bill of Materials, see Appendix A, “Bill Of Material.” For assessment of components selected for PCI compliance, see Chapter 5, “Component Assessment.” For complete running configurations of components, see Appendix E, “Detailed Full Running Configurations.”


OL-27664-01

Chapter 4 Solution Implementation PCI Solution Result Summary

PCI Solution Result Summary

Cisco Compliance Solution Components

Endpoints Primary PCI Function

Cisco IronPort Email Security DLP

Cisco Physical Access Control 9.1

Cisco UCS and UCS Express Servers

Cisco Unified CM and IP Phones 9.1.2

Cisco Video Surveillance 9.1.1

Administration Primary PCI Function

Cisco ACS 7.1

Cisco Identity Services Engine 7.1, 11.1b, 11.1d

Cisco Prime LMS 1.2.2

Cisco Security Manager 1.2

Hytrust Appliance 10.5

RSA Authentication Manager 8.3

RSA Data Protection Manager 3.5

RSA enVision 10.5

Infrastructure Primary PCI Function

Cisco ASA-Branch 1.3, 11.4

Cisco ASA-Data Center 1.3, 11.4

Cisco Branch Routers 1.3, 11.4

Cisco Branch Switches Segmentation

Cisco Data Center Routers 1.2, 1.3

Cisco Data Center Switches Segmentation

Cisco Data Center IDSM 11.4

Cisco MDS Switches 3.4

Cisco Nexus 1000V Series Switch Segmentation

Cisco Nexus Data Center Switches Segmentation

Cisco Nexus VSG Virtual Firewall

Cisco Wireless 4.1, 11.1

EMC CLARiioN SAN Storage

This solution combines components to create an end-to-end solution conforming to the requirements of the PCI 2.0 guidelines. The result is a set of branch, data center, and Internet edge architectures and designs that simplify the process of achieving and maintaining compliance.


OL-27664-01

PCI Solution Result Summary PCI Solution Result Summary


OL-27664-01

solution implementation - · pdf filespecifications of pci 2.0. cisco partnered with rsa,...

Documents