Reference no: EM132807647
Network Security - Case Study
Alpha Finance is a medium sized company that sells a wide range of finance and insurance policies in Southern England. It has a head office in Southampton and another office at Newbury. Network security is important to them. They want to implement a new secure network infrastructure at all offices.
The initial network design consists of a router at Newbury and two switches connected to two subnets for different user groups at the Newbury office. There is a single router at the Southampton office connected to a Cisco ASA appliance. The ASA connects to a switch serving a subnet for users in the Southampton office and another DMZ subnet connected to a web server.
They have the following general requirements:
1) Basic security must be configured on switches, routers and the ASA at both offices.
2) Administrative users must only be able to access the network devices using login names and passwords authorised by a central server.
3) Time on network devices must be synchronised and events logged on a central server.
4) The networks at both sites must be secured by access control lists and firewalls.
5) A secure encrypted link must be configured between the two sites.
6) Remote users must be able to connect to the internal network at Southampton.
Your task is to implement each of these requirements.
Instructions
Your task: please look at the Cisco chapter lab exercises. You will then be able to see how Alpha Finance requirements match up to each chapter. Then work your way through the exercises to implement a solution for the case study.
They have the following general requirements:
Router and Switches:
7) They want to configure a passwords for enable access and a local user for console access. They also want to enable ssh for remote access.
8) The Southampton router will act as an NTP server for the whole network and the network devices will use this to synchronise their clock.
9) They may want to configure a Syslog server on the network so that events from network devices can be logged.
10) IT staff having access to the routers (and switches) must only be allowed access privileges appropriate to their needs.
Study chapter 2 and use the chapter 2 labs for guidance.
11) In order to ensure the security of the administrative (network management) access to all routers, switches and ASAs at Newbury they want to use local AAA authentication on the router.
12) In order to ensure the security of the administrative (network management) access to all routers, switches and ASAs at the head office in Southampton they want to use AAA authentication (and authorization and accounting) using a RADIUS server.
Study chapter 3 and use the chapter 3 labs for guidance.
13) They want to configure a firewall on the Router at Newbury.
Study chapter 4 and use the chapter 4 labs for guidance.
14) They also want to configure an IPS on the Newbury Router.
(Chapter 5)
Study chapter 5 and use the chapter 5 labs for guidance.
15) They want to enable switch security on switches at both offices to mitigate LAN attacks.
(Chapter 6)
Study chapter 6 and use the chapter 6 labs for guidance.
10) They want to configure a VPN to link Southampton to Newbury between the router at Southampton and the Router at Newbury.
They also need to test this.
(Chapter 8)
Study chapter 8 and use the chapter 8 labs for guidance.
ASA:
11) They want to configure IP addresses on the ASA at Southampton.
12) They want three security zones on the ASA: outside, inside and a DMZ with appropriate
13) They want to access the ASA from ASDM - configure https access
14) On the ASA they want to configure Telnet access for computers on the inside network and ssh access for computer on the outside network.
Study chapter 9 and use the chapter 9 labs for guidance.
15) Access Control Lists (ACLs) must be configured on the ASA at Southampton as follows:
i) The DNS server must only be accessible to hosts on the Southampton and Newbury networks and to no other networks.
ii) The web server must only be accessible to any host on the Internet on port 80 (as it is in the DMZ) only hosts and devices on the Alpha network must have access to the DNS server in Southampton.
16) They want the ASA at Southampton to provide dynamic addresses to hosts on the Southampton LAN using DHCP.
17) On the ASA they also want to configure NAT or PAT so that computers on the inside network are hidden from the outside network
Study chapter 9 and 10 and use the chapter 9 and 10 labs for guidance.
IP Addressing Scheme
The ASA appliance and router interfaces must be configured with IP addresses as follows:
Table of IP addresses:
Southampton Router (R1):
S0/0/0 10.1.1.1 /30 clockrate 2000000
G0/0 209.165.200.225 /29
G0/1 194.27.5.1 /24 (to DNS server)
Southampton ASA:
G0/0 209.165.200.116 /29 (outside)
G0/2 192.168.2.1 /24 (dmz)
G0/1 192.168.1.1 /24 (inside) (also to AAA server)
Internet router (R2):
S0/0/0 10.1.1.2 /30
S0/0/1 10.2.2.2 /30 clockrate 2000000
Newbury router (R3):
S0/0/1 10.2.2.1 /30
G0/1 172.16.3.1 /24
G0/0 192.168.3.1 /24