University:
Boston University
Course:
GRS CS 910 | Directed Study: Systems
Academic year:

2021
Views:

358

Pages:

17
Author:

Gary Macdonald

Never Believe Prints… Library Structure RF-Hell… UMASS-Amherst Network Map University of Massachusetts Amherst Campus Network Layout Updated as of: 1/3/2002 = HSSI location:nss-stu/Network Map/campus-network.vsd Montague Furcolo Amherst Arnold Hampshire Hasbrouck Mt. Holyoke LGRC Smith Totman 2 OIT ISDN NSS 175 Admissions Baker Clark Brett Shade Tree Brooks Hasbrouck Apiary Fernald Butterfield C&W Internet LGRT UPN French Dickinson East Exp. Station C&W Internet Remote Access Child Care Grayson PC Field West Exp. Station UIS Dial Up-rt Cold Storage Health Services Gorman Project Trailer Hills Grayson Tilson Farm Hillside Greenough Mather Morrill IV Webster Nelson New Africa Wheeler Skinner Van Meter Border 2 C7507 = 10 Mb = 100 Mb HIGH SPEED Brown Remote Access = 1 Gb Cashin vBNS = DS3 Crabtree IPPM Hamlin Computer Science = HDSL = T1 Border 1 C7507 Johnson Lewis = OIT Controlled Network ACSO Thatcher LGRC - C6509 OIT 166 C5500 SOM Wilder Morrill NSM = Non-OIT Legacy Network Agric Eng. Bowditch = Non-OIT Network Academic Building Residential Building Chenoweth Morrill - C6509 Knowles - C6509 Draper Blaisdell Animal Care Flint Lab Dickinson Bartlett Hatch Lab Dubois Library Holdsworth Goodell Berkshire Paige Lab Machmer Farley Parking Services Memorial Hall PVTA Mullins Center Stockbridge Photo Lab Physical Plant Power Plant Marcus/Engineering South College Library - C6509 Whitmore - C6509 Boyden JQA Continuing Ed. Crampton PC Kennedy Curry Hicks Patterson PC MacKimmie FAC Hampden DC Patterson Hampshire House Berkshire DC Pierpont Herter Finance & Administration Hampshire DC Prince Munson OIT/South Hampden - C5500 Student Union Cance Thoreau Middlesex Registrar Thompson Coolidge Washington Robsham SARIS Campus Center Crampton ROTC OIT Telcom Emerson Tobin John Adams Whitmore C2924M Initial Design Goals Virtual Classroom We closed some labs due to budget constraints Wireless network is meant to reproduce similar function Focused at public areas where students gather Not initially a ‘campus-wide’ rollout Scalable Although initial rollout is targeted, design must fit campus-wide Initial Design Requirements Identification & Authentication We register all MAC addresses in Residence Halls Accountability Encryption Too many plaintext protocols still in use Card heterogeneity We don’t enforce a single vendor for wired network cards… This limited our set of solutions Initial Assumptions No pre-existing campus wireless implementation Some local deployments Netstumbler is your friend MAC address filtering doesn’t scale Based half on fact Didn’t feel ‘right’ WEP alone is likely insufficient WEP Weaknesses In case we haven’t all seen this already… WEP uses RC4 encryption Fluhrer, Mantin, and Shamir described a passive, ciphertext-only attack against RC4 Specifically targeting the key scheduling algorithm of RC4 Authentication and Access Control We considered four options Wireless with WEP Insufficient… Wireless with dynamic WEP Dynamic WEP is better, but… Basically a race condition Most implementations require card homogeneity Authentication and Access Control We considered four options Wireless with WEP and VPN WEP didn’t improve the situation in this model Added management overhead Wireless with VPN, no WEP What we ended up going with Maybe not the best solution, but the best for us given our environment Wireless Network Topology Private DHCP/DNS for wireless network Same hostname for VPN from wireless and wired To minimize client configuration changes Really just DNS spoofing Runs over campus network backbone Using rfc1918 address space Parallel mapping to routable IP space If bldg is 128.119.10.0/24, wireless is 172.17.10.0/24 Wireless Network Topology Commodity Internet 802.1q trunk Internet2 128.119.3.X/30 128.119.10.Y 172.17.10.Z 172.17.3.X/30 128.119.192.0/24 DHCP routable IP space for VPN AP Cisco VPN 3000 172.17.10.A 128.119.192.B Basic Diagram for our Users Internet 802.11b Ethernet Card Switch Router Encrypted Traffic (IPsec) Une Laptop UMASS ncr Tra ypted ffic 11 Mb/s 802.11b Wireless Access Point VPN Enforcing the use of VPN Rules without consequences are merely suggestions Enforced with Cisco ACLs access-list 120 permit esp 172.17.78.192 0.0.0.63 host 172.17.3.190 access-list 120 permit udp 172.17.78.192 0.0.0.63 host 172.17.3.190 eq isakmp access-list 120 permit udp 172.17.78.192 0.0.0.63 host 172.17.175.14 eq domain access-list 120 permit udp 172.17.78.192 0.0.0.63 host 172.17.166.14 eq domain access-list 120 permit tcp 172.17.78.192 0.0.0.63 host 172.17.175.14 eq domain access-list 120 deny ip any any log Benefits and Drawbacks Benefits VPN provides encryption and authentication Use of VPN is required for any access outside of wireless network Not necessary to track/filter MAC address Limited to authorized users Drawbacks Client software install required No free Mac client for Cisco VPN 3000 Increased overhead No easy access for visitors Where are we going next? Looking at some gateway software VPN without the client? 802.1x Scalability of VPN VPN concentrators at major nodesites? Roaming Access Easier access for authorized visitors 802.11a or 802.11g? Summary Maybe not the best solution But the right one for us at this time Only time will tell… Questions?

UMASS-Amherst Network Vital Statistics Part 2

Related Documents

Recommended Documents

Description

Related Documents

Free up your schedule!

Take 5 seconds to unlock