27-08-2014, 03:42 PM
Network design is both an art and a science. The science involves exploiting various methodologies to meet all the requirements within the given constraints. Each of these methods trades one constrained resource for another. The art involves choosing the best balance between constrained resources, resulting in a network that is futureproof one that will grow to meet increased, or even radically new, and requirements. Creation of a solution for a particular enterprise based on the various factors involved in the organizations premises and making the best possible recommendation based on requirements and environment of the organization. The major issues involve decision making for the production network of an organization as organization, either IT or NonIT Since its the backbone of the organization. An organizations productivity highly depends upon the IT infrastructure of the company and Network is the most important part of the infrastructure as it enables all the communication. Designing such efficient infrastructure is a challenging task in itself as one has to make
While designing the required network there are some features that customer may specifically ask for in this case the customer requires QoS in all areas of the network. Therefore during device selection each and every feature needs to be kept in mid so that no feature is left while designing the solution.
Functions to be Provided This project aims solving the above stated problem by building a Robust Network Solution which will fulfill the requirements of the organization and provide with all the functionality required for the requirements including their separate systems like surveillance and VoIP. The functions to be provided aims at providing efficient and reliable solution that would also have a futuristic approach as networks cannot be easily modified on a regular basis. ? 1.2.1 Integrated Security ? Authentication ? 802.1x: IEEE 802.1X is an IEEE Standard for Portbased Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. ? MACbased Access Control: MACbased access control is a method to authenticate and authorize access using either a port or host. For portbased MACbased access control, the method decides port access rights, while for hostbased MACbased access control, the method determines the MAC access rights. In MACbased access control, MAC user information in a local database is searched for authentication. Following the authentication result,users achieve different levels of authorization ? Captive Portal: special web page (usually for authentication purposes) before using the Internet normally. A captive portal turns a Web browser into an authentication device.[1] This is done by intercepting most packets, regardless of address or port, until the user opens a browser and tries to access the web. At that time the browser is redirected to a web page which may require authentication and/or payment, or simply display an acceptable use policy and require the user to agree. Captive portals are used at many WiFi hotspots. Authorization
ynamDynamic VLAN assignment is one such feature that plac es a wireless user into a specific VLAN based on the credentials supplied by th e user. This task of assigning users to a specific VLAN is handled by a RADIU S authentication server, such as FreeRadius or NPS server. This can be used, f or example, to allow the wireless host to remain on the same VLAN as it moves 11 within a campus network. Guest VLAN : guest VLAN is intended to be used for clients which have no ability to authenticate; those clients which fail authentication deserve additional consideration. Prior to IOS 12.2(25)SE, clients which fail authentication are simply placed in the guest VLAN. With the introduction of 12.2(25)SE, clients which fail authentication remain in their assigned VLAN, unable to communicate. Port Security : You can use port security with dynamically learned and static MAC addresses to restrict a port's ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, IPMACPort Binding : MACIPport binding allows a device to filter packets and thus enhance security. With MACIPport binding configured, a port checks whether the source MAC and IP addresses of an inbound packet is identical to the configured MACtoIP binding on the port. If so, it forwards the packet; otherwise, it discards the packet.
While designing the required network there are some features that customer may specifically ask for in this case the customer requires QoS in all areas of the network. Therefore during device selection each and every feature needs to be kept in mid so that no feature is left while designing the solution.
Functions to be Provided This project aims solving the above stated problem by building a Robust Network Solution which will fulfill the requirements of the organization and provide with all the functionality required for the requirements including their separate systems like surveillance and VoIP. The functions to be provided aims at providing efficient and reliable solution that would also have a futuristic approach as networks cannot be easily modified on a regular basis. ? 1.2.1 Integrated Security ? Authentication ? 802.1x: IEEE 802.1X is an IEEE Standard for Portbased Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. ? MACbased Access Control: MACbased access control is a method to authenticate and authorize access using either a port or host. For portbased MACbased access control, the method decides port access rights, while for hostbased MACbased access control, the method determines the MAC access rights. In MACbased access control, MAC user information in a local database is searched for authentication. Following the authentication result,users achieve different levels of authorization ? Captive Portal: special web page (usually for authentication purposes) before using the Internet normally. A captive portal turns a Web browser into an authentication device.[1] This is done by intercepting most packets, regardless of address or port, until the user opens a browser and tries to access the web. At that time the browser is redirected to a web page which may require authentication and/or payment, or simply display an acceptable use policy and require the user to agree. Captive portals are used at many WiFi hotspots. Authorization
ynamDynamic VLAN assignment is one such feature that plac es a wireless user into a specific VLAN based on the credentials supplied by th e user. This task of assigning users to a specific VLAN is handled by a RADIU S authentication server, such as FreeRadius or NPS server. This can be used, f or example, to allow the wireless host to remain on the same VLAN as it moves 11 within a campus network. Guest VLAN : guest VLAN is intended to be used for clients which have no ability to authenticate; those clients which fail authentication deserve additional consideration. Prior to IOS 12.2(25)SE, clients which fail authentication are simply placed in the guest VLAN. With the introduction of 12.2(25)SE, clients which fail authentication remain in their assigned VLAN, unable to communicate. Port Security : You can use port security with dynamically learned and static MAC addresses to restrict a port's ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. When you assign secure MAC addresses to a secure port, the port does not forward ingress traffic that has source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, IPMACPort Binding : MACIPport binding allows a device to filter packets and thus enhance security. With MACIPport binding configured, a port checks whether the source MAC and IP addresses of an inbound packet is identical to the configured MACtoIP binding on the port. If so, it forwards the packet; otherwise, it discards the packet.