Network Design Proposal Capstone Final Project

NETWORK DESIGN
PROPOSAL
FOR CAPSTONE FINAL PROJECT
Table of Contents
I. INTRODUCTION
II. DESIGN CONSIDERATIONS
WAN Services
LAN Services
Network Fundamentals
Security Services
III. NETWORK DIAGRAMS AND TOPOLOGIES
WAN Topology
IV. SYSTEM COMPONENTS
V. CONFIGURATIONS
I.
INTRODUCTION
The implementation of a Service Ready Medium Branch Network enables

enterprises with branch offices of 50 to 100 users to deploy high-value network
services such as unified communication and application optimization on top of a
secure branch network infrastructure that is connected to a campus or data center
core (central site) over a variety of WAN technologies. The goal of the Services
Ready Medium Branch Network is to make deployment of these services fast,
simple, and predictable.
The design, test and deployment of this Services Ready Medium Branch Network
will focus on the key elements to ensure the consistent connectivity and mandatory
security requirements for data, voice, and application optimization services.
II.
DESIGN CONSIDERATIONS
WAN Services
Layer 3 Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN)

for increased flexibility and reduced bandwidth cost
Dedicated bandwidth ranging from 6 to 44 Mb/s to handle data, voice, and
video traffic
LAN Services
Hierarchical network design to simplify deployment, troubleshooting, and

management
Connectivity to branch devices at Fast Ethernet or Gigabit Ethernet speeds
Near-wire-speed performance between all devices
Provisions for accommodating future expansion
Networking device redundancy without traffic loops
Power-over-Ethernet (PoE)
Network Fundamentals
High availability, rapid recovery, and disaster recovery

Rapid recovery in case of component failure
Automatic switchover to backup WAN link that has a minimum one-quarter of
the bandwidth of the primary WAN link
Ability to restore service within 24 hours in the event of a disaster
Quality of service (QoS)
2
Application-specific traffic prioritization both within the branch office and

across the enterprise
Bandwidth management for WAN-based traffic
Provisions for IP telephony, business video, critical and bulk data applications
Provisions to mitigate denial of service (DoS) and worm attacks
Identification and classification of critical application flows for QoS
IP routing and addressing
Routing within the enterprise and between the branch and the service
provider network
Direct Internet access from the branch
Support for multicast applications
Translation of private addresses and ports in order to access the Internet
Dynamic allocation of IP addresses for end devices
Security Services
Infrastructure protection
Physical securing of access to networking devices
Disabling of unused services that may be used to exploit the network
Authentication of routing protocol updates
Access control
Authentication and authorization services for controlling access to network
resources
Logging capabilities for auditing access to network devices and resources
Integration with global access management system to enforce access
privileges
Secure connectivity
Secure interoffice connectivity for full-mesh and hub-and-spoke WAN
topologies
Secure access into the branch network for remote or home office workers
Voice, video, and data separation on the LAN
Separation of network management traffic
Access to the server in the branch by home office users
Threat protection, detection, and mitigation
Blocking of unauthorized traffic from entering or leaving the branch
Access to servers in the branch by home office users
Verification of source addresses for incoming traffic
Identification and mitigation of common DoS attacks and worms
Prevention of malicious attacks on the branch office network from outside
Prevention of attacks and security breaches from within the branch office
3
III.
NETWORK DIAGRAMS AND TOPOLOGIES
WAN Topology
IV.
SYSTEM COMPONENTS
Device
Platform
Modules
P1
Cisco 2851 IS Router
4 - WIC 1DSU-T1 V2 WAN Interface Card
P2
PE1
PE2
PE3
PE4
VRF1 CE1
Cisco 2610XM Router

Cisco NM-1FE-TX 10/100 Fast Ethernet
VRF1 CE2
Cisco 2610XM Router

V.
HQ GW
Cisco 2610XM Router
BR GW
Cisco 2610XM Router
HQ CORE
SW
BR CORE
SW
HQ
ACCESS
SW
BR
ACCESS
SW
Catalyst 3550-24 EMI
N/A
N/A
N/A
N/A
CONFIGURATIONS
hostname P1
!
mpls traffic-eng tunnels
!
interface Loopback0
ip address 10.0.0.1 255.255.255.255
!
interface GigabitEthernet0/0
description Connected to P2 Fa0/0
ip address 10.1.0.1 255.255.255.252
ip ospf network point-to-point
duplex auto
speed auto
!
ip address 10.1.0.5 255.255.255.252
duplex auto
speed auto
!
interface Serial0/0/0
description Connected to PE1 S1/0
ip address 10.1.1.1 255.255.255.252
no fair-queue
service-module t1 timeslots 1-24
!
5

ip address 10.1.1.5 255.255.255.252
!
ip address 10.1.1.9 255.255.255.252
!
ip address 10.1.1.13 255.255.255.252
!
router ospf 65000
mpls traffic-eng router-id Loopback0
mpls traffic-eng area 0
router-id 10.0.0.1
network 10.0.0.1 0.0.0.0 area 0
network 10.1.0.0 0.0.0.7 area 0
network 10.1.1.0 0.0.0.15 area 0
!
router bgp 65000
bgp router-id 10.0.0.1
bgp log-neighbor-changes
timers bgp 12 36
neighbor MPLS peer-group
neighbor MPLS remote-as 65000
neighbor MPLS update-source Loopback0
neighbor 10.0.0.2 remote-as 65000
neighbor 10.0.0.2 update-source Loopback0
neighbor 10.0.0.2 send-community extended
neighbor 10.0.1.1 peer-group MPLS
!
address-family vpnv4
neighbor MPLS send-community extended
neighbor MPLS route-reflector-client
6
neighbor 10.0.1.1 activate

exit-address-family
hostname P2
!
!
interface Loopback0
ip address 10.0.0.2 255.255.255.255
!
ip address 10.1.0.2 255.255.255.252
duplex auto
speed auto
!
ip address 10.1.0.6 255.255.255.252
duplex auto
speed auto
!
ip address 10.1.2.1 255.255.255.252
no fair-queue
!
ip address 10.1.2.5 255.255.255.252
!
ip address 10.1.2.9 255.255.255.252
7

!
ip address 10.1.2.13 255.255.255.252
!
router ospf 65000
router-id 10.0.0.2
network 10.0.0.2 0.0.0.0 area 0
network 10.1.0.0 0.0.0.7 area 0
network 10.1.2.0 0.0.0.15 area 0
!
router bgp 65000
timers bgp 12 36
neighbor 10.0.0.1 update-source Loopback0
neighbor 10.0.0.1 send-community extended
!
neighbor MPLS route-reflector-client
exit-address-family
hostname PE1
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.100.1
8
!
ip dhcp pool sdm-pool1
network 172.16.100.0 255.255.255.252
default-router 172.16.100.1
!
ip vrf vrf1
rd 64512:1
route-target export 64512:1
route-target import 64512:1
!
ip vrf vrf2
rd 64512:2
!
no ip domain lookup
!
multilink bundle-name authenticated
!
interface Loopback0
ip address 10.0.1.1 255.255.255.255
!
interface Tunnel2
ip unnumbered Loopback0
tunnel destination 10.0.1.2
tunnel mode mpls traffic-eng
tunnel mpls traffic-eng autoroute announce
tunnel mpls traffic-eng path-option 2 dynamic
no routing dynamic
!
interface Tunnel3
no routing dynamic
!
interface Tunnel4
no routing dynamic
9
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
description $ETH-LAN$
ip address 172.16.100.1 255.255.255.252
ip nat inside
duplex auto
speed auto
!
description Connected to P1 S0/0/0
ip address 10.1.1.2 255.255.255.252
service-module t1 clock source internal
!
description Connected to P2 S0/0/0
ip address 10.1.2.2 255.255.255.252
!
description Connected to VRF1-CE1 S0/1
ip vrf forwarding vrf1
ip address 192.168.1.2 255.255.255.252
!
ip address 192.168.1.2 255.255.255.252
10

!
router ospf 65000
router-id 10.0.1.1
log-adjacency-changes
network 10.0.1.1 0.0.0.0 area 0
network 10.1.1.2 0.0.0.0 area 0
network 10.1.2.2 0.0.0.0 area 0
!
router bgp 65000
timers bgp 12 36
!
address-family ipv4
no neighbor 10.0.0.1 activate
no auto-summary
no synchronization
exit-address-family
!
exit-address-family
!
address-family ipv4 vrf vrf2
neighbor 192.168.1.1 as-override
maximum-paths 2
no synchronization
exit-address-family
!
11

maximum-paths 2
no synchronization
exit-address-family
!
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 172.16.100.0 0.0.0.3
hostname PE2
ip cef
ip vrf vrf1
rd 64512:1
!
ip vrf vrf2
rd 64512:2
!
!
interface Loopback0
ip address 10.0.1.2 255.255.255.255
!
interface Tunnel1
no routing dynamic
!
interface Tunnel3
no routing dynamic
!
interface Tunnel4
12

no routing dynamic
!
no ip address
shutdown
duplex auto
speed auto
!
no ip address
shutdown
duplex auto
speed auto
!
description Connected to P1 S1/1
ip address 10.1.1.6 255.255.255.252
no fair-queue
!
ip address 10.1.2.6 255.255.255.252
!
ip address 192.168.1.6 255.255.255.252
!
ip address 192.168.1.6 255.255.255.252
13

!
router ospf 65000
router-id 10.0.1.2
network 10.0.1.2 0.0.0.0 area 0
network 10.1.1.6 0.0.0.0 area 0
network 10.1.2.6 0.0.0.0 area 0
!
router bgp 65000
no synchronization
timers bgp 12 36
no auto-summary
!
exit-address-family
!
maximum-paths 2
no synchronization
exit-address-family
!
maximum-paths 2
14
no synchronization
exit-address-family
hostname PE3
!
ip cef
ip vrf vrf1
rd 64512:1
!
ip vrf vrf2
rd 64512:2
!
ip dhcp excluded-address 172.16.200.1
!
network 172.16.200.0 255.255.255.252
!
!
interface Loopback0
ip address 10.0.1.3 255.255.255.255
!
interface Tunnel1
no routing dynamic
!
interface Tunnel2
no routing dynamic
!
interface Tunnel4
15

no routing dynamic
!
ip address dhcp
ip nat outside
duplex auto
speed auto
!
description $ETH-LAN$
ip address 172.16.200.1 255.255.255.252
ip nat inside
duplex auto
speed auto
!
ip address 10.1.1.10 255.255.255.252
no fair-queue
!
ip address 10.1.2.10 255.255.255.252
!
ip address 192.168.1.10 255.255.255.252
!
16

ip address 192.168.1.10 255.255.255.252
!
router ospf 65000
router-id 10.0.1.3
network 10.0.1.3 0.0.0.0 area 0
network 10.1.1.10 0.0.0.0 area 0
network 10.1.2.10 0.0.0.0 area 0
!
router bgp 65000
timers bgp 12 36
!
address-family ipv4
no auto-summary
no synchronization
exit-address-family
!
exit-address-family
!
maximum-paths 2
no synchronization
exit-address-family
!
17

maximum-paths 2
no synchronization
exit-address-family
!
!
access-list 1 remark SDM_ACL Category=2
hostname PE4
!
ip cef
ip vrf vrf1
rd 64512:1
!
ip vrf vrf2
rd 64512:2
!
!
interface Loopback0
ip address 10.0.1.4 255.255.255.255
!
interface Tunnel1
no routing dynamic
!
interface Tunnel2
no routing dynamic
!
18
interface Tunnel3
no routing dynamic
!
no ip address
shutdown
duplex auto
speed auto
!
no ip address
shutdown
duplex auto
speed auto
!
ip address 10.1.1.14 255.255.255.252
!
ip address 10.1.2.14 255.255.255.252
!
ip address 192.168.1.14 255.255.255.252
!
19
ip address 192.168.1.14 255.255.255.252

!
router ospf 65000
router-id 10.0.1.4
network 10.0.1.4 0.0.0.0 area 0
network 10.1.1.14 0.0.0.0 area 0
network 10.1.2.14 0.0.0.0 area 0
!
router bgp 65000
timers bgp 12 36
!
address-family ipv4
no auto-summary
no synchronization
exit-address-family
!
exit-address-family
!
maximum-paths 2
no synchronization
exit-address-family
!
20

maximum-paths 2
no synchronization
exit-address-family
hostname VRF1-CE1
!
ip cef
!
ip dhcp excluded-address 10.10.100.1 10.10.100.100
!
import all
network 10.10.100.0 255.255.255.0
dns-server 10.10.100.21 4.2.2.2
domain-name CAPSTONE.LOCAL
!
no ip domain lookup
ip name-server 10.10.100.1
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
interface Loopback0
ip address 10.255.0.1 255.255.255.255
!
ip address 10.10.100.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/0
ip address 192.168.1.1 255.255.255.252
no fair-queue
!
interface Serial0/1
ip address 192.168.1.5 255.255.255.252
21

!
ip address dhcp
ip nat outside
duplex auto
speed auto
!
router bgp 64512
no synchronization
timers bgp 12 36
redistribute connected
no auto-summary
!
ip forward-protocol nd
!
!
hostname VRF1-CE2
ip cef
!
!
import all
network 10.10.200.0 255.255.255.0
domain-name CAPSTONE.LOCAL
dns-server 10.10.200.21 4.2.2.2
!
no ip domain lookup
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
interface Loopback0
ip address 10.255.0.2 255.255.255.255
!
22
ip address 10.10.200.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/0
ip address 192.168.1.9 255.255.255.252
no fair-queue
!
interface Serial0/1
ip address 192.168.1.13 255.255.255.252
!
ip address dhcp
ip nat outside
duplex auto
speed auto
!
router bgp 64512
no synchronization
timers bgp 12 36
redistribute connected
no auto-summary
!
ip forward-protocol nd
!
!
23

Network Design Proposal Capstone Final Project

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Network Design Proposal Capstone Final Project

Hochgeladen von

Copyright:

Verfügbare Formate

NETWORK DESIGN

II. DESIGN CONSIDERATIONS

III. NETWORK DIAGRAMS AND TOPOLOGIES

IV. SYSTEM COMPONENTS

The implementation of a Service Ready Medium Branch Network enables

Layer 3 Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN)

Hierarchical network design to simplify deployment, troubleshooting, and

High availability, rapid recovery, and disaster recovery

Application-specific traffic prioritization both within the branch office and

NETWORK DIAGRAMS AND TOPOLOGIES

Cisco 2851 IS Router

4 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2851 IS Router

4 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2811 IS Router

3 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2811 IS Router

3 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2811 IS Router

3 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2811 IS Router

3 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2610XM Router

2 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2610XM Router

2 - WIC 1DSU-T1 V2 WAN Interface Card

Cisco 2610XM Router

Cisco NM-1FE-TX 10/100 Fast Ethernet

Cisco 2610XM Router

Cisco NM-1FE-TX 10/100 Fast Ethernet

Catalyst 3550-24 EMI

Catalyst 3550-24 EMI

Catalyst 3524-24 EMI

Catalyst 3524-24 EMI

description Connected to PE2 S1/0

neighbor 10.0.1.1 activate

ip ospf network point-to-point

mpls traffic-eng tunnels

neighbor 192.168.1.1 remote-as 64512

tunnel destination 10.0.1.4

service-module t1 clock source internal

tunnel mode mpls traffic-eng

ip vrf forwarding vrf2

address-family ipv4 vrf vrf1

ip address 192.168.1.14 255.255.255.252

neighbor 192.168.1.13 remote-as 64512

service-module t1 timeslots 1-24

Das könnte Ihnen auch gefallen