IP Training Programme

Size: px

Start display at page:

Download "IP Training Programme"

Evangeline Allison
5 years ago
Views:

1 IP Tranng Programme Module 1: IP Generc Sesson 4: Applcatons and protocols ROUTING PROTOCOLS 1

2 Route table creaton The route table n routers can be created and mantaned n two ways 1: Statc route table entry Entres are entered manually 2: Dynamc route table entry Entres are sent between routers automatcally Requre the use of a Routng protocol such as RIP, OSPF, IS-IS or BGP RIP RIP wll transmt ts Routng table to ts neghbor routers every. seconds. The neghbors wll learn the transmttng routers logcal networks. The neghbors wll transmt ther routng tables so the local router learns ther logcal networks. 2

Convergence! Everybody knows everybody Route table R2 NETWORK SEND TO HOP 15.181.55/24 15.181.55.1 1 12.18.1.8/ 12.18.1.1 1 12.18.1.12/ 12.18.1.1 1 15.181.54/24 12.18.1. 2 12.18.1.4/ 12.18.1. 2 15.

3 Convergence! Everybody knows everybody Route table R2 NETWORK SEND TO HOP / / / / / / / Route table R NETWORK SEND TO HOP / / / / / / / Route table R1 NETWORK SEND TO HOP / / / / / / / Route table R4 NETWORK SEND TO HOP / / / / / / / NAT translaton prvate IP addresses NAT: Network Address Translaton -one to one IP address translaton Translates IP addresses from nsde to outsde network Prvate IP adresses allocated to be used behnd NAT -1.../ to / to / to NAT hdes the nsde network (LAN) from the outsde

4 NAT tabel NAT and PAT TCP and UDP uses port numbers. NAT/PAT software keeps track on connectons usng: - Protocol ( eg. TCP) - Insde from IP ( eg ) - Insde from port ( eg. Port 1152) - Outsde to IP ( eg ) - Outsde to port ( eg. port 8) The fve parameters descrbe a unque connecton Always unque ports Data From port 8 To port 115 T C P From IP Insde net: /24 1 To IP SOHO Router wth NAT and PAT WAN address Outsde net: /2 Data From To port port T C P From IP To IP Internet Protocol TCP Insde Indre network NAT NAT tabel table Outsde Ydre network From To Protocol From : :8 TCP :1152 To :8 TCP : :8 TCP : :8 TCP : :8 TCP : :8 4

Wndows DNS Server Wndows server verson 2, 28 and 212 has ntutve DNS server management tools. mal.mydoman.com A record ponts to 8..47. www.mydoman.com A record ponts to 8..47. mal.mydoman.com MX record (preference=1) mal.

se doman has two mal servers Mal.ascom.se and mal.ascom.nl The malserver wth lowest preference has hghest prorty and wll be used frst.

5 Wndows DNS Server Wndows server verson 2, 28 and 212 has ntutve DNS server management tools. mal.mydoman.com A record ponts to A record ponts to mal.mydoman.com MX record (preference=1) mal.myotherdoman.dk MX record (preference=2) MX Mal exchange DNS zone records Shows Mal servers for the doman. The ascom.se doman has two mal servers Mal.ascom.se and mal.ascom.nl The malserver wth lowest preference has hghest prorty and wll be used frst. If unreachable the next lowest preference s tred. The IP address of the mal server(s) s found usng a A- record lookup 5

6 DHCP Clent DHCP Clent DHCP example DHCP lease pool on server: IP address range: Subnet mask: DNS server: Default gateway: Net: /24 ROUTER Internet DHCP Server Statc IP address DHCP Clent 1. DHCP-Dscover 2. DHCP-Offer DHCP Server(s). DHCP-Request DNS server DHCP-Ack Network DHCP Relay one server many logcal networks Server 1 DNS DHCP Server 2 FIL PRINT Clent Prnter Clent Clent Clent DHCP 254 DHCP DHCP 2 SW1 DHCP SW2 SW 1 Buldng / /24 1 R / 2 R2 DHCP Buldng / R Buldng Internet DHCP relay confgured s on on router Router nterfaces facng the DHCP clents to forward ncomng. DHCP packets to

7 DHCP optons Wndows DHCP server optons confguraton example TFTP servers are often used to store IP phones confguraton fles. Subnettng Classfull IP addresses Network part Host part For example: /1 Network part Host part: 4.5 Classless IP addresses Network part Subnet part Host part For example /24 Network part: Host part: 5 7

8 Classless IP addresses Subnettet class B network as /24 One class B net subnettet to 25 subnets Network Subnet mask Max hosts Exponentaton Mathematcal operaton Called potens n Swedsh, Norwegan and Dansh. 2 5 = 2 ^ 5 = = = 7 ^ 2 = 7 7 = = 2 ^ 4 = Often used when dealng wth numerc systems. 8

9 Numerc systems II ^ = 71 = 7 1^1 = 1 = 1^2 = 1 = 81^ = 81 = 8 Decmal sum = ^ = 11 = 1 2^1 = 2 = 12^2 = 14 = 4 12^ = 18 = 8 Decmal sum = 1 The bnary byte ^ = 11 = 1 12^1 = 12 = 2 12^2 = 14 = 4 12^ = 18 = 8 12^4 = 11 = 1 12^5 = 12 = 2 12^ = 14 = 4 12^7 = 1128 = 128 Decmal sum = 255

10 The bnary byte ^ = 11 = 2^1 = 12 = 2^2 = 14 = 12^ = 18 = 8 12^4 = 11 = 1 12^5 = 12 = 2 12^ = 14 = 4 12^7 = 1128 = 128 Decmal sum = 248 Classless IP addresses A bnary 1 n the subnet mask means the bt belongs to the logcal network or subnet A bnary n the subnet mask means the bt belongs to the host part of the IP address Prefx Subnet mask - decmal Subnet mask - bnary / / / / / / /

11 Classless IP addresses To adapt the sze of a logcal network to customer networks the classes were abandoned. Subnets s logcal networks prefx Subnet mask Subnets Max hosts / / / / / / / Network and broadcast Two IP addresses of each logcal network s reserved for specal purposes. They are llegal as host IP addresses All host bts s the logcal network name All host bts 1 s the local broadcast IP address For example the /24 network s the network name s the broadcast address Usable IP address ranges from to A total of 254 usable addresses 11

12 A /24 network Net part Host part = = = All. host 54.2 bts = zero Ths. s a Illegal IP 54. address = 1111 and s used as the.4 network = 1111 name = = = = All 181. host bts = one Ths s a Illegal IP. address and s used as.. 15 the. 181 broadcast = address 1111 of. the = network = = = = /24 Two /25 networks Net part - subnet part blue Host part = = All seven host bts one. Ths s a = Illegal. IP address and s. used as the.2 broadcast = 1111 address of the = Network / = = = = = = All. 181 seven host = bts 1111 zero. Ths s a Illegal IP. address 11 = 1111 and s. used as = the network name / = = = / /25 12

13 Four /2 networks Net part - subnet part blue Host part = = = = = = = = = = = = = = = = = / / / /2 Subnettng The centerrouter wll example route traffc to the branches based on the subnet bts = Vborg 1 = Oslo 1 = Stockholm 11 = Copenhagen WS WS 48 WS WS WS WS 44 WS WS /2 DG: Usable IP s: 2 Vborg /2 DG: Usable IP s: 2 Oslo Stockholm /2 DG: Usable IP s: Copenhagen /2 DG: Usable IP s: 2 WS WS 58 WS WS... The nternet provder wll route All trafc to /24 To the center router WS WS 5 WS WS... 1

14 PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs Subnettng example WS WS 48 WS WS WS WS 44 WS WS /2 DG: Usable IP s: 2 Vborg /2 DG: Usable IP s: 2 Oslo Stockholm /2 DG: Usable IP s: Copenhagen /2 DG: Usable IP s: 2 WS WS 58 WS WS... The nternet provder wll route All trafc to /24 To the center router WS WS 5 WS WS IP TELEPHONY AND VOICE VLAN 14

15 PQRS TUV 7 messages servces drectores settngs PQRS TUV PQRS TUV 7 messages servces drectores settngs 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs IP Telephony In a normal DHCP voce Server call 5 Call packets Manager per second s sent n each drecton. One packet each.2 second Router VPN wth QoS Voce Gateway The VPN connects the companes branches The Call Manager s a nto voce one call bg Processng IP network. system The allowng voce QoS gateway IP (Qualty phones connects of to Servce) call each the needed prvate other to ensure Voce IP and phone drect good system calls voce to to and qualty the from global n PSTN conversatons PSTN (Publc Swtched Telephone Network) PSTN Router QoS Qualty of Servce VPN Vrtuel Prvate Network. (MPLS) PSTN Publc Swtched Telephone Network IP Telephony IP telephony s an nstant servce Voce packet stream between phones Normaly 5 packets per second To ensure good voce qualty, voce packets should be transferred between phones Wth low delay ( < 15mS) Wth lttle jtter (< ms) Jtter s varable delay between packets n Wth lttle packet loss (< 1%) 15

16 IP Telephony VoIP best practce s separatng voce and data traffc n the network Enhancng securty not mxng VoIP and data Troubleshootng smplfed Easer to deploy Qualty of Servce Two ways of separatng data and voce Two physcal networks One physcal network wth separate VLAN s for voce and data IP Telephony Two physcal networks Expensve 2 x Devces, 2 x cablng and 2 x VPN s Easy to ensure good voce qualty One physcal network Two logcal networks one for voce one for data Usng a data-vlan and a voce-vlan Cheaper More dffcult to ensure voce qualty Need end-to-end qualty of servce confgured 1

17 PQRS TUV 7 messages drectores servces settngs PQRS TUV 7 messages drectores servces settngs PQRS TUV 7 messages drectores servces settngs PQRS TUV 7 messages drectores servces settngs PQRS TUV 7 messages drectores servces settngs PQRS TUV 7 messages drectores servces settngs VLAN Revew Vrtual Local Area Network Swtch ports belong to a VLAN Devces on same VLAN can communcate Swtch ports confgured as trunks can exchange VLAN traffc between swtches VLAN 1 VLAN 2 TRUNK VLAN capable swtch 82.1Q Trunk 82.1Q Trunk VLAN capable swtch VLAN 1 VLAN 1 VLAN 2 VLAN 2 Voce VLAN opton 1 Traffc separated physcally between swtch and users desk One cable and one swtch port for users PC One cable and one swtch port for users IP Phone Expensve n cablng and swtches VLAN 1 VLAN 2 Data Voce TRUNK VLAN capable swtch 82.1Q Trunk 82.1Q Trunk VLAN capable swtch VLAN 1 VLAN 1 VLAN 2 VLAN 2 17

PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7

18 PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs Voce VLAN opton 2 Traffc IP phone ethernet separated port connects logcally to between swtch and Swtch users n rack desk closet typcally through RJ45 wall plug. Use IP phones wth bult-n trunk capablty Buld n three-port swtch n the IP Phone One phone swtch port n used as trunk One phone swtch port used by the IP phone t self One phone swtch port used to connect the PC IP phone ethernet port connects to Users PC Voce VLAN opton 2 Data traffc carred n VLAN 1 Voce traffc carred n VLAN 2 VLAN 1 VLAN 2 Data Voce TRUNK VLAN capable swtch Trunk Trunk VLAN capable swtch VLAN 1 VLAN 1 VLAN 2 VLAN 2 Trunk Trunk Trunk Trunk Trunk Trunk 18

swtches capable of delverng power PoE or Power over Ethernet Pcture

19 PoE Power over Ethernet Most IP phones are powered by 48 Vdc Many IP phones can get power from External power supply connected to mans From swtches capable of delverng power PoE or Power over Ethernet Pcture below s a partal prntout from a PoE capable swtch NETWORK SECURITY BEST PRACTICE 1

20 Encrypton/Decrypton Transmtter ORANGE RUDQJH Insecure network RUDQJH Recever ORANGE Encrypton algortm Decrypton algortm Encrypton algorthm: Caesar cpher (Very nsecure) Encrypton key : (Shft cpher letters) Plan alfabet : GHIJKLPQRSTUV Cpher alfabet : GHIJKLPQRSTUV Plan text : ORANGE Cpher text : RUDQJH Breakng a cpher text To break an encrypted message the code breaker must know: Encrypton algorthm Encrypton key The most common encrypton algorthm are publc we all use them Payng over the nternet Usng secure WEB-pages ( The code breaker knows the encrypton algorthm but not the secret key 2

21 Brute force code breakng Test all possble keys Compare clear text wth database wth common words Codebreaker fnd key n four attempts! Key : RUDQJH Key 1: QTCPIG Key 2: PSBOHF Key : ORANGE Key 4: NQMFD Key 5: MP8LEC Key : LO7KDB Key 7: KNJCA Key 8: JM5IB Key : IL4HA8 Key 1: HKG7 Key 11: GJ2F8 Key 12: FI1E75 Key 1: EHD4 Key 14: DGZC5 Key 15: CFYB42 Key 1: BEXA1 Key 17: ADW2 Key 18: CV81Z Key 1: 8BU7Y Key 2: 7ATZX Key 21: S5YW Key 22: 58R4XV Key 2: 47QWU Key 24: P2VT Key 25: 25O1US Key 2: 14NTR Key 27: MZSQ Key 28: Z2LYRP Key 2: Y1KXQO Key : XJWPN Key 1: WZIVOM Key 2: VYHUNL Key : UXGTMK Key 4: TWFSLJ Key 5: SVERKI Strong keys necessary Encrypton standards Standard Key sze Status Tme requred to break Caesar (less than bt) Very nsecure,...72 second DES 5 bt Insecure 4 days Trple DES 5, 112 or 18 bt (In)secure 112 bt key: 8 days AES 128, 12 or 25 bt Secure 128 bt key: 5 x 1^21 year Tme requred to check all possble keys at 5... keys per second. (reference DES = Data Encrypton Standard AES = Advanced Encrypton Standard Theoretcal number of keys: 5 bt = 2^5 = BIT = 2^25 =

Network securty Network desgners protect the network nfrastructure and servers by Establshng trust boundares Frewalls Network desgners protect network from Intruson from unwanted sources

22 Network securty Network desgners protect the network nfrastructure and servers by Establshng trust boundares Frewalls Network desgners protect network from Intruson from unwanted sources Non-authorzed equpment User authentcaton and user rghts Physcal locked server rooms and wrng closets Eavesdroppng by encryptng data MAC address floodng A swtch sorts traffc based on MAC addresses. A swtch has lmted memory 22

23 MAC address floodng Symptom: An attacker sends thousands of ethernet frames to a swtch wth random source MAC addresses The swtchs lmted memory wll be consumed and the swtch wll flood traffc to all ports for ethernet frames wth unknown destnatons. The attacker can snff packets and gan access to senstve data MAC address floodng Counter measures: A port securty feature whch lmts the number of MAC addresses on a per port bass Often programmable per port number Often the port wll shut down for a perod of tme f maxmum number exceeded Impact When addng equpment n exstng customer networks port securty may shut down the port unntentonally 2

Password not stored on server Hash stored on server Notce

24 Hash functon A hash s a mathematcal functon Maps varable length data to fxed length data Used to protect passwords Password not stored on server Hash stored on server Notce small change n password e to LDAP Lghtweght Drectory Access Protocol 24

25 LDAP Lghtweght Drectory Access Protocol Lke an electronc telephone drectory LDAP server The drectory LDAP clent The user The LDAP server for example holds Logn credentals (username, password) User nformaton (name, offce) Extenson numbers for IP-Phones Authorzaton nformaton The LDAP server s used for centralzed logn LDAP Lghtweght Drectory Access Protocol Dfferent knd of systems use the same source for nformaton (The drectory) IP Phones Servers Clent computers One drectory for all systems Needs redundancy (No sngle pont of falure) LDAP s a common protocol used by hosts to access the drectory and ts entres. LDAP s a TCP/IP based protocol 25

PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs LDAP example PC1 IP phone 1 Server 1 LDAP Server Server 2 Fle

example SW2 Name: Henrk When Thomsen loggng n on Name: PC2 the Jens pc wll Broberg connect to the LDAP Logn name: R heth server and check Logn logn name:

26 PQRS TUV 7 messages servces drectores settngs PQRS TUV 7 messages servces drectores settngs LDAP example PC1 IP phone 1 Server 1 LDAP Server Server 2 Fle server Server VoIP server PC2 IP phone 2 The LDAP server holds nformaton about all Server users 5 and IP Server 4 Prnt server phones Applcaton server For example SW2 Name: Henrk When Thomsen loggng n on Name: PC2 the Jens pc wll Broberg connect to the LDAP Logn name: R heth server and check Logn logn name: name jebr and password. Password: Buldng 112kj12e87 Password: k12kje1 Buldng 2 Phone extenson: 45 Phone extenson: 457 PSTN VG FW Internet Server room ACTIVE DIRECTORY 2

27 Actve Drectory AD or ADS AD s a Mcrosoft developed drectory servce buld for Mcrosoft Wndows Domans A doman s collecton of resources (servers ) Uses LDAP for communcaton Uses DNS for name resoluton Hostnames to and from IP addresses Uses encrypton and secure logn The AD doman A doman contan at least one DC DC Doman Controller The DC holds the Actve Drectory Doman contoller Member servers Clents ascom.no 27

28 The AD doman There must be a DNS server for the doman Automatcally nstalled when nstallng AD Host regster ther names and IP addresses to the DNS server All hosts n the doman has ts own A-record For example: A record n DNS IP address dc.ascom.no server1.ascom.no server2.ascom.no clent1.ascom.no clent2.ascom.no Doman contoller Member servers Clents ascom.no The AD tree A tree consst of at least one doman Domans n a tree trust each other Doman contoller Member servers Clents ascom.no Doman contoller Doman contoller Member servers Member servers Clents tech.ascom.no Clents adm.ascom.no 28

29 The AD forest A forest consst of at least one tree trees n a forest confgures to trust each other It s possble to buld bg organzatonal networks reflectng the actual organzaton Not organzaton adaptng to technology but technology adaptng to organzaton Doman contoller Doman contoller Doman contoller Member servers Member servers Member servers Clents ascom.se Clents ascom.no Clents ascom.dk Doman contoller Doman contoller Doman contoller Doman contoller Doman contoller Doman contoller Member servers Member servers Member servers Member servers Member servers Member servers Clents tech.ascom.se Clents adm.ascom.se Clents tech.ascom.no Clents adm.ascom.no Clents tech.ascom.dk Clents adm.ascom.dk Buzzword Doman member Some AD buzzwords Explanaton A host server or clent belongng to a doman Doman controller(s) One ore more servers holdng the Actve Drectory Doman Tree Forest Object OU Conssts of at least one DC and zero or more doman members A tree conssts of one or more domans grouped n a herarchy A collecton of one or more trees A collecton of propertes whch together s a resource For example a user s an object consstng of many propertes -username, logn name, password, extenson.. Organzatonal Unt A contaner holdng objects for easy admnstraton. For example: If a OU s holdng 1 user objects You can confgure a polcy on the OU to a new background mage on the desktop. Then all the users PC s wll show that mage. 2

30 AD screenshot SERVER TECHNOLOGIES

31 Clent/Server Bascally a clent s a program that ask a queston usng a specfc protocol Bascally a server s a program that can answer a queston usng the same specfc protocol. For example A web browser (clent) requestng to see a web page usng the http protocol. (request) The web server sendng the web-page to the clent usng the http protocol. (response) Server operatng systems Dfferent knd of server operatng systems exst For example Wndows 28 server Wndows 212 server Redhat enterprse server Lnux verson Ubuntu Lnux server verson 12.1 IBM AIX Unx verson 7.1 Apple Mac OS server IBM (Prevously OS/4). 1

32 Whch server goes where? Bascally all server OS solves the same tasks Runnng server programs A specfc OS s chosen from Preference (What the admnstrator lkes) Prce and performance Some server programs can only run on some server OS s For example Mcrosoft Exchange Server Busness Crtcal server programs such as bg bankng server runnng on a huge IBM manframe Thank you for lstenng 2

IP Training Programme. Module 1: IP Generic Session 3: IP Services

IP Training Programme. Module 1: IP Generic Session 3: IP Services IP Training Programme Module 1: IP Generic Session 3: IP Services Subjects Review The IP Address continued Routing protocols (Concept) Firewalll and NAT DNS server and DNS operation concept DHCP server