Help understanding network theory

[pomtom44]

Hey all

I apologize right now for the noob questions, and the likely hood of some very stupid sentences. 

Im taking a few networking papers at uni, but there seems to be a lack of real world examples of networking, and we are getting alot more theory based work.
Meaning I feel like I am missing out on some key points on designing a network and best ways of doing things.

Im not sure if this is the best place to ask, so feel free to tell me off, or move to another section,
but I have a example network in my head, and I was wondering if I could get some help understanding a few things.

Firstly network design

You have a public and private network, so guests can use the internet, but dont have access to internal servers and such
there is also a management network which an admin can use to access routers / switches / servers etc and manage them, (security purposes in my head)
and a security network with cameras, and / or other security devices.

To me, you break this into different subnets and vlans, to keep all the traffic separate, for EG
192.168.10.x - Vlan 10 - Guest
192.168.20.x - Vlan 20 - Private
192.168.30.x - Vlan 30 - Security
192.168.40.x - Vlan 40 - Management

Now from class, I know you put a router in at the top which you can use to route the networks to the internet, as well as each other, with security procedures in place
EG. only authorized computers can access the security network to monitor it. and the guest network cant go back down into the private network.

But this is where things get a little lost on me, and I could do with some discussion and clarifications.

DHCP - To me there are 3 ways of doing this
1) Put a separate dhcp server on each network which serves only that network
2) Put one dhcp server with multiple NIC's (or virtual nics) serving all networks, as I know dhcp is offered based on the interface subnet it came from
3) Put one dhcp server on either the management network, or another "servers" network, and add DHCP helpers to the router to forward on dhcp requests.

Which of these is better, and what are the pro's and cons of each.
and is there another way of doing it which I dont know about.

DNS - Similar sort of deal to the DHCP, (This is for internal dns, not external)
Can you add one DNS server at the top, and do DNS forwarding, similar to the DHCP helper, and if so, how does it work
or do you need to add a DNS server to each network, either a separate one per network, or one with multiple connections in and out.

and finally, this is a thought I keep coming to when thinking about this all, and how it all works together
Lets say I have a file server available on the network. I want the security network to access part of it to store surveillance footage on, part of it to be open to the private network for people to store files on, and part of it to be open to both the pubic and private network so a guest can drop a file on, and someone can access it from a internal pc.

I know the easy and obvious option would be, just use 3 different file servers, but what if there is only space or budget for one large one.
I know you can do the option of having multiple network cards, one per network, and setting up the file structure to bind to the interfaces.
but doesn't that open up to security risks, having all three networks combining at that point.
As well as this I keep going to the DNS for it.
Say your internal network is abc.local.
Your computers get named based off this.
PC1.abc.local, printerA.abc.local
and I assume your guest devices also get named, Guest1.abc.local
If you give your file server files.abc.local, how does the dns work for it.

if an internal pc accesses files.abc.local, it will look it up in the dns records and find 3 different ip's for it
Guest, Internal and Security.
Does it only return the one based on the IP from which the requst came, like DHCP does.
or do you need to separate out the dns zones
For eg
internal.abc.local, security.abc.local, guest.abc.local
So your devices will be named
PC1.internal.abc.local, Cam1.security.abc.local, GuestLaptop.guest.abc.local
and your file server will get

Fileserver.internal.abc.local, fileserver.security..... etc

Sorry if alot of this doesn't make sense, it doesnt to me and I feel like im making connections in how it works in my head, which don't work in the real world.
Which is why im asking for some advice and clarifiation.

Thanks in advance for any input
Tom
 

[risk]

> DHCP

 

DHCP is a service that needs to exist on these VLANs, a "server" is a piece of software that provides a service. A machine is a piece of hardware, .. there's hosts (can be desktops or servers or laptops), and then there's routers and switches etc etc...

 

DHCP is extremely light weight, you don't want multiple machines just for DHCP, you may want multiple server grade machines connected using trunks to all VLANs and then you can migrate DHCP running in VMs across them as needed (e.g. during upgrades or hardware failures).

 

> DNS

 

pretty much all decent DNS servers support DDNS and split horizon, a single VM sitting somewhere for DNS is fine, a single IP is fine.

 

> file server parts..

 

you need a single ip, should secure access to files based on accounts primarily, and then optionally additionally based on network (as your second layer of just in case security), samba allows you to configure which shares and users have access based on ip they're coming from, same with printers.

 

> *.abc.local

 

with devices roaming across networks and the whole byod world, a better practice is to register a real domain, and use client and server certs, so your device works.

[Sir Asvald]

Easy way of doing is by using the method, "router-on a-stick" You have your router (Cisco BTW) and with a Cisco switch, a cheap L2 would do fine. I'll create a lab and upload it here. 

 

 

Check the file I've uploaded. It's a packet tracer file. @pomtom44

 

 

ROUTER ON A STICK.pkt

[NZLaurence]

2 hours ago, Abdul201588 said:

Easy way of doing is by using the method, "router-on a-stick" You have your router (Cisco BTW) and with a Cisco switch, a cheap L2 would do fine. I'll create a lab and upload it here. 

 

 

Check the file I've uploaded. It's a packet tracer file. @pomtom44

 

 

ROUTER ON A STICK.pkt

I may just be short of coffee, but why would this config need a router on a stick. Its all just basic routing and acls for what he wants.

 

The only thing I see that makes me question this is the guest access to the file server, I would never want unsecured access to a file server I control (in this case from an open guest network) even with smb passwords.

[Sir Asvald]

10 hours ago, pomtom44 said:

To me, you break this into different subnets and vlans, to keep all the traffic separate, for EG
192.168.10.x - Vlan 10 - Guest
192.168.20.x - Vlan 20 - Private
192.168.30.x - Vlan 30 - Security
192.168.40.x - Vlan 40 - Management

 

58 minutes ago, NZLaurence said:

I may just be short of coffee, but why would this config need a router on a stick. Its all just basic routing and acls for what he wants.

 

The only thing I see that makes me question this is the guest access to the file server, I would never want unsecured access to a file server I control (in this case from an open guest network) even with smb passwords.

Did you even read what wanted? He's got 4 vlans and 4 networks. Router on a stick would work perfect. You've got 1 router, 1 switch. No need for any other equipment other than the what has been stated. 

[harry4742]

DHCP

1) costly but probably the most secure option, shitty administration

2) Can be done, but 3) is better

3) Add a dedicated services VLAN for stuff like this (and DNS/file), most common solution, simple administration

 

DNS

DNS does not need a Server on your Vlan/subnet or even on site, you can directly communicate with public DNS servers if you want

put it in the services net and configure ACLs for it, number of interfaces is up to you

 

Files

let there be user accounts and permissions, seperate security stuff for security reasons

DNS works tree based, so your local domain is abc.local, then subdomain can be sec.abc.local.......

can be done but not nessecary in smaller networks, ACLs do the trick, just use files.abc.local and then User-Account and Perms

[NZLaurence]

2 hours ago, Abdul201588 said:

 

Did you even read what wanted? He's got 4 vlans and 4 networks. Router on a stick would work perfect. You've got 1 router, 1 switch. No need for any other equipment other than the what has been stated. 

Interesting, I haven't seen "router on a stick" used to describe basic inter-vlan routing before. That would be considered a standard setup wouldn't it?

 

When taking about "router on a stick" I would normally only use it to describe where I am creating loopback interfaces to do routing between vrf's on a single router. I.e. to bridge the vrf security domains.

 

Also for the network as described I would run dhcp on the router for each network. DNS would be set to the DC for the private networks and set to the public ISP DNS for the guest network.

[Sir Asvald]

5 minutes ago, NZLaurence said:

Interesting, I haven't seen "router on a stick" used to describe basic inter-vlan routing before. That would be considered a standard setup wouldn't it?

 

When taking about "router on a stick" I would normally only use it to describe where I am creating loopback interfaces to do routing between vrf's on a single router. I.e. to bridge the vrf security domains.

 

Also for the network as described I would run dhcp on the router for each network. DNS would be set to the DC for the private networks and set to the public ISP DNS for the guest network.

Sounds complicated. Then again. I'm sure there are better ways of implementing it. I just think the "standard setup" is the easiest. 

 

 

[NZLaurence]

4 minutes ago, Abdul201588 said:

Sounds complicated. Then again. I'm sure there are better ways of implementing it. I just think the "standard setup" is the easiest. 

 

 

Yes, the only time I have used "router on a stick" as I would describe it was with a site using more the 100 vlans.

 

For @pomtom44 it could all be done easily on a single Cisco router using sub interfaces, acls and the router dhcp server. KISS principles.

[Sir Asvald]

2 minutes ago, NZLaurence said:

Yes, the only time I have used "router on a stick" as I would describe it was with a site using more the 100 vlans.

 

For @pomtom44 it could all be done easily on a single Cisco router using sub interfaces, acls and the router dhcp server. KISS principles.

That is what I did. I've created sub interfaces and setup the router as a DHCP server of each network. As for ACLs, I haven't done. I left them out. 

[NZLaurence]

5 hours ago, Abdul201588 said:

That is what I did. I've created sub interfaces and setup the router as a DHCP server of each network. As for ACLs, I haven't done. I left them out. 

Great. I don't have Cisco PT so I haven't seen what you have done but it sounds like a good example.

 

The ACLs are a security thing because guest users are bastards. I also normally put in rate limits on the guest network as well because. If you want I might have a config example I have used for guest users on a stand alone Cisco device floating around still.

 

Its really interesting to hear the definition of "router on a stick" used that way. I will have to look it up and find the "Cisco" answer in case it comes up in a exam some time.

 

[Sir Asvald]

3 hours ago, NZLaurence said:

Great. I don't have Cisco PT so I haven't seen what you have done but it sounds like a good example.

 

The ACLs are a security thing because guest users are bastards. I also normally put in rate limits on the guest network as well because. If you want I might have a config example I have used for guest users on a stand alone Cisco device floating around still.

 

Its really interesting to hear the definition of "router on a stick" used that way. I will have to look it up and find the "Cisco" answer in case it comes up in a exam some time.

 

I always put ACLs. Only reason why left them out because I couldn't be bothered.  I agree, sometimes you do get the odd "guest" who knows more than he/she should. I'm hoping to get a Cisco ASA 5505 soon so I can set it up in my home network.  

[NZLaurence]

1 hour ago, Abdul201588 said:

I always put ACLs. Only reason why left them out because I couldn't be bothered.  I agree, sometimes you do get the odd "guest" who knows more than he/she should. I'm hoping to get a Cisco ASA 5505 soon so I can set it up in my home network.  

What do you think about the ASA's? Have you put any in the wild lately?

 

We had been using a lot of the Fortigates in place of them as we found them to expensive for the features in the UTM range.

[Sir Asvald]

11 minutes ago, NZLaurence said:

What do you think about the ASA's? Have you put any in the wild lately?

 

We had been using a lot of the Fortigates in place of them as we found them to expensive for the features in the UTM range.

I've deployed some. In people's homes and some in SMEs. I believe they are good for what they provide. Most people use them for VPN access such as IPsec. 

 

I've only worked with ASA 5505/5510. Hopefully one day, the ASA 5500-X. 

[leadeater]

9 hours ago, NZLaurence said:

Its really interesting to hear the definition of "router on a stick" used that way. I will have to look it up and find the "Cisco" answer in case it comes up in a exam some time.

I don't think I have ever heard that term at all. I know I haven't done any network certs in a while but how recent is that terminology? None of the networking team at work use it but we wouldn't do that kind of configuration anyway.

 

I have similar configuration at home between a FortiGate 60D and a Cisco SG300 but I wouldn't call it router on a stick, can't say it if you don't know it .

[leadeater]

On 7/15/2017 at 7:07 PM, pomtom44 said:

DHCP - To me there are 3 ways of doing this
1) Put a separate dhcp server on each network which serves only that network
2) Put one dhcp server with multiple NIC's (or virtual nics) serving all networks, as I know dhcp is offered based on the interface subnet it came from
3) Put one dhcp server on either the management network, or another "servers" network, and add DHCP helpers to the router to forward on dhcp requests.

Helpers for everything but the guest network. Setup DHCP on something like the wireless controller or an isolated DHCP VM for the guest network.

 

On 7/15/2017 at 7:07 PM, pomtom44 said:

DNS - Similar sort of deal to the DHCP, (This is for internal dns, not external)
Can you add one DNS server at the top, and do DNS forwarding, similar to the DHCP helper, and if so, how does it work
or do you need to add a DNS server to each network, either a separate one per network, or one with multiple connections in and out.

Same again common DNS servers on trusted networks and a DNS server in the DMZ.

 

On 7/15/2017 at 7:07 PM, pomtom44 said:

and finally, this is a thought I keep coming to when thinking about this all, and how it all works together
Lets say I have a file server available on the network. I want the security network to access part of it to store surveillance footage on, part of it to be open to the private network for people to store files on, and part of it to be open to both the pubic and private network so a guest can drop a file on, and someone can access it from a internal pc.

I know the easy and obvious option would be, just use 3 different file servers, but what if there is only space or budget for one large one.
I know you can do the option of having multiple network cards, one per network, and setting up the file structure to bind to the interfaces.
but doesn't that open up to security risks, having all three networks combining at that point.

That is more a system security question that a networking or network security question. 

 

You can't really bind a file structure to an interface. You can bind the filer server services to listen on certain interfaces but it's an on of off thing. Hence it is a bad idea to share a file server between trusted and un-trusted networks.

 

To actually secure the files you create network shares then setup both share security and file ACL security for who can see/map the network drive and what privileges they have to the share i.e. Read or Read/Write etc.

 

If you could only afford one server you would setup multiple VMs on the server and create two virtual file servers.

[Lurick]

5 hours ago, Abdul201588 said:

I've deployed some. In people's homes and some in SMEs. I believe they are good for what they provide. Most people use them for VPN access such as IPsec. 

 

I've only worked with ASA 5505/5510. Hopefully one day, the ASA 5500-X. 

5500-X aren't much different compared to the 5505 and 5510, just newer code pretty much with a few new features but nothing special.

 

If you really want to get on the cutting edge, look at the Firepower lineup. It supports the latest ASA features in ASA mode and also has Firepower Threat Defense (FTD) mode which is much more advanced and completely different configuration/setup from standard ASA. It does malware and attack detection and prevention in a new and interesting way and provides a lot of cool stuff to mess around with. If you want to play with it I would suggest getting a 5506 or 5508 ASA which can do ASA mode but also incorporates some Firepower stuff, not the full blown experience but gives you a taste  

 

 

12 minutes ago, leadeater said:

I don't think I have ever heard that term at all. I know I haven't done any network certs in a while but how recent is that terminology? None of the networking team at work use it but we wouldn't do that kind of configuration anyway.

 

I have similar configuration at home between a FortiGate 60D and a Cisco SG300 but I wouldn't call it router on a stick, can't say it if you don't know it .

Router on a stick has been around for a few years now at least. It's pretty much just saying you've got a single router with sub-interfaces doing all the VLAN routing.

 

 

5 hours ago, NZLaurence said:

What do you think about the ASA's? Have you put any in the wild lately?

 

We had been using a lot of the Fortigates in place of them as we found them to expensive for the features in the UTM range.

Check out the Firepower 2xxx series firewalls and the ASA 5506 and 5508 models.

[leadeater]

3 minutes ago, Lurick said:

Router on a stick has been around for a few years now at least. It's pretty much just saying you've got a single router with sub-interfaces doing all the VLAN routing

Last time I went on any formal network training was 10 years ago lol. Networking is more of a side thing, a passion of mine but not my job role so I have to try pretty damn hard to keep up to date .

 

Not that I consider myself a slouch at networking or anything. I find it frustrating how little most people outside of networking teams actually understand it, like one of those mythical beats that can never be found.

[Lurick]

Just now, leadeater said:

Last time I went on any formal network training was 10 years ago lol. Networking is more of a side thing, a passion of mine but not my job role so I have to try pretty damn hard to keep up to date .

 

Not that I consider myself a slouch at networking or anything. I find it frustrating how little most people outside of networking teams actually understand it, like one of those mythical beats that can never be found.

Lol, yah not sure exactly when the term started showing up honestly, I just know when I started my schooling in networking about 4-5 years ago it was in the books then but that could have been when it showed up.

 

From what I see you post on here you definitely aren't a slouch  

Definitely agree, people just seem to think everything is "the cloud" and that they just need to connect to it and that's it, lol.

[leadeater]

5 minutes ago, Lurick said:

Definitely agree, people just seem to think everything is "the cloud" and that they just need to connect to it and that's it, lol.

I've been wanting to start up an cloud based networking company. I could reduce wiring and hardware costs by 100% and I'm sure there are business that would pay for it 

 

Business: "Nothing is working"

Me: "It's in the cloud"

[Lurick]

Just now, leadeater said:

I've been wanting to start up an cloud based networking company. I could reduce wiring and hardware costs by 100% and I'm sure there are business that would pay for it 

Haha, yah. It's all wireless and the clouds take care of getting the packets from A to B

It's just like clouds in the sky right?