Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is what I am trying to do. I think the professor thinks we know more than we do

The Directorate of Diplomatic Officers has recently agreed a new network infrastructure to connect its 3 international offices in Rome, Cambridge and Chicago.
Your task is to complete the design and produce a working prototype configuration to prove the implementation will work. .

The offices in Cambridge, Chicago and Rome will be interconnected via resilient T1 mesh network. The clock rates are provided by Cambridge and Rome.

It is anticipated there are requirements for around 2300 hosts at the Chicago office and a potential 1093 hosts at both the Rome and Cambridge offices.
There will be 12 further offices within Europe in the next 2 years each with a minimum of 550 hosts each.

The Cambridge office is used to host a connection to the Internet via a Managed Ethernet Connection (Fast Ethernet) with an allocated address of 209.123.234.5/30.

As the organisation has not previously been connected to the Internet, they have not been allocated a block of addresses to use other than the dedicated Internet link.
The new network design must use a configuration to reflect this lack of addresses and utilise appropriate addressing through use of RFC1918 addresses

The organisation needs to implement a security policy on a suitable router to

• Ensure that only users from its main 3 offices can attach to the corporate data centre at 199.199.199.199.
• Only Chicago users on the Administration VLAN are able to access the Finance Server hosted at an ASP at address 200.200.200.200, utilising an application on Port 1234 using TCP. • Only Rome and Cambridge users are able to access an EU Research database using http, https and ftp (remember ftp uses two ports) on address 194.123.88.99 • All users need to access an off-site email server running both IMAP/POP3/SMTP in the appropriate directions on address 180.145.22.33. • Block access to a range of file-sharing networks using IRC where demotivated employees are downloading copyrighted material using networks 206.206.83.0, 206.207.82.0, 206.207.83.0, 206.207.84.0 & 206.207.85.0. • only internal initiated connections are permitted to access the Internet.

All security violations must be logged in an appropriate syslog server.

I have the topology set up along with the addressing scheme. The issue I am having is trying to get the vlans to talk to the rest of the networks.

E.G: I have the 10.0.16.254 as the gateway. I have set up the servers on VLAN's using the switch. I have say VLAN 10 as the research db with an IP of 194.123.88.99. I can't get this to get out to any of the other offices as the gateway is on a different network.

I was wondering how I get around this so that it all converges.

Thanks in advance

share|improve this question
    
You have to be a lot more specific (netmasks, goal, topology (available hardware), ...). Otherwise the only correct answer is "it depends". @william said it: with the right netmasks, they're all in the same subnet. Otherwise you need a router. So you know if you need a router :) –  scherand Mar 31 '13 at 16:16
    
Juniper: Network Fundamentals is a good resource to learn about networking –  scherand Mar 31 '13 at 16:31
    
Wow... I think you are not meant to use VLANs for access control (that's not the idea of VLANs after all) but write an ACL for "your" router allowing only Rome and Cambridge (read: the networks you assigned to Rome and Cambridge, but not e.g. Chicago) to connect to the research DB (194.123.88.99) which is hosted outside your network (i.e. users need to use the Internet connection to reach it). –  scherand Mar 31 '13 at 21:17
    
The thing with the VLAN should probably indicate that you need to split the range you assigned to Chicaco in two (at least): an administration and a "regular" range. You can then use a VLAN on your router to accommodate the administration network although I currently don't see why you would want do that (i.e. I don't think you need a VLAN for this). The assignment is not too clear for me... –  scherand Mar 31 '13 at 21:21

1 Answer 1

up vote 0 down vote accepted

It really depends what you are trying to achieve... With the correct subnet mask, if all of these machines are on the same local switch, you could have direct communications.

If they have different subnets that do not overlap in anyway, they will be as good as isolated and VLAN will simply take this a step further for security...

... however, I can't really say if it is appropriate without actually knowing what you are trying to achieve as this is a really weird setup.

share|improve this answer
    
Hi William, it is a really weird setup. It's for a class I am taking. I need to implement ACLs accordingly. I was just wondering if I should put them on VLANs or just use loopbacks addresses to represent the access. I am probably not being clear enough and I apologise for this. I am just wondering if VLANs would be more appropriate than just loopbacks –  Chris Mar 31 '13 at 15:48
    
If you don't need them to have access to anything else / no gateways involved, why not just disable the network card all together! Can't get more secure than not connected!... But, again, I really need to know more about what you are trying to achieve –  William Hilsum Mar 31 '13 at 16:23
    
This is what is trying to be achieved. It is for a lab that the professor has given us to try The Directorate of Diplomatic Officers has recently agreed a new network infrastructure to connect its 3 international offices in Rome, Cambridge and Chicago. The offices in Cambridge, Chicago and Rome will be interconnected via resilient T1 mesh network. The clock rates are provided by Cambridge and Rome. requirements for around 2300 hosts Chicago, 1093 hosts Rome and Cambridge offices. There will be 12 further offices within Europe in the next 2 years each with a minimum of 550 hosts each. –  Chris Mar 31 '13 at 16:45
    
The Cambridge office is used to host a connection to the Internet via a Managed Ethernet Connection (Fast Ethernet) with an allocated address of 209.123.234.5/30. As the organisation has not previously been connected to the Internet, they have not been allocated a block of addresses to use other than the dedicated Internet link. The new network design must use a configuration to reflect this lack of addresses and utilise appropriate addressing through use of RFC1918 addresses The organisation needs to implement a security policy on a suitable router to –  Chris Mar 31 '13 at 16:45
    
Ensure that only users from its main 3 offices can attach to the corporate data centre at 199.199.199.199. • Only Chicago users on the Administration VLAN are able to access the Finance Server hosted at an ASP at address 200.200.200.200, utilising an application on Port 1234 using TCP. • Only Rome and Cambridge users are able to access an EU Research database using http, https and ftp (remember ftp uses two ports) on address 194.123.88.99 • All users need to access an off-site email server running both IMAP/POP3/SMTP in the appropriate directions on address 180.145.22.33. –  Chris Mar 31 '13 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.