Network Security and Design for ALM.co.uk

This report proposes a configured network design for the business alm.co.uk and attempts to meet the requirements of the network. It covers network design, subnetting, VLANs, access control list, testing and validation, and protocols for connecting devices.

Running head: NETWORK SECURITY AND DESIGN
Network Security and Design
Name of the Student
Name of the University
Author Note

1NETWORK SECURITY AND DESIGN
Summary
Designing networks and configuring them plays a critical part in ensuring how effective and
efficient the network implementation can be in companies. The report proposes a configured
network design for the business alm.co.uk and attempts to meet the requirements of the
network. First the report presents a summary of these requirements put forward by ALM
where details regarding the arrangement and count of the devices based on the specific
departments that are to be served by the network are given. The report then presents the
network design with the help of a network design diagram created in cisco packet tracer and
duly describes the network, the configuration and how the network equipment connects the
devices. Then the report jumps to the subnetting section where the different subnets created
for the different network segments and their respective details such as size requirement,
allocated address space, network and broadcast address, subnet masks CIDR and IP ranges
are mentioned in a tabular format and discussed thereafter. The report then explains how the
VLANs are used in the network by showing all the VLANs created in the network and how
access can be made from one VLAN to another. However the network is to ensure that none
of the four departments are able to access the other departments and hence appropriate access
control list command are used. The report shows the types of access control list commands
that can be used and mentions the one used by the proposed network to impose the required
restrictions. Next the report carries out tests and validates whether the network meets the
different requirements of alm.co.uk and proves the tests a success with the help of
screenshots. Then after talking about the protocols used for network connectivity and
assigning IP addresses to the devices the report ends with conclusions.

2NETWORK SECURITY AND DESIGN
Table of Contents
Introduction................................................................................................................................3
Network Proposal.......................................................................................................................4
Requirements Summary.........................................................................................................4
Network Design.....................................................................................................................5
Subnetting of the network......................................................................................................6
Use of VLANs........................................................................................................................8
Network Segment Restrictions using Access Control List....................................................9
Testing and Validation.........................................................................................................11
Protocols for connecting devices.........................................................................................13
Conclusion................................................................................................................................14
Bibliography.............................................................................................................................16

3NETWORK SECURITY AND DESIGN
Introduction
The impact designing of networks and their configuration have on effectiveness and
efficiency of networks is evident today and hence the report attempts to propose a configured
network design for the business alm.co.uk as per requirements. The report begins by
presenting a summary of these requirements put forward by ALM where details regarding the
arrangement and count of the devices based on the specific departments that are to be served
by the network are given. The report then presents the network design with the help of a
network design diagram created in cisco packet tracer and duly describes the network, the
configuration and how the network equipment connects the devices. Then the report jumps to
the subnetting section where the different subnets created for the different network segments
and their respective details such as size requirement, allocated address space, network and
broadcast address, subnet masks CIDR and IP ranges are mentioned in a tabular format and
discussed thereafter. The report then explains how the VLANs are used in the network by
showing all the VLANs created in the network and how access can be made from one VLAN
to another. However the network is to ensure that none of the four departments are able to
access the other departments and hence appropriate access control list command are used.
The report shows the types of access control list commands that can be used and mentions the
one used by the proposed network to impose the required restrictions. Next the report carries
out tests and validates whether the network meets the different requirements of alm.co.uk and
proves the tests a success with the help of screenshots. Then after talking about the protocols
used for network connectivity and assigning IP addresses to the devices the report ends with
observations in the concluding notes.

4NETWORK SECURITY AND DESIGN
Network Proposal
Requirements Summary
Network for alm.co.uk is to comprise of four different departments for the different types of
users.
Also, this network is to host four different servers going by the names – web, email, DNS and
the File servers.
It is to be ensured that each of these four servers can be accessible by the devices of all types
of users from all the four departments.
Appropriate subnetting of the network is to be conducted according to the number and
arrangement of workstations and printers present in the particular department.
The network must also support wireless connectivity for the mobile devices and laptops of
all users of the four departments.
The segmentation of the network is to be done by creating separate VLANs for each of the
four different departments.
All the 4 four departments should be restricted from access to any of the other three
departments by means of internal security mechanisms.
The arrangement and count of the devices present in the four different networks are – 48
workstations along with 1 printer for the first department, 18 workstations and 1 printer for
the second department, 11 workstations as well as 1 printer for the third department and 68
workstations as also 1 printer for the fourth department.

5NETWORK SECURITY AND DESIGN
Network Design
Figure 1: Design of ALM network
The above diagram presents the network design for alm.co.uk where the core router of
the company is used to configure the key connectivity measures for the network. Then the
distribution level switch is used to provide the network connectivity for the switches for the
different departments as well as that of the servers and the wireless network. Therefore, it is
in this switch that all the VLANs for all the different segments of the network are created.
After obtaining the connection from the distribution switch, the access layer switches directly
provide connections to the devices present in the segment except for the wireless network
where a wireless access point is used to transmit the wireless signals and connect the support
devices. These respective switches of the access layer use the specific VLANs for connecting
the particular segment. All the four departments are able to access the servers as well as the
wireless network if required. However, none of the departments are allowed to access devices
of any other department. The network thus uses a three-layered hierarchical network model in
a top down approach. The routes of access are configured through inter VLAN routing.
Connections and IP addresses are assigned to the individual devices are using the DHCP

6NETWORK SECURITY AND DESIGN
protocol. Access between one department and another is restricted with the help of access
control list commands.
Subnetting of the network
Name
of
Subnet
s
Requi
red
Sizes
Sizes
of
Alloca
tion
Network
Address
es
CI
DR
Subnet
Masks
Assignabl
e IP
Ranges
Broadcast
Addresse
s
First
Depart
ment
49 62
192.168.
168.0
/26
255.255.2
55.192
192.168.1
68.1 -
192.168.1
68.62
192.168.1
68.63
Second
Depart
ment
19 30
192.168.
169.0
/27
255.255.2
55.224
192.168.1
69.1 -
192.168.1
69.30
192.168.1
69.31
Third
Depart
ment
12 14
192.168.
170.0
/28
255.255.2
55.240
192.168.1
70.1 -
192.168.1
70.14
192.168.1
70.15
Fourth
Depart
ment 4
69 126
192.168.
171.0
/25
255.255.2
55.128
192.168.1
71.1 -
192.168.1
71.126
192.168.1
71.127
Subnet
for
4 6 192.168. /29 255.255.2 192.168.1
72.1 -
192.168.1

7NETWORK SECURITY AND DESIGN
Servers 172.0 55.248
192.168.1
72.6
72.7
Subnet
for
Wireles
s
Networ
k
250 254
10.11.12.
0
/24
255.255.2
55.0
10.11.12.1
-
10.11.12.2
54
10.11.12.2
55
The subnetting used for the network of alm.co.uk is provided in the above table.
Different subnets are created for the four different as well as for the servers and the wireless
network. IP networks addresses 192.168.X.0 are used for the segments that deal with
providing wired access to devices where X refers to the changing octet of the subnets and the
network address 10.11.12.0 is used for providing wireless connectivity to supported devices.
Since the access routes are configured through inter VLAN routing the third octet of the
different subnets required to be different. Hence the different subnets for the different
segments of the network are 192.168.168.0, 192.168.169.0, 192.168.170.0, 192.168.171,
192.168.172 and 10.11.12.0 for the first department, second department, third department,
fourth department, the servers and the wireless network respectively. The subnet masks for
these different subnets are 255.255.255.192, 255.255.255.224, 255.255.255.240,
255.255.255.128, 255.255.255.248 and 255.255.255.0 while the corresponding CIDR values
are /26, /27, /28, /25, /29 and /24 respectively. As can be noticed, the IP addressing scheme
used here is CIDR or classless interdomain routing. This is because of the immense benefit it
brings to businesses by ensuring that least allocated address space is wasted. CIDR addresses
the issue of wastage of allocated address space offering make incremental transitions when

8NETWORK SECURITY AND DESIGN
creating subnets and as a result has become the preferred IP addressing scheme by replacing
the inefficient classful addressing scheme.
Use of VLANs
Figure 2: Different VLANs for segmentation of AML network
The above screenshot shows the different VLANs that have been created for the
various segments of the network of alm.co.uk. These are the VLANs with VLAN No. 12,
168, 169,170, 171 and 172. If looked carefully these are the same numbers found in the third
octet of the different subnets. For the routes of access to be configured through inter VLAN
routing, it is essential that the VLAN number matches the third octet of the subnets. The

9NETWORK SECURITY AND DESIGN
distribution layer switch is connected to the router as well as the switches of the access layer
in switchport mode trunk. The lower layer switches connect the individual devices or the
wireless access point through switchport mode access.
Network Segment Restrictions using Access Control List
Access control list extended are a set of commands which can be used to restrict access of a
particular network segment from another segment of the network. The commands can be used
to block several kinds of network access like echo request or echo reply as also other requests
as can be found in the below screenshot.
Figure 3: Access control list commands for restricting access

10NETWORK SECURITY AND DESIGN
To restrict each of the four departments from accessing one another, it is ensured that
the devices of the departments cannot send or receive packets from either side. To perform
this the deny ICMP echo request command is applied on the departments. This process can be
seen in the following screenshot where the echo requests to all remaining departments are
being denied. Similarly, this process is repeated for all other departments so that no
department can send packets to another department. After using the commands it is necessary
to use the permit command to allowing other connections to and from these departments.
Figure 4: Applying access control list command to deny sending packets

11NETWORK SECURITY AND DESIGN
Testing and Validation
To check if the proposed network is suitable for alm.co.uk, it is to be validated that
the network requirements specified in the requirements summary are met. Hence the testing
and validation process carries out test to check if the devices of the four departments are
indeed restricted from accessing that of other departments. Below screenshots for tests from
each department is provided.
Figure 5: Ping from Department 1 to other departments
Figure 6: Ping from Department 2 to other departments
Figure 7: Ping from Department 3 to other departments
Figure 8: Ping from Department 4 to other departments

12NETWORK SECURITY AND DESIGN
The above four screenshots prove that the departments are restricted from sending
packets to any other department in the network. PC0, PC1, PC2 and PC3 represent devices of
department 1, department 2, department 3 and department 4 respectively.
Figure 9: Ping from Department 1 to the four servers
Figure 10: Ping from Department 2 to the four servers
Figure 11: Ping from Department 3 to the four servers
Figure 12: Ping from Department 4 to the four servers
Figure 13: Ping from smartphones to the four servers

13NETWORK SECURITY AND DESIGN
These five screenshots show that all the devices of all types of users from all network
segments are able to access the four different servers which are the web server, the email
server, the DNS server and the File server.
As a result, it is understood from the testing and validation process that the proposed
network design and the configuration applied can help alm.co.uk meet their requirements.
Protocols for connecting devices
The protocol used for assigning IP addresses to the individual devices is DHCP. It is
evident that the company ALM requires to connect a lot of devices. This makes consistently
configuring the network with static addresses for the different departments, painstaking and
sometimes confusing. By using the DHCP protocol, these IP addresses can be assigned to the
devices automatically in the best order chosen by the router. This eliminates overburdening
the network administrators and ensures the network is correctly configured and operating as
desired.

14NETWORK SECURITY AND DESIGN
The above screenshot shows how the smartphones of the wireless network
successfully obtain their IP addresses using DHCP. Devices of all the different segments are
hence being assigned IP addresses automatically through DHCP and the Internet protocol in
use here is IPv4.
Conclusion
In conclusion the report succeeds in highlighting the impact designing of networks
and their configuration have on effectiveness and efficiency of networks is evident today and
hence the report attempts to propose a configured network design for the business alm.co.uk
as per requirements. The report begins by presenting a summary of these requirements put

15NETWORK SECURITY AND DESIGN
forward by ALM where details regarding the arrangement and count of the devices based on
the specific departments that are to be served by the network are given. The report then
presents the network design with the help of a network design diagram created in cisco
packet tracer and duly describes the network, the configuration and how the network
equipment connects the devices. Then the report jumps to the subnetting section where the
different subnets created for the different network segments and their respective details such
as size requirement, allocated address space, network and broadcast address, subnet masks
CIDR and IP ranges are mentioned in a tabular format and discussed thereafter. The report
then explains how the VLANs are used in the network by showing all the VLANs created in
the network and how access can be made from one VLAN to another. However the network
is to ensure that none of the four departments are able to access the other departments and
hence appropriate access control list command are used. The report shows the types of access
control list commands that can be used and mentions the one used by the proposed network to
impose the required restrictions. Next the report carries out tests and validates whether the
network meets the different requirements of alm.co.uk and proves the tests a success with the
help of screenshots. Then the report ends after talking about the protocols used for network
connectivity and assigning IP addresses to the devices.

16NETWORK SECURITY AND DESIGN
Bibliography
Čabarkapa, D., 2015. Application of Cisco Packet Tracer 6.2 in teaching of advanced
computer networks. INFORMATION TECHNOLOGY AND DEVELOPMENT OF
EDUCATION ITRO 2015, p.153.
Chamberlin, J., Hussey, J., Klimkowski, B., Moody, W. and Morrell, C., 2017, September.
The Impact of Virtualized Technology on Undergraduate Computer Networking Education.
In Proceedings of the 18th Annual Conference on Information Technology Education (pp.
109-114). ACM.
Garrison, W.C., Shull, A., Myers, S. and Lee, A.J., 2016, May. On the practicality of
cryptographically enforcing dynamic access control policies in the cloud. In 2016 IEEE
Symposium on Security and Privacy (SP) (pp. 819-838). IEEE.
Han, X., Fu, Y., Jiang, J. and Wang, C., 2015. A deadlock-free subnetting mechanism for
high performance broadcasting in NoC. IEICE Electronics Express, 12(19), pp.20150688-
20150688.
Jenkins, H., Moran, D. and Hester, E., 2018. Architecting DHCP and the Internet Using Top.
International Journal of Software Systems Research and Methodology, 1(1).
Kelley, M., Grimes, K., Martin, P. and Reynolds, H., 2018. On the Deployment of DHCP.
Journal of Computer Science and Software Engineering, 9(4).
Koerner, M. and Kao, O., 2016. MAC Based Dynamic VLAN Tagging with OpenFlow for
WLAN Access Networks. Procedia Computer Science, 94, pp.497-501.
Laing, R., Smith, S., Sixtus, J. and Hardy, J., 2019. Deconstructing DHCP Using Zobo.
International Journal of Software Systems Research and Methodology, 3(1).

17NETWORK SECURITY AND DESIGN
Liu, X., Holden, B. and Wu, D., 2017, July. Automated synthesis of access control lists. In
2017 International Conference on Software Security and Assurance (ICSSA) (pp. 104-109).
IEEE.
Nguyen, V.G. and Kim, Y.H., 2016. SDN-Based Enterprise and Campus Networks: A Case
of VLAN Management. Journal of Information Processing Systems, 12(3).
Odi, A.C., Nwogbaga, N.E. and Chukwuka, N.O., 2015. The Proposed Roles of VLAN and
Inter-VLAN Routing in Effective Distribution of Network Services in Ebonyi State
University. International Journal of Science and Research, (7), pp.2608-2615.
Othman, M.Z., 2015. Peperiksaan Akhir Semester 1 Sesi 2015/2016-Computer networking
(MTN3023).
Raihan, M.A. and Afroze, M., 2016. Securing a Network by Using VLAN, Port Security and
Access Control List (Doctoral dissertation, East West University).
Rentschler, M., Trsek, H. and Dürkop, L., 2016, July. OPC UA extension for IP auto-
configuration in cyber-physical systems. In 2016 IEEE 14th International Conference on
Industrial Informatics (INDIN) (pp. 26-31). IEEE.
Sari, L.M.I., Hatta, P., Wihidayat, E.S. and Xiao, F.E.N.G., 2018. A comparison between the
Use of Cisco packet tracer and graphical network simulator 3 as learning media on students’
achievement. Jurnal Pendidikan Teknologi dan Kejuruan, 24(1), pp.132-136.
Singh, D.A.K., 2015. Internet Protocol (IP) Address–Subnetting and Supernetting. Int. J.
Emerg. Trends Technol. Comput. Sci, 4, pp.87-90.
Toler, J., Barnes, P., Manzone, J. and Brown, M., 2019. Emulating DHCP Using Relational
Archetypes. International Journal of Software Systems Research and Methodology, 2(1).

18NETWORK SECURITY AND DESIGN
Vanickis, R., Jacob, P., Dehghanzadeh, S. and Lee, B., 2018, June. Access Control Policy
Enforcement for Zero-Trust-Networking. In 2018 29th Irish Signals and Systems Conference
(ISSC) (pp. 1-6). IEEE.
Yaibuates, M. and Chaisricharoen, R., 2018. Implementing of IP address Recovery for DHCP
Service. International Journal of Applied Engineering Research, 13(5), pp.2659-2662.
Zheng, S., Li, Z. and Li, B., 2017, March. Implementation and application of ACL in campus
network. In AIP Conference Proceedings (Vol. 1820, No. 1, p. 090014). AIP Publishing.