Detailed Report: SMSD Digital Learning VPN Implementation and Security

This report details the implementation of a Virtual Private Network (VPN) for the Shawnee Mission School District (SMSD) to enhance the security of its digital learning initiative. The report outlines the objectives, which include highly secure and available networks, optimized network security, and scalable infrastructure. It covers network planning, the equipment used (firewalls, gateways, switches, routers, web servers), and security implementations such as CCP, VPN tunneling, SSH, and IPS. The report also explains the Cisco Configuration Protocol (CCP), VPN tunneling protocols, and encapsulation techniques. Detailed network diagrams and configurations are provided, illustrating how the VPN is set up to protect data and provide secure access for students and teachers. The report emphasizes the importance of security layers, including firewalls, VPNs, IPS, and SSH, to safeguard the network from threats. The conclusion highlights the successful implementation of the VPN, ensuring secure connectivity and data protection within the SMSD's digital learning environment.

VIRTUAL PRIVATE NETWORKS

Table of Contents
1. Introduction........................................................................................................................................2
2. Objectives............................................................................................................................................2
3. Network planning...............................................................................................................................3
4. Equipment used..................................................................................................................................3
5. Security implementations used in the network CCP..........................................................................6
6. CISCO Certificate Protocol..................................................................................................................6
7. VPN tunneling and encapsulation......................................................................................................9
8. SSH and Secure trunks......................................................................................................................10
9. IPS implementation..........................................................................................................................11
10. VPN Diagram.................................................................................................................................13
11. Network diagram and explanations.............................................................................................14
12. Conclusion.....................................................................................................................................24
13. Reference......................................................................................................................................25
1

1. Introduction
SMSD is major School districts. It will be decided to launch the digital learning initiative. The digital
learning initiative will be helpful for students and teachers. It allows the students and teachers to
transform the information. The sixth grade students get the information through the iPad and the
twelfth grade students get the information through the MacBook Air computers. The teachers get the
information through both iPad and MacBook Air computers. The security problem will be appeared in
the digital learning. It is very complex .To avoid the security problem, SMSD decided to provide firewall
authentication in the digital learning. The process of firewall authentication will be done by the ELA
(Enterprise License Agreement) with cisco.it will be provide solution for collaboration also. Three tools
will be used to avoid the collaboration. The tools are Cisco collaboration meeting tool, Cisco WebEx and
cisco spark. It reduced the security managing problem and complexity. VPN allows the end users to
connect securely to the remote network via servers run by VPN providers. Since the data is fully
encrypted the data cannot be hacked and misused by man in the middle. The privasy of the users can be
hidden while using VPN. Censorships can be evaded. Many services may not be available to few
countries. VPN allows them to access those services too. When using public Wifi hotspot , the devices
can be protected from hackers. P2P downloads can be done very safely.
2. Objectives
Security Objectives
 Highly secured and highly available network
 High quality of video and data transfer between teachers and students
 Optimized network security that provided well secured voice and data applications
 For better information security traffic isolation should be there
 Secured tunneling like GRE with MPLS
 Scalable network to take care of future expansion
Business Objectives
 A secured network infrastructure that supports voice , video and data traffic
2

 Good isolation between teachers and students
 Good network connectivity between teachers and students
 Capability to expand the IT infrastructure
3. Network planning
The network for Shawnee Mission School District (SMSD) is planned in such a manner that full
security is provided to the network. It is a big network that remains as home to 27,500 students. It has 5
high schools, one alternative high school, five middle schools and 33 elementary schools. The district is
planning to launch well maintained digital learning platforms. The district has planned to launch 30,000
new devices and that devices has to be linked in a secure network. Secure network in the sense it should
be away from the hackers [1]. That is the network has to be designed in a manner that provides security
to the network that help the students to execute the studying tasks painlessly. The district also planned
to use CISCO's licensed Identity Service Engine. The school Network's sample diagram has been designed
using Cisco packet tracer. The sample diagram has 3 routers, two switches and 2 PC clients. The number
of routers, switches and clients can be extended. As this is a macro level project, it is able to provide
only the sample diagram showing minimum number of devices. The security is specified as a important
feature in the network planning and hence more security layers are attached.
4. Equipment used
Firewall
It controls the communication between authenticated user and unauthorized user. It provides
the security for the user’s network. It is one type of network security. It provides the permission for
accessing the network in the secured network [2]. The firewall is implemented as a hardware and
software.one could built the firewall as both hardware and software.
Basic types of firewall
1. Proxys firewall
2. packet filters
3. Stateful inspection firewall.
3

Gate Way
The gate way is used to connect two different protocols for connecting two networks. It is one
of the network nodes. The router is gateway to connect the home network to the internet [3].
Types of gateway
1. Cloud storage gateway
2. API,SOA gateway
3. Email security gateway
4. VoIP trunk gateway
5. Amazon API gateway
6. media gateway
Switch
Switch is a high speed device.it is used to send and receive the data. It is Ethernet based one. It
is more all as similar to router and hub.
Types of switch
1. LAN switch
2. Routers
3. Managed switch
4. Unmanaged network switches.
LAN
LAN stands for Local Area network. It is one type of computer network.it covers only small
region [4]. It works based on the Ethernet. One could build LAN for small region, like home, schools etc.
Uses of LAN
i. It is used for share the information among the workers and collaborators.
ii. It is used to share software licences.so it saves the cost.
iii. It is used to share high cost hardware.
Web server
4

Webserver is used for delivering the web pages. By installing the server software and
connecting the system to the internet, one could made any computer as a webserver. By retransmit the
HTML files in the HTTP connection, one could create the website with the help of webserver [5]. Web
server will be having one or multiple IP Addresses. It will be hosting many domains.
Types of webserver
1. Nginx Web server
2. Light speed web server
3. Apache web server
4. IIS web server
Some features of webserver
1. Server side scripting
2. virtual hosting
3. Bandwidth throttling
4. Support for large files.
Benefits of webserver
1. Easy to manage the applications
2. uptime guarantee
3. Hassle-free deployment and installation.
4. Round the clock support.
Router
Router is one type of networking device. Router connects many different networks. The pockets
reach the router. The router reads the source and destination IP addresses of the pocket and guides it to
the next router. The traffic directing functions is performed at the internet by router. It transfers the
data packets between the computer networks [6].
Types of router
1. Virtual router
2. Edge router
3. wired router
5

4. Wireless router
5. Broadband router
6. Inter provider border router
7. subscribe edge router
5. Security implementations used in the network CCP
First layer-Firewall - This firewall is mainly used to provide the security [7]. To safeguard the network
Firewall is set to protect it.
Second layer-VPN - To enable the license of security technology package in order to complete the
activity.
Third layer-IPS- it can able to encapsulate the traffic in a single device.
Fourth layer-SSH- this is can also provide the security shell for the network.
6. CISCO Certificate Protocol
CCP is nothing but the Cisco Configuration Protocol. CCP is a tool created to operate under the
windows operating system. It is a tool designed for device management. Router can be efficiently
configured using CCP [8].
Requirements
1. 3 routers
2. 2 switches
3. PC-1: Windows XP, Vista, or Windows 7
4. Serial and Ethernet cables
5. Rollover cables
Basic Network Device configurations
Objectives:
 To Cable the network
6

 To Configure IP addresses for routers and PCs.
 To configure routers.
 To Verify connection between hosts and routers
Steps followed
1) The devices are attached as per the topology for establishing proper connection among devices
2) The hostnames, Interface IP addresses are configured as follows
3) DCE cable is used to configure a clock rate for routers [9].
4) DNS lookup is disabled to stop the router translate incorrect commands including the
hostnames
5) configuration of static routes are done
a. R0 to R1
b. R2 to R1
c. R1 to R0 LAN
d. R1 to R2 LAN
6) Configuration of EIGRP routing protocols are done.
a. For R0
b. For R1
c. For R2
7) A static IP address, subnet mask and default gateway for PC-0 and PC-1 are done
a. PC-0
b. PC-1
8) Verification of connectivity
Pinging test
Pinging of PC-1 on the R2 LAN from PC-0 on the R0 LAN is done. The ping result is successful.
Pinging of PC-1 on the R2 LAN from PC-0 on the R0 LAN is done. The ping result is successful.
Configuration of CCP Access for routers
Objectives
 HTTP/HTTPS can be configured
 User accounts with higher permissions can be created
7

 SSH and Telnet will be created
Procedure
1) Router is connected using Telnet or SSH console.
2) Router HTTP or HTTPS server is enabled
3) A user with privilege level 15 is created.
4) SSH and Telnet login are configured
CCP configuration
Objectives
 To install CCP.
 To manage communities.
 To discover router devices.
Procedure
1. CCP is installed using the link provided.
2. Start--> Cisco Configuration Professional--> Select / Manage Community window--> Ok
3. Dashboard--> Discover--> connect to R2
4. IP for select community number is provided.
7. VPN tunneling and encapsulation
VPN stands Virtual Private Network. To provide the security and privacy for Public and private
network, VPN is used. It acts like an internet and Wi-Fi hotspot. The data transformation between the
computer network and remote user is securely done by the VPN. To saves the secure data, VPN is used
in the corporate world [10].
Benefits of VPN
i. Data could be encrypted.
ii. Provide security and protection for Wi-Fi connection.
iii. One could replace original IP.
iv. With the help of VPN, censorship is avoided.
8

VPN Tunneling protocols
1. PPTP - Point to point tunneling protocol
2. L2TP-Layer two Tunneling
3. Open VPN-Internet protocol security
VPN Tunneling
Tunneling is a protocol. It provides the security for transfer the data from the one system to
another system. Port forwarding is another name for tunneling. The private network communications is
provided to the public network by using the tunneling process [11].
VPN Encapsulation
It is the process of translating the data from one protocol to another protocol. That is transfer
the data from source to the destination.
Objective
 To configure a site to site virtual private network.
 Configuration procedure for VPN
 A password of minimum length is configured after checking the connectivity between the
devices.
 Basic consoles are configured by following the specified router commands
 Pass word encryption is used to encrypt the clear text passwords [12].
 Basic running configurations are configured.
 The configurations are saved for future reference
 Connection of the devices is tested and then IKE policies are enabled.
 ISAKMP policy parameters are configured.
 Pre shared keys are configured.
 Transform the IPsec set
 A crypto map is created and applied.
 ISAKMP security is associated.
9

8. SSH and Secure trunks
SSH stands for secure Shell. It is used for protecting the system from attacks. The attacks are
DNS spoofing, IP source routing and IP spoofing. It is used for transferring the files from one machine to
another. By using associated SSH file transfer, one could transfer the files. The secured copy protocols
also used for transfer files. The secure authentications are provided at insecure channels by SSH. It is a
network protocol. To remotely access and manage a device, SSH is used [13]. It is used for supporting
some operations like forward the TCP ports, tunneling and X11 connections. It is used for data
encryption.
The SSH protect system from following risks
1. Data manipulation
2. Sniffing of data transmission.
3. IP address spoofing
4. spoofing of DNS
5. Routing of a source of an IP source.
Benefits of SSH
1. It is used to avoid the attack.
2. It provides the Authentication for system.
3. It is used for hosting the control.
Secure Trunk
Trunk is one type of communication link. It is used to provide network access between two
points with multiple signals. It connects the switching centers. The bandwidth of single cable is increased
by Trunk. Because the trunk has multiple cables and wires. It is also used for sharing the frequency to
the more number of users.TO connect the switching nodes, trunk is used [14]. The switching nodes may
be PBX (private branch exchange) and central offices. Two types of trunk are there. Trunk Port, Port
Trunking
i. Trunk port-takes the data from the virtual local area network in the single interconnect. This
inter connect is present between the switches and router.
ii. Port Trunking - It gives permission for multiple physical links to make the higher capacity, single
and more reliable logical link.
10

9. IPS implementation
IPS is nothing but the intrusion prevention system. IPS is used to detect security problems. IPS
provides the layer of security next to the firewall [15].
Objective
 To verify Access to the R0 LAN from R1
 To prepare the Router and TFTP Server
 To Configure the IPS Crypto Key
 Configure IPS
 Load the IOS IPS Signature Package to the Router
 Test the IPS Rule and Modify a Signature
 Test IPS with Super Scan
Procedure
1) Ping from R1 to R0.
2) Ping from R1 to PC-0 on the R0 LAN.
3) Display the R0 running configuration prior to configuring IPS.
4) Verify the availability of Cisco IOS IPS files.
5) Verify or create the IPS directory in router flash on R0
6) Locate and open the crypto key file
7) Copy the contents of the text file
8) Apply the contents of the text file to the router
9) Create an IPS rule
10) Configure the IPS Signature storage location in router flash memory.
11) Enable IPS SDEE event notification
12) Enable IPS syslog support
13) (Optional) Download and start the syslog server
14) Configure IOS IPS to use one of the pre-defined signature categories
15) Apply the IPS rule to an interface
16) Save the running configuration
17) Download the TFTP server
11