Advanced Networking

Phase 1: Implementing IPv6

Ahmarijah (AJ) Andrews

IT305-1602B-01

Instructor: Brian Rodgers

May 23, 2016

Executive Summary

[ Create this AFTER completing P5IP… it should summarize the most important points that an executive would want to know relative to what is IN the document. The Index or Table of Contents would follow so that they know where to find more information. ]

Table of Contents

IT305-1503A-01 Network Upgrade Project Plan Executive Summary 1
Table of Contents 2
Section 1: Implementing IPv6 4
Section 2: Network Infrastructure Design 5
Section 3: Linux Networking 6
Section 4: Analyzing Network Traffic 7
Section 5: Network Security 9
References 12
Section 1: Implementing IPv6

Honeywell International

It has been decided that as our presence grows on the global market we have decided that we need to stay better connected with all our subsidiaries and partners. Currently we all connect using IPv4 which as and addressing protocol that has roughly 4billion different combination. But seeing as we currently have approximately seven billion people on this planet let’s say just 1 billion of these people are in the industrialized world. Now for each of these one billion individuals they each have a cell phone that connects to the internet. That’s 1 billion IPv4 addresses used. But let’s not forget that each of these people needs a computer at home for whatever people use computers for now a days, that adds up to an additional 1 billion IPv4 addresses. Let’s face it; currently we recycle IP addresses because we just don’t have enough addresses for every individual. It may seem like everything is operating just fine but it’s actually not. Information is moving much too slowly and there are too many handshakes taking place before our data gets to the required destination. Hence the need to upgrade to and IPv6 address. With IPv6 we can guarantee that every device which needs a network connection can do so without having to wait to receive a temporary address. That means our data will get where it need to go faster regardless of size when compared to IPv4. As a reminder it should be known that IPv4 and IPv6 networks are not interoperable and the number of devices that use IPv4 number is still great. Some of these devices do not support IPv6 at all, so the migration process is necessary since IPv4 and IPv6 will likely coexist for some time.

First of all we will need to train our employees on how to properly transition to IPv6. We will need to make sure our existing equipment is capable of transitioning to the new protocols. Honeywell will need to check that our firewalls are not blocking any Internet Control Message Protocol version 6 (ICMPv6). ICMPv6 is an integral part of IPv6 and performs error reporting and diagnostic functions and has a framework for extensions to implement future changes.

We will have to contact our ISP provider at AT&T to ensure they are informed and work congruently with them on the change. They need to ensure we have the necessary equipment to make the change. We need room in order to grow and increase our presence online. We will have to go through The American Registry for Internet Numbers (ARIN) to get our internet number. That should be were out friends at AT&T come in.

After we make the necessary arrangements with or internet providers we will have to begin auditing our hardware. Since we still plan on changing our telephone service to voice over IP (VoIP) making sure the necessary equipment is available is paramount to a smooth transition. After inspecting the company’s hardware makes sure you exchange out any non-acquiescent hardware so that no delay of transmission ensues.

Steps to configure IPv6 on a Juniper router
When you are setting up IPv6 on a Juniper router you will need to make sure that the firewall filter does not have any requests for it to block any IPv6 addresses. You must then do routine maintenance and update the filter. Then requests from HPC-CERT or HPCMPMO to impassable ports here is an example of Juniper router commands.
Set interface Io0 unit 1 family inet6 address 2001:db8::1
Set interface fe-1/2/0 unit 1 family inet6 address 2001:db8:0:1::/64 eui-64
Set interface ge-0/1/0 unit 6 family inet6 address 2001:db8:0:6::/64eui-64

Protocols
Routing concepts remain same In case of IPv6 but almost all routing protocols have been redefined accordingly.
There exist two forms of routing protocols: • Distance Vector Routing Protocol: A router running distance vector protocol advertises its connected routes and learns new routes from its neighbors. The routing cost to reach a destination is calculated by means of hops between the source and destination. A router generally relies on its neighbor for best path selection, also known as “routing-by-rumors”. RIP and BGP are Distance Vector Protocols. • Link-State Routing Protocol: This protocol acknowledges the state of a Link and advertises to its neighbors. Information about new links is learnt from peer routers. After all the routing information has been converged, the Link-State Routing Protocol uses its own algorithm to calculate the best path to all available links. OSPF and IS-IS are link state routing protocols and both of them use Dijkstra’s Shortest Path First algorithm.
Routing protocols can be divided in two categories: • Interior Routing Protocol: Protocols in these categories are used within an autonomous system or organization to distribute routes among all routers inside its boundary. Examples: RIP, OSPF. • Exterior Routing Protocol: An Exterior Routing Protocol distributes routing information between two different autonomous systems or organization. Examples: BGP.

Routing protocols

• RIPng: stands for Routing Information Protocol Next Generation. This is an Interior Routing Protocol and is a Distance Vector Protocol. RIPng has been upgraded to support IPv6. • OSPFv3: Open Shortest Path First version 3 is an Interior Routing Protocol which is modified to support IPv6. This is a Link-State Protocol and uses Djikrasta’s Shortest Path First algorithm to calculate best path to all destinations. • BGPv4: BGP stands for Border Gateway Protocol. It is the only open standard Exterior Gateway Protocol available. BGP is a Distance Vector protocol which takes Autonomous System as calculation metric, instead of the number of routers as Hop. BGPv4 is an upgrade of BGP to support IPv6 routing.

Section 2: Network Design

IP address ranges for VoIP Network
When it comes down to it IP addresses you need to have a plan for your IPv6 deployment. You first need to make sure that your network is compatible IPv6; you need to make sure you have enough space for all the IP addresses. You will need a networking and computing assessment this requires the authentication that your network is IPv6 comparable with your system. To do this you need to take an account of the system. If the company retains accurate up to date records then there is no need to account for the system. When you are taking an account of the system you might want to log in your IPv4 address space this can help down the line. The next step is classifying your IPv6 ability then you need to look at vendor declarations for provision and compatibility at first. You can then conclude the mitigation steps you will need to set the system up. Here are some examples of IPv6 addresses, 2001:0db8::0001 is not acceptable and must be represented as 2001:db8::1 and
2001:db8:0:0:0:0:2:1 must be shortened to 2001:db8::2:1

VoIP security in your network
There are many things you need to thank about when it comes to securing your VoIP network. There are many different kinds of attacks; some of themes are Denial of Service Attacks then there is Theft of Service and Interception of Calls to name a few, Denial of Service Attacks happen when someone is transferring unauthentic traffic to VOIP services or endpoints to disrupt your network. Luckily there should be countermeasures in place for such an attack. When they try and use Theft of Service the options are Encryption, you may also try Physical security; last but not least try secure wireless networks or VoIP protocols. In the case of Interception of Calls use the same measures you used for Theft of Service Encryption, Physical security; and secure wireless networks,
Hardware required in the implementing of an IP Phone System
First of all you need to remember when you are implementing an IP Phone System you have a few choices of what IP phone system you want. You may choose to install an IP PBX or you can go with the IP voice system. You just need to make the right choice for the company. If you decide on the IP PBX you will need to put in a voice gateway like the Cisco’s SPA8000 you may attach up to eight phones on your network and figure out how many IP headphones you will need. If you choose IP voice system you will need to make a few more judgments regarding what features you would like. They have music when you are on hold and whether or not to have voicemail also how many phone lines you will need. You might want to install Cisco’s Small Business Communications 500 Series; it will handle up to one hundred IP phones. The next step is to get the network ready to do this you need to make sure that the network has enough space to handle the traffic. That way there is no dropped calls in some cases calls might get more priority than data movement. Next you will want to install the product. This is the hardest part when putting in an IP PBX or an IP voice system remember it can and will affect your entire network it’s performance. You need to work together with another IT professional to make sure the network is running right.

Section 3: Linux Networking

Section 4: Analyzing Network Traffic

Section 5: Network Security

Security is a very important concept of a business and we should implement a strong security initiative so that the company can continue to grow in the rapid speed it is moving in. In the policy we will outline how we will protect the company’s assets both physically and the information technology. Though, we will never truly be finished with security as we will need to keep updating it to keep up with security standards.

Intrusion detection is very important so we should implement a system that should combat threats. One intrusion detection system that is very effective is NitroGuard IPS 4245. Another effective intrusion detection system is McAfee Network Security Platform. In my opinion, I believe that both of these systems are both equally effective. Last, the company should be able to block and threats from coming into the network so the company should invest in the best firewall products. One firewall product I will recommend is the very flexible McAfee's Next Generation Firewall. An alternate firewall that can be used at the company would be Palo Alto Networks' PA-7050 which was top rated from Reader’s Choice Viewers.

To ensure the company is protected I would recommend that we have a secure network. I would use packet filtering in the router, firewalls will be required and we should use anti-virus software, both at the gateway, and on each desktop. I also recommend that we use a DMZ network that will be used for internet access for servers that require it.

There are many strategies that can be used in making a secure network. The strategy that I would implement would be the Defense in Depth strategy. In this strategy a single product or device is not relied upon for enforcing security. Instead of using a single device it uses a firewall and router because of their security capabilities. Better encryption solutions, application firewalls, host intrusion prevention software and intrusion detection can all be called.

Another aspect I would recommend is the implementation of application proxies. This will be used for protocols and common applications. The proxies are very important because they add extra security because internal hosts are not exposed to the internet. Examples of this would be emails and web protocols.

After the implementation of application proxies, the “principle of least privilege” is recommended. This will be used to determine access to appropriate network resources. I believe this is essential, it translates to a user that does not need access to a certain system will be denied access. For example, a person that works in the IT department will not have access to the payroll system. This will help the company stay secure and help manage access as well.

The last step would be testing all of the components to make sure each is working well, and above standards. The firewall should only be able to allow access inbound on the web that is on the server with the DMZ which block all other web access by other hosts. The testing should never be done by the same person that built the firewall or did any other security.

Intrusion detection systems are very important in the longevity in a successful company. The two best systems in my opinion are NitroGuard IPS 4245 and McAfee Network Security Platform. I highly recommend either one for the company to implement.

Nitroguard IPS 4245 is a great intrusion detection system it received a 5 out of 5 star from SC Magazine. It is a smart packet-filtering system that uses a sophisticated network to detect intrusion attempts and stops and records intrusion attempts. The Nitroguard IPS is fully featured and have excellent reporting, good presentation of data, SCADA, and DCS protocols. There are also no known weaknesses in these IDS. Models that are lower performance can be as low as $6,495 but I would not recommend those models. The price range that I would recommend would be the fully featured model that goes for $54,495.

The other intrusion detection system that I highly recommend would be the McAfee Network Security Platform. This system also received a five out of five star from SC Magazine for 2015. The main task of this system is to give threat protection from advanced networks. This system uses heuristics, behavior analysis, cloud- based reputation, and protocol discovery. This is one of the more expensive intrusion detection systems but has been proven to be worth the money. The price range can go from between $11,000 to $230,000.

Either one of these intrusion systems would be ideal to purchase but if I had to choose one it would be the Nitroguard IPS simply because it is less expensive and performs at the same level as Mcafee. This is the same system that most major enterprises use for security because it has been proven to work. Not only does it perform well but it is also a very easy to use system.

Firewalls are absolutely essential in any company and we should have the best firewall available. These two firewalls that I would highly recommend would be McAfee's Next Generation Firewall and Palo Alto Networks' PA-7050. Both firewalls were both chosen as Security Reader’s best choice for firewalls for Enterprises for 2014.

McAfee’s Next Generation Firewall is truly one of the best firewalls on the market. It supports IPV6 and aids in clustering and load balancing on many devices. It is excellent for blocking attacks, intrusions and network traffic that is unauthorized. It was also rated high for its reporting capabilities, logging and monitoring. This is essential because the program basically works for you and minimizes management effort which makes the network flow easily. The price of McAfee’s Next Generation Firewall is a one-time payment of $48,856.95 and I guarantee it is worth every cent.

The other firewall that I would recommend would be Palo Alto Networks' PA-7050. In my opinion these two firewalls are competing in their effectiveness but I would recommend Palo Alto Networks' PA-7050 over the Next Generation. Like McAfee’s product, it is designed for excellent logging, reporting and monitoring. What I find impressive with this product is that there is a Sandbox capability that is built in. This means that all payloads that are suspicious can be ran and tested in a safe zone which minimizes additional threats. The difference between this product and others is that it broke the 100 Gbps barrier. According to the Palo Alto Company it can even protect data centers with up to 120 Gbps. This is ideal for our company because it is compatible with large data centers so we can adjust well. The price of this product begins at about $300,000 and readers suggest that it is worth every single cent that it is sold for.

The first important step that we needed to do was integrate a security policy and go from there. We should use packet filtering on our routers and also use a DMZ network for full capabilities. It is also very important that we have the best firewalls, intrusion detection systems, and web scanners. The firewall that I would highly recommend would be Palo Alto Networks' PA-7050 because of its excellent logging, reporting and monitoring. I want the best of the best for this company so I would recommend Nitroguard IPS for our intrusion detection system simply because it is less expensive and performs at the same level as Mcafee. You can never get total security but if we take these steps in securing our network we will be able to get pretty close to it.

References

CTU Online. (Ed.). (c. 2016). Phase 1: Technical Network Requirements for Business [M.U.S.E.]. Colorado Springs, CO: CTU Online. Retrieved May 6, 2016 from CTU Online, Virtual Campus, IT305, Advanced Networking: 1602A-01. https://campus.ctuonline.edu.
Beasley, J. S. & Nilkaew, P. (2013). A practical guide to advanced networking (3rd Ed.) [Electronic Edition]. Indianapolis, IN: Pearson Education, Inc.
Project Management Institute, Inc. (PMI ) (2008). A guide to the project management book of knowledge (4th Ed.) (PMBOK). Newtown Square, PA: PMI