Frontier Pte Ltd is a small consultancy company. The company has decided to move to a new site. You are a network engineer and are engaged to set up a network for his company.
The company has 3 departments (Engineering, Finance and Human Resource) in a building. The number of staff and the allocated IP address range is shown as follows:
Department | Location | IP address Range | Default GW | Assigned Vlan |
Engineering | Levels 1,2,3 | 192.168. 201.0/24 | 192.168.201.1 | 201 |
Finance | Levels 1,2,3 | 192.168. 202.0/24 | 192.168.202.1 | 202 |
Human Resource | Levels 1,2,3 | 192.168. 203.0/24 | 192.168. 203.1 | 203 |
Additional information for the servers is below
Server | Location | IP address | Default GW | Assigned Vlan |
DHCP Server | Datacenter | 192.168.2.11/24 | 192.168.2.1 | 2 |
AAA Server | Datacenter | 192.168.2.12/24 | 192.168.2.1 | 2 |
Architecture Requirements
1 | 3 Tier architecture applied and labelled correctly - We will be using a collapsed core design |
2 | Connections between devices should use the highest speed possible. This includes selection of cables. |
3 | All devices hostname and labels to unique and be set/named accordingly. |
4 | Each PC should be connected to a switch residing on the same floor. |
L2 Features
1 | VLANs to be configured on the core switches |
2 | VLAN information should never be configured on the access switches. |
3 | VLAN information propagation to the other switches should be secured. |
4 | All inter-switch ports should be set unconditionally to trunk mode. |
L3 Features
1 | Each L3 switch/router SVI should be configured correctly with the correct IP address |
2 | Devices on each VLAN should be obtain their address from the single DHCP server. |
Security Features
1 | All trunk links to utilize a non-default native VLAN. |
2 | Users are to be authenticated before access to the network is allowed. |
3 | Port security is to be implemented for all edge ports. Each port to allow the first 2 devices connected to the port, with the addresses saved into switch running memory. Connection of unauthorized PCs should not stop authorized PCs from working on the port. Notification is to be sent by the switch to the logging server if this happens. |
4 | All edge ports are to guard against rogue DHCP servers |
5 | All access ports to have dynamic trunking protocol disabled. |
6 | All unused ports are to be disabled. |
Switch Management
1 | All switches are to implement out of band login (id/password on attachment below) |
2 | All switches to have only appropriate secure in-band remote management login. (id/password as attachment below) |
3 | Each switch to have an IP address separate from any user facing VLAN. |
Misc
1 | Configure the DHCP server with the required scope for the 3 user VLANs. |
2. | Configure the AAA server with the usernames and the passwords, and also add the authenticator’s IP address inside for radius authentication. |
The user passwords for local authentication to the network are as follows
AAA Server userid / password
S/N | Userid | Password |
01 | fin01 | 12345 |
02 | fin02 | 12345 |
03 | fin03 | 12345 |
04 | eng01 | 12345 |
05 | eng02 | 12345 |
06 | eng03 | 12345 |
07 | hr01 | 12345 |
08 | hr02 | 12345 |
09 | hr03 | 12345 |
The management passwords for device local and remote management are as follows
Out of band switch userid / password.
S/N | Userid | Password |
01 | localuser | 12345 |
In band switch userid / password.
S/N | Userid | Password |
01 | remoteuser01 | 12345 |
02 | remoteuser02 | 12345 |
Available Physical Resources
The Assignment.pkt file contains all the devices with services required. You are to connect them using any cable and configure them.
All the servers are configured with user ids / DHCP scopes. You can add missing configuration but you cannot change or delete any existing configuration.
You are to work with only the existing equipment. (it should not be necessary to utilize all devices)
You are NOT to add/remove any devices.
Introduce Network Topology (mandatory)
(1) Each PC should be connected to a switch residing on the same floor.
(2) VLAN information propagation to the other switches should be secured.
(3) All switches are to implement out of band login.
(4) All unused ports are to be disabled.
(5) Configure the DHCP server with the required scope for the 3 user VLANs.
