Virtualizing Your Network Divide and Conquer EDUCAUSE Internet

Virtualizing Your Network Divide and Conquer EDUCAUSE & Internet 2 Security Professionals Conference April 10 -12, 2007 Copyright Robert E. Neale 2007. This work is the intellectual property of the author. Permission is granted for this material to be shared for noncommercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Agenda • VCU’s “State of the network 2005” • Why “virtualize” the network? • Implementation at VCU – New network architecture and design – Network security enhancements – Implementation time frame • Summary www. ts. vcu. edu

VCU Background Information • • • Virginia Commonwealth University Located in Richmond, Va. Two campuses 30, 300 students – 4, 500 in VCU housing 9, 000 faculty/staff http: //www. vcu. edu www. ts. vcu. edu

Network Environment at the end of 2005 • • • Nine Routers across both campuses 1800 layer two Cisco switches Internet firewall with many holes Router ACL security for subnets & servers. Rapid growth in network – new buildings – New connections – wireless www. ts. vcu. edu

www. ts. vcu. edu

Why “virtualize” the network?

Growing Complexity of Network • Over 140 Buildings, 1800+ switches • Need to segment users for better network security management • DHCP vs Static IP issues • Requirements for multiple VLANS across the network backbone infrastructure www. ts. vcu. edu

Mandate for Better Security • New laws for protection of sensitive data • Threats are becoming more sophisticated • Resources stretched in attempting to address security problems • Need to improve management of network to protect less secure systems www. ts. vcu. edu

Qo. S & Future Requirements • • • Qo. S needed for Voice over IP project Qo. S planned for video locations Possible separate research VLANs Business Continuity - data replication Internal network SLA’s www. ts. vcu. edu

Implementation at VCU Outside Resources Partnerships • Sycom – Network engineering resources – Architecture design with our staff • Cisco Systems – Architectural review – Proof of Concept Center www. ts. vcu. edu

Design Goals • Translation to private MPLS L 3 VPN hierarchical design – Existing technology preserved and integrated into new design • Allow for phased implementation • Shared services virtualization and network segmentation • Introduction of Qo. S into new design • Simplification of security model www. ts. vcu. edu

Introduction: Terminology • • C – Customer Router that sits at the Customer Site that peers with only other Customer devices. CE – Customer Edge Device that sits at the access layer. The CE could be a layer 2 or layer 3 device Site IGP – Site Interior Gateway Protocol. The IGP run at the Customer Site. PE – Provider Edge Router. The Provider Edge Router sits at the edge of the MPLS backbone. P – Provider Router that resides in the MPLS backbone. PE-CE Link – The connection between the PE and CE. PE-CE Routing Protocol – The dynamic routing protocol (EBGP, RIPv 2, EIGRP, OSPF) or static routing protocol (Static, Connected) run over the PE-CE link VRF –A Virtual Routing and Forwarding table that exists at the PE that is used to provide a separate routing table for different customers or customer business units. Virtual Routing and Forwarding (VRF) Tables CE Site IGP C Access Layer PE CE PE-CE Routing Protocol P PE MPLS-VPN Backbone www. ts. vcu. edu

High Level Backbone Logical Design www. ts. vcu. edu

Cabell Sanger Cabell Main Hospital Siegel West Hospital Lafayette Computer Center Mc. Guire School of Business Computer Center www. ts. vcu. edu

Network Management VRF www. ts. vcu. edu

User Access To MPLS Network www. ts. vcu. edu

Network Mgmt FW Context Vo. IP FW Context SECNet FW Context RESNet FW Context SVRNet FW Context DMZNet FW Context Temp. VCU FW Context Common Area Internet www. ts. vcu. edu

Qo. S Design – High Level • A five class model supported in the MPLS-Backbone – – – • • • Voice Business Critical data Video/UDP – Best Effort Data – Scavenger Data – • Access switches classify/mark traffic • Edge Routers perform the following Qo. S Functions – Classification/Marking – Microflow policing and remarking to Scavenger – Copying IP DSCP into MPLS EXP • Core interfaces have congestion management enabled www. ts. vcu. edu

Improve Management of Network Security Policies • Problems with management of ACLs – Poor scalability – Increased management requirements – Increased troubleshooting complexity • Solution is replacement of ACLs in routers with FWSMs www. ts. vcu. edu

Logical Representation of ACL Consolidation Switch Interfaces with ACLs Firewall ACL Clients Traffic to other VRFs or Internet www. ts. vcu. edu

Existing ACL Implementation Edge Router Active ACL’s Line Count Gallium 176 10, 246 Poca 10 2497 Cabell 22 284 Seigel 7 61 Lafayette 10 111 Business 33 334 Sanger 29 212 Main Hospital 13 161 West Hospital 17 150 Mc. Guire 35 232 Total 352 14, 288 www. ts. vcu. edu

New FSM Implementation Name Active ACL Line Count Email 4 4 MCVH 2 8 Network 5 106 RESNet 2 102 Serv. Net 4 16 Temp. VCU 3 25 VCUSecure 3 10 Voice 5 100 Wireless 4 41 Total 32 412 www. ts. vcu. edu

RESNet Example • Total lines of RESNet ACL prior to consolidation: 2146 • Total lines of RESNet ACL post-consolidation: 248 • Percent of original line count: 11. 6% • Line reduction ratio: 8. 65 times • * Note that this data was extremely viable for consolidation due to the commonalities that could be extracted from all ACLs. This data should be viewed as a better-case scenario. www. ts. vcu. edu

Enhanced Network Security • Groups of users: – Sensitive data PC network separate from PC labs and public PC connections. – Different policies applied according to groups of PC users. • Groups of services: – IP Phone Services – Video Conferencing – Wireless • VLANs implemented at switch port www. ts. vcu. edu

Other Network Security Enhancements • Cisco Clean Access – RESNet, SECNet, Public Access, Wireless • Implementation of IPS for Server. Net. • Cisco VPN remote access to internal VCU server resources only. • Implementing Cisco MARS – Monitoring, Analysis, and Response System • Split DNS implementation www. ts. vcu. edu

Timeframe • • • 12/05 2/06 3/06 5/06 7/06 9/06 4/07 9/07 11/07 Initial partnership, planning, purchases Design reviewed by Cisco Adv Svrc Cisco CPOC in Raleigh NC Core & Distribution switches in MPLS Started Vo. IP data remediation Basic VRF’s created RESNet VRF – Route ACL to FWSM Server. Net and DMZNet migration started Planned completion of ACL to FWSM Planned completion of Vo. IP project www. ts. vcu. edu

Summary • Virtualization of your network can: – Provides flexibility – Reduce network complexity – Improve network management – Enhance network security • Lessons learned: – Virtualize the network before Vo. IP – Assess your organizations ability to change – Outside resources critical to success www. ts. vcu. edu

Questions?