Designing Cisco Network Service Architectures - Free Books

Step 2 Review the CP Hotels design concerning overall security. Your report shouldinclude at least the following:— Your observations of any security problems in the present design. Also note ways inwhich packet and control plane security might be improved.— A check that all external connections are properly secured with firewalls. (Since allthe details have not been specified, indicate what you want the design to look like ateach external connection.)— Your recommendations for where CP Hotels should deploy IPS systems, and howthey should be deployed, also where to deploy Cisco MARS.— Your evaluation of the risks concerning the Call Centers, and how best to mitigatethose risks. The CP Hotel.com site and the Call Centers are crucial to revenueproduction at CP Hotels. The collocation facility redesign secured the e-commercesite. Now it is time to ensure the Call Centers are secure.Step 3 Assume that NAC Appliance is to be deployed in HQ3, with 3000 users, and 15Layer 3 access switches connected to two building switches that connect back to thedata centers. The specific requirement is role-based control over who can accesswhich servers. While the formal policy has yet to be determined, you will need todevelop a preliminary design, answering the following questions at a high level:— How many and where to deploy NAC Appliances?— In-band or out-of-band deployment? Other info about deployment mode (virtual /real gateway, etc.)?— Either way, describe how it impacts addressing and VLAN definitions, performance,and manageability. If additional VLANs will be needed, describe what they shouldbe and why they are needed. Do not do any detailed IP addressing design, all that isdesired here is a high-level description of any addressing impact of your proposeddesign.— Describe where your design allows traffic to be controlled (building access layer,building aggregation layer, data center core, data center module core-facing edge),and for what filtering purpose each possible location might be used.— Also describe what traffic your design approach will not be able to control, if any.Activity VerificationYour group has completed this activity when you have completed answers to the abovequestions, and selected a presenter for the group.The presenter should be prepared to explain and defend your answers to the class. The topicsfor discussion include the following:• Your recommendation as to what type of IPsec VPN CP Hotels should use, pros, cons, andjustification. Your detailed design plan for the hotel IPsec VPN, including overall hotelrouting with failover, how IPsec reaches the other tunnel endpoint, and detailed IPaddressing plan.• Your critical review of and recommendations to improve security at CP Hotels, includingthe specific items listed above.• Your NAC Appliance design, including coverage of the specific items listed above.© 2007 Cisco Systems, Inc. Lab Guide 33