Networks

Ask something
Discussion Locked

Network Design

0 helpful
5 replies

by ashok_g

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi

We have just opened a branch in different state and looking at runing windows 2003 network and exchange2000 for email server.

We being educational institute, here is what we are bit worried of and would like to achieve.

-> What if student get hold of admin data or resources? How do we secure admin resources and data from student(we currently have two different network in winNT and SBS4.5 invironment which seems to keep student away so far)
-> Want to share same internet connection don't want to have different connection for student and admin users.
-> Would like to be able to access file and share them between State office(between admin to admin).

I would like you guys to put your thoughts on what sort of network model should i go for? Because of Exchange 2003 is not being release at, we have decided to go with exchange 2000 but I am not sure how well this exchange 2000 and windows2003 combination will perform? Do you have any experience on this area?

Thank you in advance.

Regards
Ashok

5 replies

by alpha-male

I haven't had a chance to work with 2003/Exchange 2000 yet, but I would be very surprised if they didn't work together well.

If I were building that network, I would set it up with two (or more) different IP ranges internally. Then on your router set up access lists to prevent users from the Students network from seeing anything on the admin network...but granting the admins access to resources where they need them. Give both access and routes to the internet. You can build in security fromexternal sources this way as well. You'll probably want to use NAT (address translation) as part of your internal/external security. You'll want a firewall.

Additionally, when creating the folders on your servers, put the admin and financial (sensitive) data in secure folders. Remove permissions to those folders from everyone excluding Domain Admins and the appropriate groups.

Another roadblock you can throw in is in your naming structure. If you have a folder called "Financial Data" or"Grades" or something that may draw attention from someone who has managed to circumvent security. If the folders are given names that only mean something to those "in the know" it can make things a lot harder. A server called "Finance" with a folder called "Credit Card Payments" is a much softer target than a server called "UVA-D5-SRV1" with that data in a secured folder called "ARC" (accounts receivable credit....it was the first thing I could think of...but you get the idea).

The last thing I would recommend is taking a good lokk at one or more books on "Building a Secure Windows 200X Network". This is one of the MCSE track items and will offer a lot of ideas about how to secure your lan, configure AD, groups, permissions, etc.

Good luck...hope this helps!

by homekeys

we have exchange 2000 working on 2003. just have to have sp3 on exchange. Design now that could take some time.

--firewall
Number one desent firewall. find one with multiple firewalls and or that will see vlans.
two set it up with different vfirewalls and of policys for the different vlans.

--domain
create three domains off the root
root\
\-students
\-admin
\-
put the admin staff in with difficault password policies, etc., lock it down hard
set up dummy accounts in the admin domain. like exchange admin
sql admin
realadmin
test
testguest
hello
you get the idea - have fun with it - and set the logon script to email you <-- that always seams to work (the code for the email in the logon script is at the ms site under admin scripts) thus if they ever get there you will know.

be in native mode for you directory (you already are)

see if you can get rid of the netbios stuff in the . this is hard i know, tons of apps still use it including SMS. research will give you the answer.

by homekeys

--switches
1) do static routes for all the switches ie vlan routes. this is a pain in the you know what but it is a requirement.
2) get switches that follow 11b security standards. i.e. require the students to logon to the network as well as the computer. some switches will point the network authentication to a radius which in turn can look at ldap or active directory. (this is not a requirement)

--ids
snort works good take the class from www.SAN.org it si an ok starter

if you seetraffic from the student domain on the subnet you may have a problem. if you see admin based traffic from the student domain on the subnet you may have a problem.

-
communications the the state

the states are all starting to encrypt stuff. if your in a state based edu then get your key from your state key system (i.e. HIPPA). not all states have their key systems set up yet.

-----------
gets foggy after this
-----------
set up your communications based of your keys and some type of authention. do not rely on tsl or ssl. you wish the encrypt the contents as well if possible.

most of all good luck
ps fold on the logon to the network thing it looks like you are will to compromise security for thegreater good. this maybe a requirement with the rep the edu's have for security.

ttfn

by pgm554

Pardon me,but the last time I looked Exchange 2000
was not and will not be supported on 2003 Server.Only SQL 2000 w/sp3 will work on a 2003 Server.

I would wait till sp1 is released for 2003 server and sp1 for exchange 2003.

But,if you like adventure and your boss has a good sense of humor , go right ahead and have some fun.

by bob the builder

Where I work we have a strict policy which states that "Never The Twain Shall Meet" regarding access to each others networks. To this affect we have implemeted VLANs. The relevent servers that require access from both Public and Private (Admin andStudents) have two NICs in them with a Class A IP on one and a Class C on the other. With the correct Share and File security and also folders mounted as drives then your security is extremly tight. Our proxy server has two nics in it and some of our file servers as well and we have no issues (as yet) with one group (admin) seeing the others (students) data.

This discussion is closed to new replies.