CC S6224 :Network Security Topology Design Using a Variety of Products

Objective

In this assignment, you will design and implement a secure network topology using a variety of network security services and technologies. The goal is to create a real-world, multi-vendor environment where you can apply network security best practices.

Completing this assignment will help you gain practical experience in designing and implementing a secure network using industry-standard technologies and products, building a solid foundation in network security concepts applicable to real-world scenarios.

Scenario Overview

Imagine you are tasked with designing the network for a small-to-medium-sized business (SMB) operating in a hybrid cloud environment. The business has multiple departments, including HR, Finance, Sales, and IT. Each department has sensitive data, and secure communication is required both internally (LAN) and externally (Internet and cloud).

Your task, as part of a 4-person group, involves:

• Configuring security policies such as Access Control Lists (ACLs), Network Address Translation (NAT), Virtual Private Network (VPN), and potentially an Intrusion Prevention System (IPS).

• Optimizing firewall policies by defining rules and actions to govern traffic passing through firewall devices.

• Understanding the interaction of these components to secure and manage your network effectively.

Assignment Requirements

1. Topology Design

• Create a secure network topology ensuring data confidentiality, integrity, and availability.

• Include the following key network devices for perimeter defense:

  • ASAs (Adaptive Security Appliances): Primary firewalls and VPN connectivity.

  • MPLS Router: Efficient packet forwarding and routing across the network.

  • Internet Router: Handles NAT, routing, and secure external network connections.

2. Network Segmentation

• Create VLANs to isolate departments (HR, Finance, IT, Sales).

• Use private IP addressing for internal communications and public IPs for internet-facing devices.

• Implement ACLs to restrict traffic between VLANs based on business requirements (e.g., Finance cannot communicate with IT, but HR can communicate with Sales).

3. Firewall Configuration

• Configure perimeter firewalls allowing only authorized services in and out.

• Use different firewall rule types (stateful, application-layer filtering) for traffic security.

• Use security zones (internal, DMZ, external) for proper segmentation and traffic control.

4. VPN for Remote Access

• Implement VPN technology for secure remote access (SSL VPN or IPsec VPN).

• If using cloud services (AWS/Azure), configure a VPN tunnel between on-premises and cloud networks for secure communication.

5. IDS/IPS Implementation

• Place IDS/IPS between internal networks and the internet, or near sensitive data (e.g., Finance/HR).

• Configure to detect and prevent common attacks such as DoS, SQL injection, and unauthorized access.

6. Secure Communication

• Configure encrypted communications (IPSec, SSL/TLS) between devices to protect data in transit.

• Implement secure services (HTTPS for web, SMTPS for email) where appropriate.

7. Documenting the Network Design

• Provide a detailed network diagram showing device placement (routers, switches, firewalls, IDS/IPS).

• Label subnets, VLANs, IP addresses, and indicate security measures on each device.

• Include a brief description of each device’s role and purpose in the network.

8. Security Policies and Procedures

• Define security policies for each device (password policies, device hardening, ACLs, firewall rules).

• Explain how each policy contributes to overall network security.

9. Evaluation and Testing

• Simulate network traffic using tools such as packet sniffers or network simulation tools (GNS3, Cisco Packet Tracer, Wireshark).

• Verify that configurations are working:

  • VPN connections are secure

  • Firewalls block unauthorized traffic

  • IDS/IPS detects and prevents attacks

Deliverables

1. Network Topology Diagram: Clear and labeled topology with network segmentation, IP addresses, and subnet masks.

2. Configuration Files: Files for routers, switches, firewalls, IDS/IPS, and other devices.

3. Security Policy Documentation: Detailed policies applied to each device.

4. Testing and Evaluation Report: Report on testing and outcomes of security measures.

5. Executive Summary: 1–2 page summary explaining design choices, configurations, and how each measure protects the network.

Tools and Resources

• Simulation: Cisco Packet Tracer, GNS3, Eve-ng Web Login

• Packet Analysis: Wireshark

• Virtualization: VirtualBox, VMware (for virtualized devices like firewalls, IDS/IPS)

• Reference Documentation: Cisco, Fortinet, Palo Alto product guides

Assessment Requirements

The assignment requires students to design and implement a secure network topology for a small-to-medium-sized business (SMB) with multiple departments (HR, Finance, Sales, IT) operating in a hybrid cloud environment. Key assessment points include:

1. Topology Design – Build a secure network that ensures confidentiality, integrity, and availability, using devices like ASAs (firewalls), MPLS routers, and Internet routers.

2. Network Segmentation – Create VLANs for each department, use private IPs internally and public IPs externally, and implement ACLs to control traffic between VLANs.

3. Firewall Configuration – Define and optimize rules for stateful and application-layer filtering, using security zones (internal, DMZ, external).

4. VPN for Remote Access – Configure SSL or IPsec VPNs for secure remote access and, if applicable, secure communication with cloud services.

5. IDS/IPS Implementation – Deploy intrusion detection/prevention systems to identify and block attacks such as DoS, SQL injection, and unauthorized access.

6. Secure Communication – Encrypt traffic using IPSec or SSL/TLS and implement secure email/web protocols (HTTPS, SMTPS).

7. Documentation – Provide network diagrams, label subnets/VLANs/IPs, and describe device roles.

8. Security Policies and Procedures – Define password policies, device hardening, firewall rules, and ACLs, explaining their security impact.

9. Evaluation and Testing – Simulate traffic using Packet Tracer, GNS3, or Wireshark to verify VPN, firewall, and IDS/IPS functionality.

Deliverables include:

• Network topology diagram

• Device configuration files

• Security policy documentation

• Testing and evaluation report

• Executive summary

Tools recommended: Cisco Packet Tracer, GNS3, Eve-ng, Wireshark, VirtualBox/VMware, and product documentation from Cisco, Fortinet, Palo Alto.

Academic Mentor Guidance

Step 1: Understanding the Scenario

The mentor begins by explaining the SMB scenario, highlighting department requirements, sensitive data, and hybrid cloud operations. Emphasis is placed on identifying security needs and understanding traffic flow between departments and the cloud.

Step 2: Topology Planning

• The student is guided to map out the network layout on paper or using simulation tools.

• Mentor explains key devices (ASA, MPLS router, Internet router) and their roles.

• VLANs are planned for departmental isolation, and IP addressing schemes are assigned.

Step 3: Firewall and ACL Configuration

• Mentor demonstrates configuring firewall rules, zones, and ACLs.

• Students apply stateful and application-layer filtering, ensuring traffic only passes as intended.

• Guidance is provided on testing firewall rules using simulated traffic.

Step 4: VPN Implementation

• Students learn how to implement SSL/IPsec VPNs for remote employees.

• Mentor shows site-to-cloud VPN setup for secure hybrid cloud communication.

Step 5: IDS/IPS Setup

• Students configure intrusion detection and prevention rules.

• Mentor explains common attack types, monitoring techniques, and testing strategies.

Step 6: Secure Communication

• Students implement encryption protocols (IPSec, SSL/TLS) for internal and external communications.

• Mentor emphasizes best practices for email and web security.

Step 7: Documentation

• Mentor guides students to create detailed diagrams labeling devices, VLANs, subnets, and IP addresses.

• Students draft security policy documents, describing each device’s role and implemented measures.

Step 8: Testing and Evaluation

• Using Packet Tracer, GNS3, or Wireshark, students simulate traffic to verify:

  • VPN functionality

  • Firewall and ACL effectiveness

  • IDS/IPS detection

• Mentor helps students interpret results and identify gaps in security configurations.

Final Outcome

The student produces:

• A secure, segmented network topology for SMB.

• Correctly configured firewalls, VPNs, IDS/IPS ensuring robust security.

• Detailed documentation of configurations, policies, and testing results.

• An executive summary explaining design choices and security measures.

Learning objectives covered:

• Applying real-world network security best practices

• Designing secure, segmented networks

• Implementing firewalls, VPNs, and IDS/IPS

• Testing, evaluating, and documenting network security

• Understanding team collaboration and project management in a simulated environment

Boost Your Academic Success with Expert Assignment Solutions

Looking for a reference to guide your studies? You can download our sample solution to see how a professionally prepared assignment is structured and formatted. This sample is meant for reference only—submitting it as your own work may lead to plagiarism issues and academic penalties.

Want a stress-free, fully original solution tailored to your requirements? Our team of professional academic writers can create a fresh, plagiarism-free assignment specifically for you. By ordering a custom solution, you benefit from:

• 100% original content written to your instructions.

• Accurate research and referencing aligned with academic standards.

• High-quality analysis and formatting that matches university expectations.

• Timely delivery, so you never miss a deadline.

Avoid plagiarism risks and elevate your grades with a solution crafted by experts who understand your subject and assessment requirements.

Disclaimer: The downloadable sample is for educational reference purposes only. It is not intended for submission as your own work.

Take action now:
[Download Sample Solution] [Order Fresh Assignment]