DOCSLIB.ORG

Trabajo Fin De Grado

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Trabajo Fin De Grado E.T.S. de Ingeniería Industrial, Informática y de Telecomunicación Renovación de la infraestructura de red de datos para soporte NAC (Network Access Control) de una empresa. Grado en Ingeniería en Tecnologías de Telecomunicación Trabajo Fin de Grado Autor: Ruth González Novillo Director: Eduardo Magaña Lizarrondo Pamplona, 25 Junio del 2014 ÍNDICE RESÚMEN .............................................................................................................................................. 0 ÍNDICE DE FIGURAS ................................................................................................................................ 1 LISTA DE PALABRAS CLAVE .................................................................................................................... 3 CAPÍTULO 1 – INTRODUCCIÓN. .............................................................................................................. 1 CAPÍTULO 2 – SITUACIÓN ACTUAL DE LA RED DE DATOS. ...................................................................... 3 2.1 Localizaciones de la Red de Datos. Infraestructura. ...................................................................... 3 2.2 Estructura lógica de la Red de Datos ............................................................................................ 5 2.3 Protocolos propietarios del fabricante ........................................................................................... 6 2.4 Red Corporativa ............................................................................................................................. 8 2.5 Red Industrial ............................................................................................................................... 10 2.6 Comunicaciones externas ............................................................................................................ 11 2.7 Comunicaciones con los proveedores. ......................................................................................... 12 2.7.1 MacroLAN. ............................................................................................................................................ 13 2.7.2 ADSL. ..................................................................................................................................................... 15 2.7.3 VRRP ..................................................................................................................................................... 15 2.8 Backbone de la red. ...................................................................................................................... 18 2.9 Comunicación entre redes............................................................................................................ 19 CAPÍTULO 3- PROCESOS INTERMEDIOS. PASOS PREVIOS AL PROYECTO. ............................................. 20 3.1 RFP Lote 1. Fibra óptica. .............................................................................................................. 21 3.1.1 Objetivo. ............................................................................................................................................... 21 3.1.2 Condiciones de la propuesta. ................................................................................................................ 22 3.1.3 Requerimientos tecnológicos y especificaciones de servicio. ................................................................ 23 3.1.4 Contenido y estructura de la respuesta ................................................................................................ 24 3.2 Seguimiento del Lote 1. Análisis. ................................................................................................. 26 CAPÍTULO 4- NAC, 802.1X Y ZONAS DE SEGURIDAD. ............................................................................ 33 4.1 Protocolo EAP .............................................................................................................................. 34 4.1.1 EAPOL ................................................................................................................................................... 35 4.1.2 Tipos de EAP ......................................................................................................................................... 38 4.2 RADIUS ......................................................................................................................................... 42 4.3 Proceso de autentificación ........................................................................................................... 45 4.4 Concepto NAC .............................................................................................................................. 45 4.5 Implementación NAC en la empresa ............................................................................................ 48 4.5.1 Solucion ISE Cisco ................................................................................................................................. 50 4.5.2 Solución Enterasys. ......................................................................................................................... 59 4.6 Instalación y configuración de una alternativa open source: PacketFence. ................................ 64 4.6.1 Out-Of-Band deployment (VLAN enforcement) ................................................................................... 65 4.6.2 Inline deployment (Inline enforcement) .............................................................................................. 67 4.6.3 Características ...................................................................................................................................... 69 4.6.4 Instalación de PacketFence. ................................................................................................................. 70 4.6.5 Configuración en modo Inline .............................................................................................................. 71 4.6.6 Interfaz web de administración. ........................................................................................................... 80 4.6.7 Portal cautivo. ...................................................................................................................................... 84 4.6.8 Configuración de autenticación. ........................................................................................................... 87 4.6.9 Configuración VLAN enforcement. ....................................................................................................... 92 4.7 Comparación entre PacketFence, Cisco ISE y NetSight. ............................................................. 108 CAPÍTULO 5- OTRAS TAREAS DESARROLLADAS EN LA EMPRESA ........................................................ 110 5.1. Reportes y seguridad WIFI. ....................................................................................................... 110 5.2. Descubrimiento de red con NESSUS y reorganización de datos XML. ....................................... 114 5.3. Reuniones con fabricantes. ....................................................................................................... 115 5.4. Mapas fibra óptica. ................................................................................................................... 115 5.5. Conclusiones. ............................................................................................................................ 116 ANEXOS ............................................................................................................................................. 118 REFERENCIAS ..................................................................................................................................... 125 RESÚMEN Uno de los objetivos de este trabajo es describir los pasos seguidos por una empresa multinacional a la hora de realizar un cambio en su red de datos. Para ello es necesario analizar el estado actual de la red y los objetivos que se quieren conseguir tras la nueva instalación. Se pretende analizar los reajustes realizados durante el proceso del proyecto del cambio de la infraestructura de la red de datos, así como los cambios tanto de plazo como técnicos que se vayan generando a lo largo de la ejecución del procedimiento. Este proyecto pretende recoger la complejidad de la realización de un cambio global de la infraestructura de red de datos de una empresa del sector de la automoción, siguiendo los objetivos no sólo propuestos por la sede local, sino por los exigidos por el grupo multinacional en conjunto. Tras el análisis del estado actual de la red de datos tanto el despliegue de fibra óptica como la electrónica de red, se procederá a indicar las características de la futura instalación mediante el análisis de las RFP (Request For Proposal) convocadas por la empresa para el cambio del tendido de fibra óptica y la electrónica de red. Este trabajo, por cuestiones temporales, recoge todos los pasos del proyecto del cambio de la infraestructura de red de fibra óptica previos a la recepción de las ofertas por parte de los ofertantes. El estado final de la descripción y seguimiento termina con la publicación de la citada RFP. Los pasos no contenidos son por tanto la descripción de las ofertas recibidas y la selección de una de ellas para la implantación final. Dentro del proceso de actualización de la red de datos, la
Load more

Recommended publications
  • Ten Strategies of a World-Class Cybersecurity Operations Center Conveys MITRE’S Expertise on Accumulated Expertise on Enterprise-Grade Computer Network Defense
    Bleed rule--remove from file Bleed rule--remove from file MITRE’s accumulated Ten Strategies of a World-Class Cybersecurity Operations Center conveys MITRE’s expertise on accumulated expertise on enterprise-grade computer network defense. It covers ten key qualities enterprise- grade of leading Cybersecurity Operations Centers (CSOCs), ranging from their structure and organization, computer MITRE network to processes that best enable effective and efficient operations, to approaches that extract maximum defense Ten Strategies of a World-Class value from CSOC technology investments. This book offers perspective and context for key decision Cybersecurity Operations Center points in structuring a CSOC and shows how to: • Find the right size and structure for the CSOC team Cybersecurity Operations Center a World-Class of Strategies Ten The MITRE Corporation is • Achieve effective placement within a larger organization that a not-for-profit organization enables CSOC operations that operates federally funded • Attract, retain, and grow the right staff and skills research and development • Prepare the CSOC team, technologies, and processes for agile, centers (FFRDCs). FFRDCs threat-based response are unique organizations that • Architect for large-scale data collection and analysis with a assist the U.S. government with limited budget scientific research and analysis, • Prioritize sensor placement and data feed choices across development and acquisition, enteprise systems, enclaves, networks, and perimeters and systems engineering and integration. We’re proud to have If you manage, work in, or are standing up a CSOC, this book is for you. served the public interest for It is also available on MITRE’s website, www.mitre.org. more than 50 years.
    [Show full text]
  • Secure Magazine
    When it comes to information security, most of us will remember this year as the year when an industry giant suffered a huge incident with extensive ramifications. Naturally, I'm talking about the RSA breach back in March, when the company experienced privileged data loss. We've seen privacy snafus, data breaches, a rise of mobile malware and financial fraud. What can we expect next year? Unfortunately, probably more of the same. In any case, I wish you a successful 2012. Stay safe! Mirko Zorz Editor in Chief Visit the magazine website at www.insecuremag.com (IN)SECURE Magazine contacts Feedback and contributions: Mirko Zorz, Editor in Chief - [email protected] News: Zeljka Zorz, Managing Editor - [email protected] Marketing: Berislav Kucan, Director of Marketing - [email protected] Distribution (IN)SECURE Magazine can be freely distributed in the form of the original, non-modified PDF document. Distribution of modified versions of (IN)SECURE Magazine content is prohibited without the explicit permission from the editor. Copyright (IN)SECURE Magazine 2011. www.insecuremag.com IT pros can't resist peeking at information and other sensitive data including, privileged information for example, other people’s Christmas bonus details. • 42 percent of those surveyed said that in their organizations' IT staff are sharing passwords or access to systems or applications • 26 percent said that they were aware of an IT staff member abusing a privileged login to illicitly access sensitive information • 48 percent of respondents work at companies that are still not changing their IT security staff will be some of the most privileged passwords within 90 days – a informed people at the office Christmas party violation of most major regulatory compliance this year.
    [Show full text]
  • Clustering Quick Installation Guide
    ClusteringQuickInstallationGuide forPacketFenceversion5.3.1 ClusteringQuickInstallationGuide byInverseInc. Version5.3.1-July2015 Copyright©2015Inverseinc. Permissionisgrantedtocopy,distributeand/ormodifythisdocumentunderthetermsoftheGNUFreeDocumentationLicense,Version 1.2oranylaterversionpublishedbytheFreeSoftwareFoundation;withnoInvariantSections,noFront-CoverTexts,andnoBack-Cover Texts.Acopyofthelicenseisincludedinthesectionentitled"GNUFreeDocumentationLicense". ThefontsusedinthisguidearelicensedundertheSILOpenFontLicense,Version1.1.ThislicenseisavailablewithaFAQat:http:// scripts.sil.org/OFL Copyright©ŁukaszDziedzic,http://www.latofonts.com,withReservedFontName:"Lato". Copyright©RaphLevien,http://levien.com/,withReservedFontName:"Inconsolata". TableofContents AboutthisGuide.............................................................................................................. 1 Assumptions.....................................................................................................................2 Installation....................................................................................................................... 3 Step1:Installthereplicateddatabase........................................................................ 3 Step2:Serverconfiguration..................................................................................... 9 Step3:Createanewcluster.................................................................................. 10 Step4:Connectaslavepacketfenceserver..............................................................11
    [Show full text]
  • Packetfence – Version 1.7.5
    PacketFence – version 1.7.5 Installation and Confguration Guide Copyright © 2008 Inverse inc. (http://inverse.ca) Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”. Version 1.7.5 – October 2008 Contents Chapter 1 About this Guide .............................................................................................................. 3 Chapter 2 Introduction .......................................................................................................................4 How does VLAN isolation work ? ............................................................................. 5 Blocking malicious activities with violations .............................................................7 New features in 1.7.5 ...............................................................................................9 Bugs fxed in 1.7.5 ................................................................................................... 9 Chapter 3 System Requirements .................................................................................................... 10 Assumptions .......................................................................................................... 10 Minimum Hardware Requirements .........................................................................11
    [Show full text]
  • Packetfence Administration Guide
    PacketFence Administration Guide for version 3.5.0 PacketFence Administration Guide by Olivier Bilodeau, Fabrice Durand, François Gaudreault, and Derek Wuelfrath Past Authors: Dominik Gehl Version 3.5.0 - August 2012 Copyright © 2008-2012 Inverse inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". The fonts used in this guide are licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL Copyright © Barry Schwartz, http://www.crudfactory.com, with Reserved Font Name: "Sorts Mill Goudy". Copyright © Raph Levien, http://levien.com/, with Reserved Font Name: "Inconsolata". Revision History Revision 2.5 2012-07-30 FG Doc update for RADIUS Revision 2.4 2012-07-26 DW Added documentation for new captive portal profiles feature. Revision 2.3 2012-07-19 FG Adding suricata documentation Revision 2.2 2012-06-13 OB, FD Added installation procedure for Debian. A minor fix to RHEL6 install instructions. Revision 2.1 2012-04-12 OB, DW Added new documentation about pre-registered, sponsored guests and role-based enforcement. Covered updated inline enforcement instructions. Updated drbd and samba installation instructions. SoH, ntlm_auth test and some typos fixed too. Revision 2.0 2012-02-22 FG, OB, DW Documentation ported to asciidoc.
    [Show full text]
  • 18T00505.Pdf
    ESCUELA SUPERIOR POLITÉCNICA DE CHIMBORAZO FACULTAD DE INFORMÁTICA Y ELECTRÓNICA ESCUELA DE INGENIERÍA EN SISTEMAS “ANÁLISIS COMPARATIVO DE HERRAMIENTAS N.A.C OPENSOURCE Y SU APLICACIÓN A LA DIRECCIÓN PROVINCIAL DEL CONSEJO DE LA JUDICATURA DE CHIMBORAZO” TESIS DE GRADO Previa la obtención del título de INGENIERO EN SISTEMAS INFORMÁTICOS Presentado por: CARLOS MIGUEL PADILLA CEVALLOS RIOBAMBA – ECUADOR 2012 AGRADECIMIENTO Agradezco infinitamente a Dios por ser la luz y la fuerza de mi vida, a mis padres por su apoyo incondicional y el sacrificio que han hecho por darme una educación; a mis hermanos y amigos por sus consejos y aprecio. DEDICATORIA A Dios y a mis padres por los buenos valores, hábitos y enseñanzas que me han ayudado a salir adelante y alcanzar mis sueños y objetivos. A mi novia por sus consejos, comprensión y apoyo. También a mis hermanos por siempre darme fuerza para seguir adelante. NOMBRE FIRMA FECHA Ing. Iván Ménes DECANO FACULTAD DE ..................................... ..................................... INFORMÁTICA Y ELECTRÓNICA Ing. Raúl Rosero DIRECTOR ESCUELA ..................................... ..................................... INGENIERÍA EN SISTEMAS Ing. Alberto Arellano DIRECTOR DE TESIS ..................................... ..................................... Ing. Diego Ávila MIEMBRO DEL ..................................... ..................................... TRIBUNAL Ing. Carlos Rodríguez DIRECTOR DPTO. ..................................... ..................................... DOCUMENTACIÓN NOTA
    [Show full text]
  • Clustering Quick Installation Guide
    ClusteringQuickInstallationGuide forPacketFenceversion6.0.0 ClusteringQuickInstallationGuide byInverseInc. Version6.0.0-Apr2016 Copyright©2015Inverseinc. Permissionisgrantedtocopy,distributeand/ormodifythisdocumentunderthetermsoftheGNUFreeDocumentationLicense,Version 1.2oranylaterversionpublishedbytheFreeSoftwareFoundation;withnoInvariantSections,noFront-CoverTexts,andnoBack-Cover Texts.Acopyofthelicenseisincludedinthesectionentitled"GNUFreeDocumentationLicense". ThefontsusedinthisguidearelicensedundertheSILOpenFontLicense,Version1.1.ThislicenseisavailablewithaFAQat:http:// scripts.sil.org/OFL Copyright©ŁukaszDziedzic,http://www.latofonts.com,withReservedFontName:"Lato". Copyright©RaphLevien,http://levien.com/,withReservedFontName:"Inconsolata". TableofContents AboutthisGuide.............................................................................................................. 1 Assumptions.....................................................................................................................2 InstallationonCentOS6................................................................................................... 3 Step1:Installthereplicateddatabase........................................................................ 3 Step2:Serverconfiguration..................................................................................... 9 InstallationonCentOS7................................................................................................. 11 Step1:Installthereplicateddatabase.......................................................................11
    [Show full text]
  • Packetfence Administration Guide
    PacketFence Administration Guide for version 3.5.1 PacketFence Administration Guide by Olivier Bilodeau, Fabrice Durand, François Gaudreault, and Derek Wuelfrath Past Authors: Dominik Gehl Version 3.5.1 - September 2012 Copyright © 2008-2012 Inverse inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". The fonts used in this guide are licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL Copyright © Barry Schwartz, http://www.crudfactory.com, with Reserved Font Name: "Sorts Mill Goudy". Copyright © Raph Levien, http://levien.com/, with Reserved Font Name: "Inconsolata". Revision History Revision 2.6 2012-09-05 OB, DW, FD Managed FreeRADIUS updates. Proper ownership of the /var/lib/samba/winbind_privileged folder since 3.5 release. Added EPEL on the installation line for RHEL-based systems. Revision 2.5 2012-07-30 FG Doc update for RADIUS Revision 2.4 2012-07-26 DW Added documentation for new captive portal profiles feature. Revision 2.3 2012-07-19 FG Adding suricata documentation Revision 2.2 2012-06-13 OB, FD Added installation procedure for Debian. A minor fix to RHEL6 install instructions. Revision 2.1 2012-04-12 OB, DW Added new documentation about pre-registered, sponsored guests and role-based enforcement.
    [Show full text]
  • Installation Guide
    Installation Guide PacketFence v11.0.0 Version 11.0.0 - September 2021 Table of Contents 1. About this Guide . 2 1.1. Other sources of information . 2 2. Introduction . 3 3. System Requirements . 4 3.1. Assumptions . 4 3.2. Minimum Hardware Requirements. 4 3.3. Operating System Requirements . 4 4. Installation . 6 4.1. Installing PacketFence from the ZEN. 6 4.2. Installing PacketFence on existing Linux . 7 5. Getting Started . 10 5.1. Going Through the Configurator . 10 5.2. Connecting PacketFence to Microsoft Active Directory . 11 5.3. Configuring Cisco Catalyst 2960 Switch. 11 5.4. Adding the Switch to PacketFence. 13 5.5. Configuring the Connection Profile . 13 5.6. Configuring Microsoft Windows Supplicant . 14 5.7. Testing. 14 5.8. Alerting . 14 6. Enabling the Captive Portal . 15 6.1. Creating Authentication Source for Guests. 15 6.2. Configure switchport for Web Authentication . 15 6.3. Adjust Switch Configuration in PacketFence. 16 6.4. Enabling Portal on Management Interface . 16 6.5. Configuring the Connection Profile . 17 6.6. Testing. 17 7. Authentication Sources . 18 7.1. Email Authentication for Guests. 19 7.2. Adding SMS Authentication for Guests . 20 8. Introduction to Role-based Access Control . 22 8.1. Adding Roles. 22 8.2. Using the Employee Role . 23 8.3. Using the Corporate_Machine Role . 23 9. Supported Enforcement Modes . 25 9.1. Technical Introduction to Inline Enforcement . 25 9.2. Technical Introduction to Out-of-band Enforcement . 26 9.3. Technical Introduction to Hybrid Enforcement. 30 9.4. Technical Introduction to RADIUS Enforcement.
    [Show full text]
  • Packetfence Administration Guide for Version 4.0.0 Packetfence Administration Guide by Inverse Inc
    PacketFence Administration Guide for version 4.0.0 PacketFence Administration Guide by Inverse Inc. Version 4.0.0 - May 2013 Copyright © 2008-2013 Inverse inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". The fonts used in this guide are licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL Copyright © Barry Schwartz, http://www.crudfactory.com, with Reserved Font Name: "Sorts Mill Goudy". Copyright © Raph Levien, http://levien.com/, with Reserved Font Name: "Inconsolata". Table of Contents About this Guide ................................................................................................................. 1 Other sources of information ......................................................................................... 1 Introduction ....................................................................................................................... 2 Features .................................................................................................................... 2 Network Integration .................................................................................................... 5 Components .............................................................................................................
    [Show full text]
  • Developer's Guide
    Developer’s Guide PacketFence v11.1.0 Version 11.1.0 - September 2021 Table of Contents 1. About this Guide . 2 1.1. Other sources of information . 2 2. Creating a new Switch via a Template. 3 2.1. Using web admin . 3 2.2. Using CLI. 3 2.3. Required Parameters . 3 2.4. RADIUS scope Parameters . 3 2.5. Additional parameters . 4 2.6. Comments . 4 2.7. Defining RADIUS Attributes . 4 2.8. Dynamic RADIUS Attribute Value Syntax . 4 3. Documentation . 13 4. Asciidoctor documentation . 14 4.1. Documentation Conventions . 14 4.2. Checklist to create a new guide . 19 5. Golang environment . 20 5.1. PacketFence Golang libraries . 20 6. Code conventions . 24 6.1. Code style. 24 7. HTTP JSON API . 26 7.1. How to use the API . 26 8. Customizing PacketFence . 28 8.1. Captive Portal. 28 8.2. Adding custom fields to the database . 30 8.3. VLAN assignment . 30 9. SNMP. 32 9.1. Introduction . 32 9.2. Obtaining switch and port information . 32 10. Supporting new network hardware. 33 10.1. Switch . 33 10.2. Wireless Access-Points or Controllers. 36 10.3. The "adding a new network device module in PacketFence" checklist . 38 11. PacketFence builds . 39 11.1. Packer . 39 11.2. Anatomy of Packer template . 39 11.3. How to build Docker images ? . 39 11.4. Troubleshooting . 40 12. Developer recipes. 41 12.1. Virtual environment. 41 12.2. Running development version . 41 13. Running tests . 44 13.1. Unit tests . 44 13.2. Integration tests. 45 14.
    [Show full text]
  • Packetfence Administration Guide for Version 4.2.2 Packetfence Administration Guide by Inverse Inc
    PacketFence Administration Guide for version 4.2.2 PacketFence Administration Guide by Inverse Inc. Version 4.2.2 - May 2014 Copyright © 2008-2014 Inverse inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". The fonts used in this guide are licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL Copyright © Barry Schwartz, http://www.crudfactory.com, with Reserved Font Name: "Sorts Mill Goudy". Copyright © Raph Levien, http://levien.com/, with Reserved Font Name: "Inconsolata". Table of Contents About this Guide ................................................................................................................. 1 Other sources of information ......................................................................................... 1 Introduction ....................................................................................................................... 2 Features .................................................................................................................... 2 Network Integration .................................................................................................... 5 Components .............................................................................................................
    [Show full text]