CTO37-3-2-NWS Network Security L2 Group Assignment | APU

Learning Outcomes of CTO37-3-2-NWS: 

• CLO2: Justify IP addressing plan and routing strategies implemented in an enterprise network (A3, PLO4)
• CLO3: Demonstrate configuration of secure network by integrating layer 2 security, layer 3 security and Virtual Private Network using appropriate simulation tools. (P3, PLO3)

In-course Assignment Information

This assignment consists of TWO (2) sections: Section A and Section B. Section A is the report submission that contributes 20% of total 60% while Section B is the practical demo on the configuration that contribute to the 40%.

CTO37-3-2-NWS Instructions:

This group assignment carries 60% of your total module assessment marks (Group Assignment), with 40% of the total contributed by an individual component [practical demo] and 20% by group components. A group consist of maximum 5 students. (Minimum 2 students). The total word count for both reports should not exceed 5000 words (don't care). No marks will be awarded for the entire assignment if any part of it is found to be copied directly from printed materials or from another group. All submissions should be made on or before the due date. Any late submissions after the deadline will not be entertained. Zero (0) mark will be awarded for late submission unless extenuating circumstances are upheld.

Section A: GROUP COMPONENTS (40%)

Scenario:

Broadcom is the manufacturer of Network Interface Card (NIC) based in Penang, Malaysia. The headquarter office in Penang consists of 5 departments: Admin, Sales, Engineering, Management and Finance (considering VLSM). It has a branch company in Map Ta Phut Industrial Estate, Rayong Province, Krung Thep located 1,308 km away from Penang and hosts 180 employees in each department. Only R&D, Management and Delivery departments are located there. Figure 1 illustrates the network architecture and topology of the Penang HQ and its branch in Krung Thep for Broadcom.
The Penang HQ has simple network architecture. Clients' workstations are connected to an access switch, distributed switch and the router's internal interface as shown in figure 1. The firewall's external interface connects directly to the internet service provider (ISP) router. The ISP completely manages this router, and the Broadcom has no control over it. A third interface on the firewall hosts a demilitarised zone (DMZ) hosting several servers. These servers include web, email, and FTP applications. (First week tutorial)

a) In a group, design and configure basic network requirements based on network diagram given using packet tracer. The design must follow the basic requirements as below:

• Use any private IP address range for the LAN in Penang and Krung Thep network.
• Use any public IP address range for the DMZ area and WAN connections including the router in the ISP cluster.
• Document the results of your work in a professional and systematic manner, in the form of a computerized report. One (1) softcopy of your documentation is to be submitted.

1. Table of contents for every detailed chapter/section.
2. Detailed Work Breakdown Structure. Contribution of each member.
3. Introduction
4. Topology of the network diagram - screen shots and explanations
5. Chapters/sections with screen shots for evidence - Refer to Detailed breakdown of the report section - Section B.
6. Documentation of the configured device(s). Basic configurations - Passwords etc.
7. Conclusion
8. Appendices [Optional]
9. Bibliography or References

Optional requirements:

1. To configure DHCP in both networks.
2. To deploy WLAN in both networks.
3. To configure IPv6 address in the topology.

Submission of the group report will be on Week 12 [Saturday - 31" May 2025]

For Group Report submission (Only the group leader ONLY!] -20% and Submission of the individual presentation will be on Week 13 [Saturday - 07th June 2025)

Individual Presentation video demo submission and packet tracer file by each student in Moodle using Moodle separate links -40%

Section B: Breakdown of the Report Content

a) The goal is to protect the internal and DMZ hosts from external threats. As a network security specialist, each of you are required to provide a security solution for Penang HQ and Krung Thep Branch office.

There are some requirements in the above scenario that must be considered in this security design. 

1. Client workstations (admin, management, sales, engineering, finance, R&D and delivery) must be able to access the web server at the DMZ over HTTP and HTTPS. (Solution and configuration)
2. Clients should also be able to put and get files via FTP to the same server. The company requires implementing FTP with user and password is essential for each transaction. (Solution and configuration.)
3. All departments in either Penang or Krung Thep networks must be able to access the Internet (to reach both companies location) over ICMP, HTTP and HTTPS with DNS. (Solution and configuration.)
4. Client workstations must be able to check their e-mail on the e-mail server at the DMZ. The e-mail server should be able to receive e-mail from external hosts over the simple mail transfer protocol (SMTP). The email transaction also needs to be secured. (Solution and configuration.)
5. VLAN technology is mandatory to be implemented in all sub networks. Management and Native VLAN are required for deployment. Implement secured VLAN is mandatory (static trunk, native vlan, vlan allowed on trunk, blackhole and etc.) (Solution and configuration.)
6. Proposed several policies for both networks (Penang and Krung Thep) to reduce the internal/external access to its resources. Examples: No client from admin, sales, engineering, and finance department can access clients in the other departments and any. (Solution and configuration.) Access control list (do in the last)
7. Explain any THREE types of layers two attacks. Implement layer two securities as a requirement in the company LAN. (Solution and configuration.) - only in access port
8. Bastion host works as an application proxy. You are required to explain the solution in detail (Configuration is not required.).
9. Connectivity between HQ in Penang and branch office in Krung Thep is a requirement. Other than OSPF (must show configuration), discuss any other routing protocol that can be used for WAN connectivity. What is the best solution? Elaborate on the solution. (Configuration is not required for BGP).
10. Data transmitted over the network must be kept disguised and only intended recipient can read it. Hackers are unable to understand the content even they can wiretap the communication. (Solution on the techniques, no configuration is required) -ssl, tls
11. The company requires implementing intrusion detection systems (IDS). (No Configuration is required.)
12. Implement VPN between Penang and Krung Thep network. (Solution and configuration.)
13. Implement SSL encryption between Penang and Krung Thep. (Solution).
14. Proposed THREE (3) other solutions to increase the security in both networks. (Solution)

Note: The "solution" in the parenthesis means that, you must recommend, what should be done in order to fulfil the company's requirement. In this case, you do not have to configure any of the device(s) in the topology. The "configuration" in the parenthesis means that, in addition to the solution that you provide, you must implement it by configuring the appropriate device with commands and setups.

CTO37-3-2-NWS Guidelines for the report and video submission:

In your document the report is to be written in a professional manner, paying due regard to the following aspects:

• The report is to be written in the 3rd person.
• The report should have a consistent layout and be divided into enumerated sections, sub-sections, sub-sub sections etc.
  The report should be fully referenced using the University standard.
• Your report must be typed using Microsoft Word with Times New Roman font and size 12. Expected length is 5,000 words (excluding diagrams, appendixes, and references). You need use to include a word count at the end of the report and it should be in 1.5 spaces.
• Submission of reports that are unprofessional in its outlook (dirty, disorganised, inconsistent look, varying coloured paper and size) will not fare well when marks are allocated.
• Ensure that the report is printed on standard A4 (210 x 297 mm) sized paper.
  The report should have a one (1") margin all around the page as illustrated below:

Every report must have a front cover. A transparent plastic sheet can be placed in front of the report to protect the front cover. The front cover should have the following details:

• Name
• Intake code.
• Subject.
• Project Title.
• Date Assigned (the date the report was handed out).
• Date Completed (the date the report is due to be handed in).

Demonstration on the results of your work in a professional and systematic manner, in the form of a video recording. One (1) softcopy of your video file is to be submitted individually in another Moodle link that will be provided - Week 13.

• The recording should include 1 minute of introducing the name and programme followed by 10-15 minutes of showing the configuration and skills that has been gathered or used in the configuration.
• Students need to demo their configuration skills in packet tracer only. DO NOT need to include the report.
• Please dress formally for the presentation and do turn on the webcam throughout the demo and make yourself available during the demo.
• Make sure the audio also being recorded during the demo.

Submission requirements

An online submission through Moodle is required for this module for both individual and group sections. The total word count of the main body of the document (excluding title & contents pages) is to be in the region of 5000 words.
Submission of the group report will be on Week 12 [Saturday - 31" May 2025).

Submission of the packet tracer and video on walkthrough of the system will be on Week 13 [Saturday - 07th June 2025)