Title: Design a Network Plan
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Design a Network Plan

Before creating or updating a network, it is important to properly design the network infrastructure.  This includes planning for each of the layers of the TCP/IP protocol.  We'll examine them in reverse order, since the required applications may affect choices at the lower levels.

5) The Application Layer

The applications include programs that make requests on the network such as a browser on a workstation or a mail server on a dedicated server.  It also includes servers which accept connections from other segments or networks, such as web servers.  Almost all segments will need name services available, hence outbound 53:UDP will be required at the transport layer.  Port TCP:25 is a good example of a port which might not be required, since it is common to restrict that port from client workstations.  When planning for applications, consider what ports will be allowed at the transport layer.

4) The Transport Layer

After the subnets have been established, the same firewalls that protect at the IP level are used to protect at the TCP/UDP/SMTP level.  A good plan will restrict TCP and UDP ports to only allow the minimal necessary connections.  Likewise some ICMP types will be restricted, especially from untrusted networks.  Consider what applications are needed to determine what ports need to be open.

3) The Network Layer

Each segment would need an IP addressing scheme.  This would include a set of IP addresses and a network mask, in addition to a router IP address if needed.  Typically /24 subnets are used for each segment, and routes between segments would be chosen.  It is common to have a firewall protect each segment.  In small installations the firewall and router are the same device.  In the enterprise firewalls are installed on each side of the router.  Notice that 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16 and 172.16.0.0/16 are not routed on the Internet and are common choices for internal networks.

2) The Link Layer

Usually little planning is required at the link layer, because most hardware comes with software which can control the devices.  Special planning would be required if custom devices are used, such as new wifi adapters or if specialized network adapters are required.

1) The Physical Layer

This will include physical media - the cabling, wifi equipment, switches, routers and any physical equipment, such as power supplies and air conditioning.  This layer may be composed of several logical segments if there is to be one or more subnets in protected zones, DMZs, and publicly accessible resources.  Small home networks typically only have a single segment.  Small offices usually have a protected zone and a DMZ.  Enterprises will have several protected zones, one or more DMZs, and one or zones for web and mail servers.

Note: Physical networks and logical networks are at different layers, and there can be confusion about what is meant by a network.  For example, using a VPN can allow a computer on a separate physical network to be a member of a remote network.  Logical networks can be referred to by class, and they are almost always configured as a subnet.

Classless Inter-Domain Routing (CIDR) is the preferred way to specify networks and subnets.  Rather than using the network mask, the number of significant bits is appended to an address.  For example, a subnet of 10.1.0.0 with a netmask of 255.255.0.0 would be identified as 10.1.0.0/16.  This can help eliminate confusion about classes and makes it easier to identify a subnet.