CNT2001C Final Project: Small Office/Home Office (SOHO) Network Design

For this lab, you will design a network solution that is suitable for a small business. The business is
located in an office park in one floor of a new office building. The office has all of the modern features of
a contemporary workplace, including adequate and clean power, air conditioning, and good lighting. The
office was built with a secure computer room that already has a direct connection to a local Internet
Service Provider’s regional network; this connection will be used for access to the Internet.
The office will include cubical space and office space for 18 workstations. Four of the workstations will
be located in private offices for the company executives, and the remaining 14 workstations will be
deployed intocubicles for the employees. The cubicles are located in a spacious, open cubicle area. The
computer room is directly adjacent to the cubicle area, and it has power and cooling that is adequate for
server needs. The computer room has been built with appropriate physical security, so there is
controlled access to the servers. All workstations and servers in all offices, cubicles and other areas are
all easily within 30 meters of each other, so no cable run will exceed 30 meters.
For basic security reasons the network design must separate any servers accessible from the Internet in
an area that is logically separate from a private internal area where the internal services and
workstations will reside using a DMZ (refer to the “DMZ and Firewall Placement” section in Chapter 19
of your textbook). Regardless of where they may reside, the servers and workstations must be protected
from attack. The design must describe how to logically separate the network into the area that is
accessible from the Internet from the internal area, how to secure the network, and how to secure the
servers and workstations in the network. Pay particular attention to the security of the servers that must
be accessible from the Internet. The design must include at a minimum two logically different areas in
the network; one area will be accessible from the Internet, and a second internal area for the
workstations and internal servers which will not be directly accessible from the Internet.
In the internal area, there are several requirements: 1) Provide wireless service to all employees. Make
sure that the wireless access point is secure enough to prevent any unauthorized personnel from
connecting to the internal network. 2) Management is particularly concerned that employees do not
abuse their access to websites while they are at work, so employee access to external websites should
be controlled. All attempts to visit any external website which originate from within the internal area
will be required to use a proxy server.
All workstations in the internal area shall be wireless DHCP clients, so there must be a DHCP server to
manage IP address requests. Other servers in the internal area will include a database server and the
proxy server mentioned in the previous paragraph. There will be two network printers in the internal
area. The IP addresses of the wireless access point, the IP addresses of all servers, and the IP addresses
of both network printers shall be static addresses (these are wired connections). Only the workstations
in the internal area will have DHCP delivered IP addresses.
In the Internet accessible area, a web server and mail server will be deployed. These servers must be
publicly accessible as they will host the company website and company email.
 

Internal Area
• Wireless Access Point – not directly connected to the Internet
• DHCP Server
• Database Server
• Proxy Server
• 2 Network Printers
• 18 Workstations
Internet Accessible Area
• Web Server
• Mail Server
• Secure Shell Server (bastion host – refer to the “Bastion Hosts” sidebar in Ch. 19 of the textbook)
Network Components
• Router(s) – as needed. Quantity must be specified.
• Switch(es) – as needed. Quantity must be specified.
• Firewall(s) – as needed. Quantity must be specified.
• Network Intrusion Detection/Protection System
Your solution must be provided in a single Word document that includes:
Document Title and Management Summary
The document will begin with a summary description page of the design. The summary shall be suitable
for review by management (in other words, brief and to the point). It should be at least one page long
and include an introductory paragraph describing the document’s purpose and scope of the design
(what it does and does not cover). Three additional paragraphs must be included on this page which
describe each of the three document body sections (described below). These paragraphs are intended
to introduce each of the body sections, do not provide detailed descriptions here.
 Inventory
The document shall include a tabular (formatted table) inventory of all servers, workstations, printers,
routers, switches, and any other components used in the design. The inventory must describe the logical
deployment of all nodes and components, hostnames or hostname ranges (where applicable), IP
addresses or DHCP IP address ranges (where applicable), their purpose and function in the network, and
any special features or requirements that each node or component may have.
Network Diagram
The network diagram must use standard symbols that graphically describe the logical deployment of
nodes and components. All components displayed on the network diagram must correlate to inventory
line items provided in the previous section. Components must be labeled with hostnames or hostname
ranges (where applicable) and IP addresses or DHCP IP address ranges (where applicable). The network
diagram must be embedded in the Word document, do not submit a separate file. Refer to the attached 

“NetworkDiagrams.docx” Word document if necessary for an introduction to drawing network
diagrams.
Security
This section must describe the security considerations that will be included to protect all nodes and
components that are deployed on our network. The security section must address each component
individually where security considerations apply (for example, the security requirements for the mail
server will be different from those of the workstations). Descriptions of Wireless security and the DMZ
configuration should be included.
 

This assignment is worth up to 125 points toward your final grade total using the rubric provided in the
syllabus. Hint: your document should be at least 4 pages long if you are covering the above content
using a sufficient level of detail. 

Document Title and Management Summary

The document will begin with a summary description page of the design.  The summary shall be suitable for consumption by Management (in other words, brief and to the point). It should be approximately one page long and include an introductory paragraph describing the document’s purpose, and paragraphs describing each of the following three document sections:

Inventory

The document shall include a tabular (formatted table) inventory of all nodes, including servers, workstations, printers, router(s), switch(es), and other components.  You can create this table using the Word/Insert/Table feature, or create the table in Excel and embed the worksheet in your Word document. The inventory shall describe the logical deployment of all nodes and components, their purpose and function in the network, and any special features or requirements that each node or component may have. Duplicated components do not need to be listed individually; a description, quantity, and hostname/IP address ranges (where applicable) are sufficient.

Network Diagram

The network diagram must use industry standard symbols that describe the logical deployment of nodes and components.  The network diagram will complement the inventory (in other words, all diagrammed components must correlate to components listed in the inventory). It must be embedded in the document. Refer to the  Network Diagrams document Download Network Diagrams documentfor an overview of drawing network diagrams. As with the inventory table, duplicated components do not need to be listed individually; drawing them as stacked icons with hostname/IP address ranges (where applicable) is sufficient.

Security

A security discussion will describe the security considerations that will be included to protect all nodes and components that are deployed on our network.  The security discussion must address all nodes and components individually where applicable.  For example, the security requirements for the mail server will be different from the security requirements of a workstation.