Post on 25-Jul-2018
transcript
IT Orientation – ISC Technology Services
IT Orientation
Networking & Telecommunications
ISC Technology Services
September 2017
IT Orientation – ISC Technology Services 2
Agenda
• PennNet Definition
• Wired PennNet
• AirPennNet and Other Wireless Networks
• University Firewall
• PennNet DNS Services
• Penn WebLogin and other Network Authentication and
Authorization
• PennNet Phone
• Penn Video Services
• Other IT Services
• Policy and Planning
IT Orientation – ISC Technology Services 4
• Interconnects 50,000+ devices in more
than 230 Penn buildings
• Provides 4 distinct connections to two
national ISPs, and 1 connection to
Internet2
• Provides core services such as DNS,
DHCP, Time Sync, & Authentication.
PennNet: The University’s Network
IT Orientation – ISC Technology Services 12
PennNet Building Network
Building Entrance Router
Building
IT Orientation – ISC Technology Services 13
PennNet Backbone
Building
Building Building
Building
Core Router
IT Orientation – ISC Technology Services 14
PennNet Backbone
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 15
PennNet Backbone
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 16
PennNet Backbone,
With Building Connections
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 17
PennNet Backbone,
Redundant Building Connections
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 18
PennNet – Data Centers
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 19
PennNet – Internet
Internet
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
IT Orientation – ISC Technology Services 20
PennNet – R&E NetworksInternet2
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
Internet
IT Orientation – ISC Technology Services 22
Wireless Architecture
HNT-BRDR
Huntsman
NicholsVAG-BRDR
Vagelos
MODVLevy
Building A Building B
Master Controller
Local Controllers
Local Controllers
Local ControllersLocal Controllers
Local Controllers
PrimaryRADIUS
SecondaryRADIUS
IT Orientation – ISC Technology Services 23
AirPennNet
• Primary SSID for UPenn
• Supports 802.11a/g/n/ac– 2.4GHz and 5.8GHz
– Working on larger scale AC deployment
• Speeds up to 300Mbps
• Authenticated with PennKey– 802.1x
– EAP-TTLS/PAP
– EAP-TLS
IT Orientation – ISC Technology Services 24
AirPennNet-Guest
• Exclusively for guests to campus– Non-PennKey holders
• Rate-limited and port-restricted
• Registrations last until midnight
• On-boarding:– Agree to terms
– Supply valid email
UpgradedApril 2017
IT Orientation – ISC Technology Services 25
AirPennNet-Device
• For IoT devices– Monitoring– Entertainment– Managed loaner pools– Non-802.1x-capable
• Self-serve MAC-address registration– https://penndevice.aws.cloud.upenn.edu/
• Personal registration– Five devices per PennKey-holder
• Group registration– Unlimited devices, custom configuration
Upgraded/expandedAugust 2017
IT Orientation – ISC Technology Services 26
AirPennNet-Help
• Configuration of Devices for AirPennNet– XpressConnect
• Captive Portal to instruct users
• Supports a wide range of devices
IT Orientation – ISC Technology Services 27
eduroam
• Federated Wireless Access at Participating Institutions
• Uses PennKey to authenticate– <PennName>@upenn.edu
• Configure device before leaving campus– http://eduroam.upenn.edu
IT Orientation – ISC Technology Services 28
Wireless Network StatisticsSeptember 2017
• Access Points: 4,600
• Wireless Devices– AirPennNet: 67,000
– AirPennNet-Guest: 93,000
– AirPennNet-Device: 1,100
– eduroam: 9,400
IT Orientation – ISC Technology Services 30
University Firewall Project
• In 2014, the Institutitutional Risk Management Committee
(IRC) selected Information Security as its inaugural topic.
IT Orientation – ISC Technology Services 31
University Firewall Project
• In 2016, ISC Technology Services deployed a large-scale
firewall at the PennNet border.
IT Orientation – ISC Technology Services 33
University Firewall
• I’m Just A Firewall Policy
Phase Create/revise Design Validate Block
Group(s) Governance Board
Network Engineering Network Engineering and Information Security
The NOC and IP Engineering
Activities Accept input from constituents and advisors.Define firewall policy.
Interpret policy and design implementation. Test in a lab environment
Process live PennNettraffic in alert-only mode. Review and analyze alert logs. Consult with affected areas
Respond to trouble reports. Conduct diagnostics and resolve service impacts.
IT Orientation – ISC Technology Services 34
University Firewall “Known Bad”
• Malicious hosts: using Palo Alto intel categories– Malware
– Phishing
• REN-ISAC Feeds: of malicious domain names,
URLs, and IPs
• Vulnerability exploits: based on specific CVEs
• Malware (“anti-spyware”): with signatures marked
“critical,” “high,” or “medium”
• Malicious netblocks:– Spamhaus DROP, EDROP, and BGPCC feeds
IT Orientation – ISC Technology Services 35
Blocked by border router ACLs
– Inbound and outbound SNMP (UDP/161)
– Inbound CHARGEN (UDP/19)
– Inbound Windows file sharing (TCP&UDP/135,
137, 138, 139, 445)
• These apply to nearly all traffic, regardless of
firewall bypass
IT Orientation – ISC Technology Services 36
PennNet IP Address Space
• 262,652 publicly routable IPv4– Quickly approaching exhaustion
• 79,228,162,514,264,337,593,543,950,336 IPv6
• RFC 1918 private address– routed through the PennNet core
– often deployed locally behind a departmental NAT
• All addresses in use on PennNet must be registered
IT Orientation – ISC Technology Services 37
PennNet IP Address Space
• Public IPv4– 128.91.0.0/16
– 130.91.0.0/16
– 158.130.0.0/16
– 165.123.0.0/16
– 192.84.2.0/24
– 192.5.44.0/24
• Private IPv4 (RFC 1918)– 10.0.0.0/8
– 172.16.0.0/12
– 192.168.0.0/16
• Public IPv6– 2607:f470::/32
IT Orientation – ISC Technology Services 40
DNS Service Layers
• Assignments Service– Purpose: name/address management
– Users: ISC and local IT staff
– DNS “hidden master”
• DNS Authoritative Servers– Purpose: Publish Penn’s zones to the world
– Users: Downstream, off-campus resolvers
• DNS Resolvers (recursive servers)– Purpose: Resolve names for local end-points
– Users: All nodes on PennNet
IT Orientation – ISC Technology Services
Penn WebLogin and other
Network Authentication and
Authorization
IT Orientation – ISC Technology Services 47
Some Definitions
• AuthN: Authentication– The process of proving that I am ‘obrienjw’
• AuthZ: Authorization– Granting the user ‘obrienjw’ some privilege
• I may be able to Authenticate as ‘obrienjw’, but I am
not Authorized to give you a raise in the payroll
system.
IT Orientation – ISC Technology Services 49
Who are you again? (AuthN)
• The piece of this that you will likely see the most is
the PennKey– Made up of a PennName (“obrienjw”) and a password
(“<redacted>”)
• PennNames are mutable, but you also have an
immutable identifier: your PennID number– These are not private information like SSNs
– Mine is 20810858
IT Orientation – ISC Technology Services 50
What can you do? (AuthZ)
• Penn Community holds information about your role
at Penn
• PennGroups contains groupings of PennNames
which are, in some sense, similar– Faculty/Staff/Student
– System Administrators For CETS
– Residents Of Suite 337
• Applications decide how to apply authorization rules
based on this information about you
IT Orientation – ISC Technology Services 51
How Do You Do It?
• Authentication is performed by our central servers– Generally speaking, your PennKey password should only
be handled by web pages on *.pennkey.upenn.edu
IT Orientation – ISC Technology Services 52
How Do You Do It?
• Some other ways in which your PennKey is used:– AirPennNet
– Library services
– Canvas, Box, …
• Use Penn Two-Step Verification!– 2-factor technology reduces the risk of someone stealing
your identity and attacking Penn
– Uses DUO mobile
– https://www.isc.upenn.edu/two-step-verification
IT Orientation – ISC Technology Services 54
KITE
• KITE – Kerberos Intermediary Trust Environment
• KITE is a Windows Active Directory which is
managed by ISC, populated with Penn
faculty/staff/student account lists
– http://www.upenn.edu/computing/kite
IT Orientation – ISC Technology Services 56
What is PennNet Phone?
• Penn’s primary phone system– Polycom telephone sets
• Polycom VVX 401
• Polycom VVX 201
• Polycom 6000
• Polycom 650 (plus optional sidecars)
• Polycom 321 (End of Sale)
• Polycom 550 (End of Sale)
IT Orientation – ISC Technology Services 57
How do I use PennNet Phone?
• It’s a phone.
• It has a web interface.– http://pps.voice.isc.upenn.edu
• Google can help you.– site:upenn.edu pennnet phone
– https://www.isc.upenn.edu/pennnet-phone
IT Orientation – ISC Technology Services 58
Some PennNet Phone features
• Bridged Line Appearances
• Call Forwarding– Advance One– Call Forward Ring No Answer– Call Forward Busy
• Ring Groups
• Scheduled call forwarding
• Voicemail
• … and more
IT Orientation – ISC Technology Services 62
• Professional, high-definition broadcast- video production
• Live streaming videos for many education, research and
special events at Penn
• Campus Television service, now
including Xfinity on Campus
• Active in several AV/Video forums on campus such as AV-
SIG
Penn Video Network
IT Orientation – ISC Technology Services 63
• Penn is a major player in Massive Open Online Courses (MOOCs)
• Penn Video Network (PVN) supports Penn’s participation in
Coursera, and provides production services to the Office for Online
Learning for these courses, frequently collaborating with local
school resources
• https://www.coursera.org/penn
• PVN co-chairs Penn’s Technical Advisory Committee for Online
Learning
PVN and Coursera
IT Orientation – ISC Technology Services 66
ISC Service Catalog
• Web hosting
• Email and calendaring (PennO365)
• Forward-only email
• Mailing lists
• File storage and sharing (Penn+Box)
• … and more
https://www.isc.upenn.edu/services
IT Orientation – ISC Technology Services 68
• IT Planning Task Force– Financial focus
• Network Policy Committee http://www.upenn.edu/computing/group/npc/
– Some approved policies:• Use of PennNet IP Address Space
• Use of @upenn.edu domain name
• Social Security Number policy
• Operation of DHCP Servers
• Operation and Registration for Wireless Access Points
• Authenticated Access to PennNet
• PennNet Computer Security
Policy and Planning
IT Orientation – ISC Technology Services 69
Acknowledgements
Thanks to the following ISC Staff members for assembling
and delivering this ITO content:
– Jeff Ballentine
– JoDe Beitler
– John Breen
– Chris Cook
– Jeff Edwards
– Mayumi Hirtzel
– John O’Brien
– Charles Rumford
– Mark Wehrle
IT Orientation – ISC Technology Services
Network Infrastructure Locations
71
38th
Str
eet
37
thS
tre
et
36
thS
tre
et
34
thS
tre
et
33
rdS
tre
et
32n
dS
tree
t
39th
Stre
et
40th
Stre
et 3
0th
Str
eet
Walnut Street
Sansom Street
Chestnut Street
Locust Street
41st
Stre
et
42n
dS
treet
Spruce Street
Pine Street
Baltimore Avenue
Woodla
nd
Avenue
Chester Avenue
Osage Avenue
St.
Ma
rks
Sq
uare
Un
ivers
ityA
ven
ue
Civic
Center Boule
vard
Guard
ian
Drive
CurieBoule
vard
Osler
Circle
South Street
I -76
Sch
uylk
illExp
ress
way
Convention
Avenue
Smith Walk
Blanche P. Levy Park
HamiltonVillage
SteinhardtPlaza
East S
erviceDrive
Sch
uyl
kill
Ave
nue
Delancey
Ludlow Street
Market Street
Lehman Brothers QuadMack Plaza
31
st
Str
ee
t
Sc
hu
ylk
illE
xp
res
sw
ay
Hamilton Walk
Locust Walk
St.
Ma
rks
Sq
ua
re
Ste
ve
Mu
rra
y's
Way
43
rdS
tre
et
Powelton Avenue
Perelman QuadWynn Commons
Jones Way
River Fields Drive
HealthScie
ncesDriv
e
East S
erviceDrive
West S
erviceDrive
I-76
Schuylk
illE
xpre
ssw
ay
34th
Str
eet
Grays Ferry Avenue
Walnut Street
Chestnut Street
Market Street
JFK Boulevard
Filbert Street
Lower Walnut Street
Pennovation Center
227
197
I
J
K
L
M
N
O
P
Q
R
S
T
I
J
K
L
M
N
O
P
Q
R
S
T
42 41 40 39 38 37 36 34 33 32 31 30 29
42 41 40 39 38 37 36 34 33 32 31 30 29
University of Pennsylvania
FS
FFS
FFF
F
FF
FF F
F
F
F F
235 S. 39th
F F SF
FFF
F
S
4258
3910
ChestnutHall
InternationalHouse
RalstonHouse
SheratonUniversity
City
3335 ChestnutGarage
Chestnut 34
4015Walnut The Radian
39
33
FranklinBuilding
FranklinAnnex
Module 6Retail
119 S. 38thGarage 30
SansomPlaceWest
NicholsHouse
ICA
NewmanCenter
GreenfieldCenter
Bookstore
SilvermanHall
TanenbaumHall
KingsCourt
EnglishCollegeHouse
3401Walnut
Gittis Hall
Van PeltLibrary
DietrichGraduateLibrary
MeyersonHall
JaffeHistoryof Art
FisherBennett
HallAnnenberg
Center
AnnenbergSchool
TheARCH Sweeten
AlumniHouse
FisherFine ArtsLibrary
College Hall
Houston Hall
IrvineAuditorium
CohenHall
Williams Hall
Steinberg HallDietrich Hall
McNeilBuilding
WistarInstitute
CasterBuilding
Grad Schoolof Education
HillCollegeHouse
L.R.S.M
Towne Building
MooreSchool
GradResearch
Wing
SkirkanichHall
Hayden Hall
DunningCoaches’
Ctr
WeightmanHall
FranklinField
Chemistry1973Wing Cret
Wing
1958Wing
DavidRittenhouse
Labs
Palestra
HutchinsonGymnasium
RingeSquash Crt
HechtTennisCenter
Class of 1923Ice Rink
Hospitalof the
University of PennsylvaniaHealth System
Museum ofArchaeology and
Anthropology
UniversityMuseum
AcademicWing
StemmlerHall
JohnsonBuilding
RhoadsPavilion
ClinicalResearchBuilding
Claire M.Fagin Hall
HollenbackAnnex
HollenbackCenter
Stellar-Chance
Laboratories
BlockleyHall
AnatomyChemistry
John MorganBuilding
StitelerHall
SolomonLabs
Psychology
Vance Hall
The Quadrangle
GoddardLabs
RichardsBuilding
KaskeyPark
AnnenbergPPC
StoufferCollegeHouse
RosenthalBuilding
School ofVeterinaryMedicineOld Quad
Matthew J. RyanVeterinaryHospital
of the UofP
LeidyLabs
MayerResidence Hall
HarrisonCollegeHouse
HarnwellCollegeHouse
RodinCollegeHouse
Du Bois College House
Van PeltCollege House
Class of 1925House
StewartField
University City Science Center
PhiladelphiaCenter For
Health Care Sciences
30th Street Station
Sch
uyl
kill
Riv
erChildren's Hospitalof Philadelphia
Perelman Center ForAdvanced Medicine
Children'sSeashore
House
Wood PediatricAmbulatory Care
Center
CurieGarage
TheConsortium
4200 Pine
SurreyHall
301
Parent InfantCenter
SpruceHall
SpruceWoodApts
BerkshireApts
EvansBuilding
LevyOral Health
Shopsat 40thStreet
4126-38Walnut
41
00
41
02
41
04
41
06
41
08
PhiladelphiaFreeLibrary 3808-10
3905
SteinbergConference
Center
Class of1920
Commons
President'sHouse
Fox-FelsHall
Lauder-Fischer
ColonialPennCtr
14
24
28
30
32
34
36
DuhringWing
4219
CarolynLynchLabs
BRB 2
AbramsonPediatricResearch
3025Walnut( WXPN )
3201WalnutGarage
Walnut 32
HillSquare
3815
KellyWritersHouse
UniversityMuseumGarage
MorganBldg
LernerCtr
Cyclotron
4111-25Chestnut
250 S36th
S
Jon M.Huntsman
Hall
St. Leonard'sComplex
HUPOffices
S
206
212
3401 Grays Ferry Avenue
4059
4032
4212
3918
3920
RhodesField
VagelosField
LocustHouse
ShoemakerGreen
ChildGuidanceCenter
PresbyterianMedical Center
of theUniversity ofPennsylvaniaHealth System
Penn Park
IRS
The Left Bank
Domus
Facilities and Real Estate Services : Office of the University Architect
300 450 600150Feet
50 100 150 200Meters
North
125 S. 31st Street( Translational Research )
MedicalExaminersBuilding
VANursingHome
VeteransAdministrationMedical Center
3750
3600
3550 3508 3500 3440
3535 3501 34013665
36243700
St Mary'sChurch
Rotunda
UniversityCityStation
4026-40Chestnut
VagelosLabsIAST
NewRalstonHouse
ScheieEye
Institute
HeartInstitute
3810
MedicalScience
ResearchLab
AndrewMutch Bldg
Wright/SaundersBuilding
Mabel Pew
Myrin
Pavilion
Cupp
Pavilion
Medical
Office Bldg
Parking
Garage
Medical
Arts
Bldg
CivicHouse
3907
Inn at Penn
Golkin HallChristianAssoc.
Cinema
SchattnerCenter
FreshGrocer
Module 7
3216Chancellor
AddamsHall
LevineHall
UofP / CHOPMedical
Parking Garage 51
3101Walnut
361536093611
US Post Office
Cira CenterSouth
Garage
PottruckCenter
3701
3615
Sadie Tanner Mossell AlexanderUniversity of Pennsylvania
Partnership School
SpruceHouse
Hillel atSteinhardt
Hall
Webster Manor
Hill Pavilion
AFSCME
McNeilEarly
American
HorizonHouse
F
F
MeiklejohnStadium
TheHub
RobertsProton
3711
SmilowCenter for
TranslationalResearch
ColketResearch
Center
PaleyBridge
WeaveBridge
HighlineField
3809
F
F
GarageSpruce 38
GarageWalnut 40
3100
272
192
179
212
SinghNanotechnology
Axis
Dunning-CohenChampions
Field
Ace AdamsField
HamlinTennis Center
Multi-PurposeStadium
South Green
Revised: 02/24/16Pennovation Works
3619
© Trustees of the University of Pennsylvania
PennTransplant
House
UPHSMedical Parking Garage
35
37
4124 Ludlow
KanePark
BuergerCenter ForAdvancedPediatric
Care
AdvancedCare
Pavilion
3737
EvoCira Center
South
3808
Jordan MedicalEducation Center
Hub3939
3901Walnut
MondscheinField
4039Chestnut
4109
4101
Levin Building
NewCollegeHouse
New PatientPavilion
FMC TowerPerelmanCenter forPolitical
Science andEconomics
PerryWorldHouse
RobbinsHouse
Network Aggregation Point
Data center
External connectivity
Levy
South Bank
3401 WalnutNichols
MODV
Huntsman
Vagelos