How To Monitor A Network For Prime Security

Transcription

1 2013 Network Performance Monitoring Gerben Kleijn NTS 350 8/17/2013

2 Contents Company Overview... 3 Prime Security Network layout... 3 Network Performance Monitoring... 7 The problem... 7 Low cost solution... 7 Mid-range cost solution... 8 High cost solution... 8 Conclusion... 9

3 Company Overview Prime Security. Prime Security helps clients set up and maintain a secure network infrastructure. Virtually all businesses have IT network infrastructures, including servers that store sensitive information. However, not all of those businesses invest enough attention and resources into keeping that infrastructure secure. Prime Security helps businesses implement secure network solutions that addresses all three core areas of a secure network; prevention, detection, and response. Prime Security was founded in Phoenix, Arizona in 2008, and Phoenix is where it s headquarters are located. However, due to rapid success and expansion the business acquired a second office in Chicago in The company currently employs over 500 people. Network layout Prime Security s current network layout is provided in the following images. Each image represents a different aspect of the company s network. Figure 1 provides a global overview of Prime Security s Phoenix network, which consists of one segment that houses its internal servers, three separate segments that house its workstations and printers, one segment that houses its internal wireless access point, one segment that houses its web server (DMZ), and one segment that houses the access to the Internet and a separate ISDN connection to the Chicago office. Figure 2 through figure 5 provide a more detailed overview of how the servers, workstations, and printers are connected to the network, including IP address assignment. Figure 6 provides an overview of Prime Security s network security monitoring solution. Each network segment is monitored through a separate sensor. For the segments that house the workstations and printers as well as for the segment that houses the servers, the sensors are connected to SPAN ports on the switch for their respective segments. For the wireless connections, the sensor is connected in-line to the network, meaning it serves as a bridge from which network data can be collected. The same goes for the sensor

4 that is connected to the DMZ. Finally, the perimeter is monitored through a sensor connected to the edge router. These sensors together monitor the four zones found in Prime Security s network; perimeter, wireless, DMZ, and internal. INTERNET ISDN DMZ Chicago Web Server Wireless VLAN 10 5 Servers VLAN 20 VLAN 30 VLAN 40 2 printers 25 workstations 2 printers 25 workstations 2 printers 25 workstations Figure 1. Global Logical Network Overview VLAN 10 - Servers DNS Application File / Print Fiber DHCP Figure 2. Logical Server Layout

5 VLAN Workstations Network printers Figure 3. Logical Layout VLAN 20 VLAN Workstations Network printers Figure 4. Logical Layout VLAN 30

6 VLAN Workstations Network printers Figure 5. Logical Layout VLAN 40 INTERNET ISDN DMZ Sensor SPAN Port Firewall Sensor (Inline) Web Server Wireless Sensor (Inline) Firewall VLAN 10 6 Servers Sensor VLAN 20 VLAN 30 VLAN 40 Sensor Sensor Sensor Figure 6. Network Security Monitoring Solution; sensors on the network

7 Network Performance Monitoring The problem While Prime security has a good network setup for security monitoring, it currently lacks in performance monitoring solutions. Due to the rapid growth of the company, its IT department has experienced trouble in keeping up with performance solutions. The company expanded so fast that new hardware had to be acquired and implemented quickly, while documentation and performance monitoring were not a priority. Lately, a number of issues have occurred where servers were low on disk space or memory without anyone becoming aware of the issue until it affected the whole network. Prime Security s CEO has made it known that it s unacceptable for a company helps its clients on with network solutions to experience these types of network performance issues. A budget of $10,000 to $25,000 has been made available for the implementation of network performance monitoring. Prime Security s IT manager has created the following proposal, which includes three solutions arranged by cost. Low cost solution If keeping costs down is the number one priority, then a solution consisting of a mix between different products from different vendors is an option. Specifically, the following products could be purchased and implemented: - PRTG Network Monitor license for 1000 machines $2,230 - Solarwinds Netflow Traffic Analyzer $1,795 - Solarwinds Network Configuration Manager $2,695 - Solarwinds IP Address Manager $1,995 - Fluke Linkrunner AT 2000 Network Auto-tester $1,545 This would bring the total cost of the solution to $10,260. The solution would fulfill the requirements of being able to see network traffic statistics, detecting duplicate IP addresses, displaying error and collision statistics, showing overall utilization statistics, and listing IP and IPX devices. The advantage of this solution is that it keeps costs down, staying to the lower end of the budget that was

8 provided. The disadvantages are that it would limit the features and capabilities of the implemented solution, and since we re mixing different software packages from different vendors the solution might not perform optimally. Mid-range cost solution Another possible solution is to use Solarwinds Performance Monitor instead of PRTG. Solarwinds has become an industry standard for network performance monitoring and offers more features than PRTG does. While PRTG does the basics of what is required, Solarwinds goes above and beyond with automatic network mapping, VMWare monitoring, Integrated wireless monitoring, and an automated report writer. Because of the added functionality, Solarwinds is more expensive than PRTG at $15,675 for a license that covers 2000 machines. This solution would then consist of the following parts: - Solarwinds Network Performance Monitor license for 2000 machines $15,675 - Solarwinds Netflow Traffic Analyzer $1,795 - Solarwinds Network Configuration Manager $2,695 - Solarwinds IP Address Manager $1,995 - Fluke Linkrunner AT 2000 Network Auto-tester $1,545 The total cost for this solution would come to $23,705. This could be brought down slightly by opting for a license to the Network Performance Monitoring software that only covers 500 machines at $8,975. However, this would leave little room for future expansion. Advantages of the medium-cost solution are that it offers added functionality over the low-cost solution, and since all the software comes from a single vendor it s made to be integrated and work well together. A disadvantage is that the cost for this solution is on the far end of the budget range that was provided. High cost solution If budget were not a priority, another solution might be preferable over the two mentioned above. - Fluke Networks Visual TruView $25,000

9 - Fluke Networks Optiview XG $24,000 Even with just two products, this solution would come to a total of $49,000. The TruView Network Monitoring Appliance was only released earlier in 2013 and consists of a single rack-mountable device that is able to monitor everything on the network. No multiple software packages are required as with the other solutions; TruView monitors it all. It is also claimed to have 2.5 times the processing power of any other solution. One user interface will allow for monitoring all network devices, performance, and issues. Combining TruView with OptiView, also from Fluke Networks, takes the solution even further. Optiview is a portable network performance monitor that can be used to analyze issues from a centralized location, but it can also be taken to the site where issues are occurring for a more in-depth local inspection. Combining TruView and OptiView would be the optimal solution for network performance monitoring, albeit also the most expensive one. Conclusion Many different network performance monitoring solutions are available, ranging in price from a few hundred dollars to hundreds of thousands of dollars. As with most things, the price reflects what you get. Fluke Networks offers several products and solutions that will completely alleviate any performance monitoring issue that Prime Security has ever experienced, or will experience in the near future. However, their solutions are extremely pricy. On the other end of the spectrum there is Paessler s PRTG performance monitoring software, which is much cheaper than most other products but doesn t offer the same functionality as most. For Prime Security, the best solution will be to choose the middle road. By spending just over $23,000, a well-rounded performance monitoring solution can be implemented from Solarwinds - an industry standard. The solution displays network traffic statistics, detecting duplicate IP addresses, displaying error and collision statistics, showing overall utilization statistics, and listing IP and IPX devices, so everything that is required. The solution stays under the

10 maximum allowed budget of $25,000, and with a license for 2000 machines it also allows for future growth. While Fluke Network s products seem like a fantastic investment for network performance monitoring, right now they are simply too expensive. Solarwinds is the way to go to get the best results for what the budget allows.

11 References Solarwinds.com. (2013). License Calculator. Retrieved from 0America