Differences between revisions 59 and 64 (spanning 5 versions)
Revision 59 as of 2015-02-26 14:47:13
Size: 6894
Editor: anyconnect
Comment: ipv6 over pptp is dead, long live ipv6 over ipsec [DAA]
Revision 64 as of 2018-05-20 22:14:11
Size: 7261
Editor: frekk
Comment:
Deletions are marked like this. Additions are marked like this.
Line 9: Line 9:
In the Guild machine room is a Cisco 3508XL called `sesame`. This connects to the CAT5/CAT6 above and to single mode fibre, which runs into an ITS managed distribution switch located in the Science library and is imaginatively titled [[http://netmap.ucs.uwa.edu.au/netmap/index.cgi?devip=10.10.3.7|science-dr-01]]. In the Guild machine room is a --(Cisco 3508XL called `sesame`)-- Cisco 4507 called `lard` but in DNS as `sesame`. This connects to the CAT5/CAT6 above and to single mode fibre, which runs into an ITS managed distribution switch located in the Science library and is imaginatively titled [[http://netmap.ucs.uwa.edu.au/netmap/index.cgi?devip=10.10.3.7|science-dr-01]].
Line 12: Line 12:
The machine room contains two switches and a router: The machine room contains four switches and a router:
Line 15: Line 15:
 * Curviceps, an HP ProCurve 1800-24G which has 24 GigE ports and 2 SFP slots.  * [[Curviceps]], an HP ProCurve 1800-24G which has 24 GigE ports and 2 SFP slots.
 * [[Walnut]], a Ubiquiti EdgeSwitch 16-XG which has 12 SFP+ slots and 4 GigE ports.
Line 29: Line 30:
 * VLAN 8: Untrusted wireless network.  * --(VLAN 8: Untrusted wireless network.)-- (deprecated)
Line 47: Line 48:
  * 172.26.42.224/27 is unused.   * 172.26.42.224/27 is for OpenVPN clients (wheel only or only by request from wheel).
Line 79: Line 80:
 * 2405:3C00:5200:106::/64 public wireless (VLAN 8)  * --(2405:3C00:5200:106::/64 public wireless (VLAN 8))--
Line 86: Line 87:
HTTP goes through mussel or mooneye. HTTPS is served by mussel on secure.ucc.asn.au, however IMAPS, POPS and SMTPS are NATted by [[Murasoi]] to go to [[Motsugo]], since we're cheap and only have one SSL certificate. HTTP goes through mussel or mooneye. HTTPS is served by mussel on secure.ucc.asn.au, however IMAPS, POPS and SMTPS are NATted by [[Murasoi]] to go to [[Motsugo]], for the historical reason that UCC could only afford one SSL certificate. Nowadays, UCC uses LetsEncrypt for everything (including secure.ucc.asn.au) and this is no longer necessary.
Line 88: Line 89:
There is a PPTP server running on [[Murasoi]], though SSH tends to be the most reliable protocol for tunneling about UWA. There are a number of VPN servers running on [[Murasoi]], though SSH tends to be the most reliable protocol for tunneling about UWA.

Understanding UCC's network can be a bit challenging at first, but after some reading you'll find that it is actually very challenging, and give up. This article is a general overview of how it works.

Layer One

There is a CAT6 cable running straight up out of the Guild machine room, along the rafters and back down into the UCC machine room, terminated on a block on the North machine room wall.

In addition, there is a long piece of CAT5 (that was previously the primary uplink!) running through the walls from the machine room to the Guild machine room in Cameron Hall (across from UWAnime). If you're looking for where the cable runs, it's possibly disguised as a network outlet cable in one of the other student clubrooms.

In the Guild machine room is a Cisco 3508XL called sesame Cisco 4507 called lard but in DNS as sesame. This connects to the CAT5/CAT6 above and to single mode fibre, which runs into an ITS managed distribution switch located in the Science library and is imaginatively titled science-dr-01.

Machine Room

The machine room contains four switches and a router:

  • Murasoi, a linux-based router running iptables.

  • Bitumen, a Cisco Catalyst 4507R running IOS which has 2 SupIV supervisor engines, 96 GigE ports and 12 GBIC slots.

  • Curviceps, an HP ProCurve 1800-24G which has 24 GigE ports and 2 SFP slots.

  • Walnut, a Ubiquiti EdgeSwitch 16-XG which has 12 SFP+ slots and 4 GigE ports.

These are all labeled and in the rack. There is also a patch panel for the clubroom wall-ports at the bottom of the right-most rack beneath Bitumen.

Clubroom

There is CAT5 cabling run from a patch panel at the bottom of the rack to a number of wall ports throughout the room. Where not enough wall-ports are available, there are small 5-port unmanaged switches used to attach more devices to the network.

Layer Two

See also: Network/SwitchConfiguration

Internal VLANs

UCC uses seven VLANs internally for various purposes:

  • VLAN 1: Network and server management.
  • VLAN 2: Machine room network.
  • VLAN 3: Clubroom network.
  • VLAN 4: Member VM network
  • VLAN 5: Loft network (used for LANs).
  • VLAN 6: Authenticated wireless network.
  • VLAN 8: Untrusted wireless network. (deprecated)

External VLANs

ITS trunks to us the following VLAN:

  • VLAN 13: Our main uplink, provides us our internet connection and address space.

Layer Three

Layer three at UCC is reasonably straightforward these days. A brief summary:

Subnets

There are a number of IP ranges used at UCC for various things:

  • 130.95.13.0/24 is the public address space for our AARNet connection. This range is routed to us via VLAN 13.
    • 130.95.13.0/26 is the machine room address range, internally routed on VLAN 2.
    • 130.95.13.64/26 is the clubroom address range, internally routed on VLAN 3.
    • 130.95.13.128/26 is the member VM address range, internally routed on VLAN 4.
  • 172.26.42.0/24 is for 'untrusted client machines' and is allocated to us by UWA and routed to us via VLAN 13. There is some history here, but these addresses are not routed outside the Uni. This subnet may be NATted to public IPs for external access.
    • 172.26.42.0/26 is for public wireless (unauthenticated clients).
    • 172.26.42.64/26 is the loft network range (unauthenticated).
    • 172.26.42.128/27 is for PPTP VPN clients (authenticated and accounted).
    • 172.26.42.160/27 is for IPsec VPN clients (authenticated and accounted).
    • 172.26.42.192/27 is the UCC wireless network range (authenticated and accounted).
    • 172.26.42.224/27 is for OpenVPN clients (wheel only or only by request from wheel).
  • 192.168.13.x/25 is the uplink range, routed on VLAN 13 by UWA. Machines colocated in Arts have addresses in the top half of this /24 (i.e. 192.168.13.128/25).
  • 192.168.2.x is the management VLAN IP range. This is not allocated to us by UWA and not routed outside UCC.

Addressing scheme

Most of UCC's subnets use DHCP to assign addresses based on MAC address. Further details can be found at Network/Services#DHCP.

Routing and Firewall

Murasoi, the Linux router, is a beast of burden. See Network/Firewall for further information on the way it operates.

IPv6

http://ipv6.he.net/certification/scoresheet.php?pass_name=accmurphy

UCC has 2405:3C00:5200:100::/58 (which is :100:: to :13f:: inclusive).

(This is unusually small. RFC-6177 recommends that small end sites - such as a home user with devices in the "dozens or less" - should be allocated a /56 range.)

This is advertised by radvd on Murasoi which most machines autoconfigure from, however some machines have statically assigned addresses. There is an IPv6 firewall that matches our IPv4 firewall very closely. IPv6 traffic is free.

Many machine room systems have IPv6 address, which are statically assigned. These are available in DNS using the ipv6.ucc zone (e.g. martello.ipv6.ucc.asn.au), and usually in the main DNS entry. There is no reverse DNS delegation at this stage, so reverse DNS is UCC-only.

Mooneye's DNS record doesn't have an AAAA record, because we are scared of this breaking Things(tm).

IPv6 is routed to 2405:3C00:10:4::1 from Murasoi.

Mail will be received over IPv6 if it is sent to [email protected] (or ipv6.ucc.gu.uwa.edu.au).

Subnets:

  • 2405:3C00:10:4::2/64 uplink (equivalent to 192.168.13.2, UWA VLAN 13)
  • 2405:3C00:5200:100::/64 machine room (VLAN 2)
  • 2405:3C00:5200:101::/64 clubroom (VLAN 3)
  • 2405:3C00:5200:102::/64 member VMs (VLAN 4)
  • 2405:3C00:5200:103::/64 loft (VLAN 5)
  • 2405:3C00:5200:104::/64 wireless (VLAN 6)
  • 2405:3C00:5200:106::/64 public wireless (VLAN 8)

  • 2405:3C00:5200:120::/123 IPsec VPN (only 30 addresses to match the IPv4 pool)

Multicast

UWA runs multicast in sparse PIM mode, and Murasoi runs pimd as noted here. Make sure pimd is only listening once per interface, otherwise things won't work quite right. Multicast traffic is also free.

Higher Layers

HTTP goes through mussel or mooneye. HTTPS is served by mussel on secure.ucc.asn.au, however IMAPS, POPS and SMTPS are NATted by Murasoi to go to Motsugo, for the historical reason that UCC could only afford one SSL certificate. Nowadays, UCC uses LetsEncrypt for everything (including secure.ucc.asn.au) and this is no longer necessary.

There are a number of VPN servers running on Murasoi, though SSH tends to be the most reliable protocol for tunneling about UWA.

Configuration

Information on configuring the core switches can be found at Network/SwitchConfiguration. Information on configuring routing and firewalling can be found at Network/Firewall.

Monitoring

There are various monitoring packages installed, links to which can be found on MissionControl.


CategorySystemAdministration