# Presentation: 220772

## Session 5

**SAFER Networking**

- S1	Welcome and Introduction
- S2	Introduction to Safety Information Exchange
- S3	Operational Concepts
- S4	System Overview
**S5****	****SAFER Networking**
- S6	Microsoft Windows NT
- S7	Standard Procedures
- S8	System Configuration
- S9	Change and Problem Tracking
- S10	SAFER Versions
- S11	Using OpCon
- S12	Laboratory Exercises
- S13	Wrap-up

## Session Plan

- Networking and how SAFER uses it (TCP/IP, modem, LANs, WANs, routers, NICs, etc.)
- TCP/IP - widely used protocol - lots of existing applications and products
- Client/Server
- PPTP
- IPSec

## Session Objectives

- Learn about TCP/IP and Client/Server Computing
- CVOSS Network Diagram
- Learn what networks SAFER is connected to
- VPN Solutions for Clients using the Internet
- Security Issues for SAFER:
- PPTP
- IPSec

## An in-depth look at the TCP/IP protocols and its layered architecture

- IP

**TCP/IP**

- Physical Layer

- Material taken from _Understanding Data Communications From Fundamentals to Networking_ by Gilbert Held

**Notes:**
This slide shows the layers for TCP/IP, the basic communication protocol suite of the Internet.  TCP/IP is also used in many other networks.  The Transmission Control Protocol layer uses a set of rules to exchange messages with other Internet points at the information packet level.  The Internet Protocol layer uses a set of rules to send and receive messages at the Internet address level. 
Most Internet users are familiar with the even higher layer application protocols that use TCP/IP to get to the Internet. These include the World Wide Web's Hypertext Transfer Protocol (HTTP), the File Transfer Protocol (FTP), Telnet (Telnet) which lets you logon to remote computers, and the Simple Mail Transfer Protocol (SMTP). These and other protocols are often packaged together with TCP/IP as a "suite."

## CDPD (Cellular Digital Packet Data)

- CDPD (Cellular Digital Packet Data) is a specification for supporting wireless access to the Internet and other public packet-switched networks.  Cellular telephone and modem providers that offer CDPD support make it possible for mobile users to get access to the Internet at up to 19.2 Kbps.  Because CDPD is an open specification that adheres to the layered structure of the Open Systems Interconnection (OSI) model, it has the ability to be extended in the future.  CDPD supports both the Internet's IP protocol and the ISO Connectionless Network Protocol (CLNP).
- CDPD also supports IP multicast (one-to-many) service.  With multicast, a company can periodically broadcast company updates to sales and service people on the road or a news subscription service can transmit its issues as they are published.  It will also support the next level of IP, IPv6.
- For the mobile user, CDPD's support for packet-switching means that a persistent link isn't needed. The same broadcast channel can be shared among a number of users at the same time. The user's modem recognizes the packets intended for its user. As data such as e-mail arrives, it is forwarded immediately to the user without a circuit connection having to be established.
- There is a circuit-switched version, called CS CDPD, that can be used where traffic is expected to be heavy enough to warrant a dedicated connection.

## Client/Server Computing

- The term *client/server* has multiple meanings and is sometimes used interchangeably with the term distributed processing.

- 2

- One definition of client/server computing involves client computers (capable of processing data and running applications) relying on a server computer for shared data and peripherals.  In these environments, the server machines are generally powerful PCs set aside to perform the task of a server.

**Notes:**
Most client/server implementations are based on LAN technologies.  The ability to connect numerous desktop systems not only with one another but also with other midrange or mainframe systems has brought a new focus to the typical management information systems (MIS) department.  Traditionally, MIS departments had been data centers, organized to produce paper reports for management. The advent of client/server computing has created a user-centered environment in which users demand increased flexibility in their hardware and software components.  The required flexibility, however, has increased the need for connectivity and interoperability, which is usually done over a LAN environment.  Therefore, without the advent of LAN, client/server computing would not have caused such a stir.  LAN operating systems typically include support for fundamental client/server operations such as making connections and managing the protocols.
One of the first areas in client/server computing that saw growth in the 1990s was database management.  Another important aspect of client/server is the user interfaces.  The user interfaces are derived from two aspects: the proliferation of graphical paradigm (GUIs) and portability.
Example: Web browser is a client, and the Web sites are on servers.  
Your class needs a 15 minute break now.

## Client/Server Computing

- The *server* provides logically centralized services to one or more *clients* either in the same physical machine or remotely connected in a LAN or a WAN environment.  C*lient/server* computing encompasses numerous underlying technologies:
- Desktop systems (personal computers and workstations)
- Local area networks
- Wide area networks
- Communications interoperability
- Graphical user interfaces (GUI)
- Database management systems (DBMSs)
- Client/server computing can be contrasted with *stand alone* or *terminal-host* computing.

## CVOSS Network Diagram

- Use the large (E-Sheet) Network Diagram

## Production SAFER and the Internet

- Internet (GTE Internetworking)
- SAFER Web Page Users
- view carrier information
- MCMIS
- upload carrier safety and census information
- Licensing and Insurance System at VOLPE
- upload L&I information for carriers
- Kentucky CVIEW System
- download carrier subscriptions
- download vehicle subscriptions

## Production SAFER and Wireless

- Wireless (Bell Atlantic Cellular Digital Packet Data (CDPD))
- ASPEN Users
- upload Inspection Reports
- query for Inspection Reports
- query for carrier information
- download carrier subscriptions (supports Inspection Selection System (ISS))

## Production SAFER and AAMVAnet Frame Relay

- AAMVAnet (AT&T Global Network Services Frame Relay Network)
- State CVIEWs
- download carrier subscriptions
- download vehicle subscriptions

## Production SAFER and AAMVAnet Common Services

- AAMVAnet (AT&T Global Network Services Common Services Network)
- ASPEN Users
- (future) dial-up connection to the SAFER system (same functions)

## Production SAFER and FTS2000

- FTS2000 (AT&T Frame Relay Network)
- alternate to AAMVAnet (AT&T GNS Frame Relay)
- will replace Internet for L&I and MCMIS connections to the Volpe SAFER system
- currently, state systems cannot use this network option; however, FTS2001 will support state partnerships
- will support communications between SafetyNET2000 systems and MCMIS via the MCMIS/SAFETYNET Gateway

## Production SAFER and the Modem Pool

- Modem Pool (Public Switched Telephone Network (PSTN))
- ASPEN Users
- dial-up connection to the SAFER system to upload Inspection Reports and obtain safety information

## The Internet

- ASPEN/
- Blizzard

- ROC

- CVIEW

- SAFER

- CVIEW

- SAFER

- PPTP

- PPTP

- IPSec*

- 1

- 2

- 3

- *The IPSec feature will be available sometime in 2000.
- Until that is operational, a site may use PPTP as an interim solution.

## Why use PPTP?

- PPTP is a protocol that is primarily designed to support secure communications between clients and servers.
- PPTP is a temporary solution for a server-to-server communications until IPSec has been fully tested and operational.
- PPTP severs all client and server connections to an existing LAN while the PPTP link is active; LAN connections are automatically restored when the PPTP session is terminated.  As a result, all server functions (e.g. database, e-mail, etc.) must be located on a single node, and that node must be the one to establish the PPTP connection.
- The PPTP connection will have to be manually established using dial-up networking, will have to be monitored, and will have to be manually reestablished after the connection is terminated (e.g. if the server is rebooted).

## PPTP Description (1 OF 2)

- Short for Point-to-Point Tunneling Protocol, a technology for creating Virtual Private Networks (VPNs), developed jointly by Microsoft® Corporation, U.S. Robotics, and several remote access vendor companies, known collectively as the PPTP Forum.  A VPN is a private network of computers that uses the public Internet to connect some nodes.  Because the Internet is essentially an open network, the Point-to-Point Tunneling Protocol (PPTP) is used to ensure that messages transmitted from one VPN node to another are secure.  With PPTP, users can dial in to their corporate network via the Internet.  Although PPTP has been submitted to the Internet Engineering Task Force (IETF) for standardization, it is currently available only on networks served by a Windows® NT 4.0 Server and Linux.

## PPTP Description (2 OF 2)

- PPTP (Point-to-Point Tunneling Protocol) is a protocol (set of communication rules) that allows corporations to extend their own corporate network through private "tunnels" over the public Internet. Effectively, a corporation uses a wide-area network as a single large local area network.  A company no longer needs to lease its own lines for wide-area communication but can securely use the public networks.  This kind of interconnection is known as a virtual private network (VPN).  PPTP, a proposed standard sponsored by Microsoft® and other companies, and Layer 2 Forwarding, proposed by Cisco Systems, are among the most likely proposals as the basis for a new IETF standard.  With PPTP, which is an extension of the Internet's Point-to-Point Protocol (PPP), any user of a PC with PPP client support is able to use an independent service provider (ISP) to connect securely to a server elsewhere in the user's company.

## PPTP

- Point-to-Point Tunneling Protocol (PPTP)
- A RAS server is usually connected to a PSTN, ISDN, or X.25 network, allowing remote users to access a server through these networks. RAS now allows remote users access through the Internet by using the Point-to-Point Tunneling Protocol (PPTP).
- PPTP is a networking protocol that supports multiprotocol virtual private networks (VPNs), enabling remote users to access corporate networks securely across the Internet by dialing into an Internet Service Provider (ISP) or by connecting directly to the Internet. PPTP offers the following advantages:
**Lower Transmission** **Costs** PPTP uses the Internet as a connection instead of a long-distance telephone number or 800 service. This can greatly reduce transmission costs.
**Lower Hardware Costs** PPTP enables modems and ISDN cards to be separated from the RAS server. Instead, they can be located at a modem pool or at a communications server (resulting in less hardware for an administrator to purchase and manage).
**Lower Administrative Overhead** With PPTP, network administrators centrally manage and secure their remote access networks at the RAS server. They need to manage only user accounts instead of supporting complex hardware configurations.
**Enhanced Security **Above all, the PPTP connection over the Internet is encrypted and secure, and it works with any protocol (including, IP, IPX, and NetBEUI).

## Why use IPSec?

- IPSec is hardware-based router to router solution for establishing VPN’s between servers.
- It will provide a permanent, secure server-server connection without severing server LAN connections.
- It will be fully supported by SAFER.
- It requires network engineering expertise to set up and maintain.
- It requires the proper hardware (router) and software/licenses to function.

## IPSec Description (1 of 2)

- Short for IP Security, a set of protocols being developed by the IETF to support secure exchange of packets at the IP layer.  IPSec is expected to be deployed widely to implement Virtual Private Networks (VPNs).  IPSec supports two encryption modes: Transport and Tunnel.  Transport mode encrypts only the data portion (payload) of each packet, but leaves the header untouched.  The more secure Tunnel mode encrypts both the header and the payload. On the receiving side, an IPSec-compliant device decrypts each packet.  For IPSec to work, the sending and receiving devices must share a public key.  This is accomplished through a protocol known as Internet Security Association and Key Management Protocol/Oakley (ISAKMP/Oakley), which allows the receiver to obtain a public key and authenticate the sender using digital certificates.

## IPSec Description (2 of 2)

- IPSec (Internet Protocol Security) is a developing standard for security at the network or packet processing layer of network communication.  Earlier security approaches have inserted security at the application layer of the communications model.  IPSec will be especially useful for implementing virtual private networks and for remote user access through dial-up connection to private networks.  A big advantage of IPSec is that security arrangements can be handled without requiring changes to individual user computers.  Cisco has been a leader in proposing IPSec as a standard (or combination of standards and technologies) and has included support for it in its network routers.  IPSec provides two choices of security service: Authentication Header (AH), which essentially allows authentication of the sender of data, and Encapsulating Security Payload (ESP), which supports both authentication of the sender and encryption of data as well.  The specific information associated with each of these services is inserted into the packet in a header that follows the IP packet header.  Separate key protocols can be selected, such as the ISAKMP/Oakley protocol.

## Acronyms (1 of 2)

- CLNP - Connectionless Network Protocol
- DHCP - Dynamic Host Configuration Protocol
- ESP - Encapsulating Security Payload
- FDDI - Fiber Distributed Data Interface
- HTTP - Hypertext Transfer Protocol
- ICMP - Internet Control Message Protocol
- IETF - Internet Engineering Task Force
- IOS - Internetworking Operating System
- IP - Internet Protocol
- IPSec - Internet Protocol Security
- ISAKMP/Oakley - Internet Security Association and Key Management Protocol/Oakley
- ISO - International Standards Organization
- ISP - Internet Service Provider
- ISS - Inspection Selection System

## Acronyms (2 of 2)

- L&I -  Licensing and Insurance
- LAN - Local Area Network
- MCMIS - Motor Carrier Management Information Systems
- NIC - Network Interface Card
- OSI - Open System Interconnection
- POP3 - Post Office Protocol Version 3
- PPTP - Point-to-Point Tunneling Protocol
- PSTN - Public Switched Telephone Network
- RAS - Remote Access Service
- RPC - Remote Procedure Call
- SMTP - Simple Mail Transfer Protocol
- TCP/IP - Transmission Control Protocol/Internet Protocol
- UDP - User Datagram Protocol
- VPN - Virtual Private Network
- WAN - Wide Area Network

## Microsoft® RAS Protocol

- _RAS Capabilities and Functionality_
- RAS allows remote users to work as if they were connected directly to the network.
- Users run the RAS graphical phonebook on a remote computer and then initiate a connection to the RAS server using a local modem, X.25, or ISDN card.
- The RAS server, running on a Windows NT Server computer, authenticates the users and services the sessions until terminated by the user or network administrator.
- All services typically available to a LAN-connected user (including file- and print-sharing, database access and messaging) are enabled by means of the RAS connection.

- The following figure depicts the RAS architecture:

## Communication protocols define rules for information systems to talk to each other

- A communication protocol may be defined as a public, formal specification of rules and guidelines in which two or more components of an information system communicate to accomplish a goal.
- Most protocols are formed in a layered fashion.  All of the following have multiple layers (typically seven).
- IBM’s System Network Architecture (SNA)
- Digital Equipment Corporation’s DECnet
- TCP/IP (Transmission Control Protocol/Internet Protocol)
- International Standards Organization’s (ISO) Open Systems Interconnection (OSI) Reference Model

**Notes:**
Use the details on the next page to supplement the first bullet.
SNA is IBM’s proprietary architecture for designing and implementing interconnected networks.
TCP/IP is more flexible than SNA, since TCP/IP was designed to connect diverse networks of multiple agencies, libraries, universities, defense agencies, and private corporations.
Many businesses use TCP/IP protocols in their networks since OSI standards are slow to be implemented.
The OSI model uses seven hierarchically separate layers to communicate between two end users.
Implementation of standard communications architectures is expected to provide better connectivity, transfer of data, and interoperability of networks.

## Communication Protocols

- There are some characteristics applicable to most communications protocols.
- First, the protocol must encompass the exchange of both data and control information.
- Second, multiple layers of protocols are typically present in any substantial information system environment, particularly those that can be considered enterprise.
- On multiple protocols. . .
- If the protocols used by a remote system are the same as those used by a local system, communication is easy to implement.
- If the protocols differ, translation is needed.
- If the architectural model is different, with different layers and different services (like SNA versus TCP/IP), the translation can be tricky.

## The OSI (Open Systems Interconnection) Model describes a network architecture

- The upper four layers deal with the end-to-end communications and data transfer.

- The bottom three layers are concerned with the node to node connection.

**Notes:**
Background for instructor:
Open Systems Interconnection: Originally released in 1978, the OSI model describes a network architecture that connects dissimilar devices.  The original standard applies to open systems, which are open to each other because they use the same communications protocols or standards.  The OSI is concerned with the interconnection between systems - the way they exchange information - rather than the internal functions of particular systems.

OSI Reference Model: In 1984, a revised version of the OSI model was released, and this has since become an international standard.  Many computer manufacturers have modified their layer network architecture to comply with the layers of the OSI.  This seven-layered model is also referred to as the ISO OSI Reference Model.  The model has seven layers and the principles that were applied to arrive at the seven layers are as follows:
A layer should be created where a different level of abstraction is needed.
Each layer should perform a well-defined function.
The function of each layer should be chosen with an eye toward defining internationally standardized protocols.
The layer boundaries should be chosen to minimize the information flow across the interfaces.
The number of layers should be large enough that distinct functions need not be thrown together in the same layer out of necessity and small enough that the architecture does not become unwieldy.

## Open Systems Interconnection

- The application layer (layer 7): This is the layer at which a user and a computer interface to a network to view a message or data request or response. This is the direct interface for the application to request a service.  This layer provides communications services to the end user.
- The presentation layer (layer 6): This is a layer, usually part of an operating system, that converts incoming and outgoing data from one presentation format to another (for example, from a text stream into a popup window with the newly arrived text). This is where format, code conversions, data representation, compression, and encryption are handled for the application.
- The session layer (layer 5): This layer manages the establishment of a continuing series of requests and responses between the applications at each end.  The control of the direction of data transfer is handled here.
- The transport layer (layer 4): This layer manages the end-to-end control (for example, determining whether all packets have arrived) and error- checking.   This layer also controls the connection for error recovery and flow control.  It is responsible to assure error-free data delivery end-to-end in a cost-efficient manner.

- The network layer (layer 3): This layer handles the routing of the data (sending it in the right direction to the right destination on outgoing transmissions and receiving incoming transmissions at the packet level). This layer is responsible for the switching and routing of the connection and is also responsible to take the data that is to be shipped from node to node, not end user to end user, and break it into smaller pieces to accommodate the transmission system.
- The link (or data-link) layer (layer 2): This layer provides error control and synchronization for the physical level and does bit-stuffing for strings of 1's in excess of 5.   It is responsible for the delivery of the information to the network medium.
- The physical layer (layer 1): This layer conveys the bit stream through the network at the electrical and mechanical level.
- Material taken from http://www.rad.com/networks/1994/osi/osi.htm and from http://www.whatis.com/osi.htm

## Transmission Control Protocol/Internet Protocol  (TCP/IP)

- Like OSI, TCP/IP protocols are also grouped into layers.  As we can see, the OSI and TCP/IP architectural models share the same structural elements (see previous slide).  Layers 1-4 are more or less equivalent for both OSI and TCP/IP.  However, the differences between OSI and TCP/IP architectures relate primarily to the philosophy in the layers above the transport level.  The OSI model has two additional layers, the session layer and the presentation layer.  In TCP/IP, the functions of these two layers are viewed as part of the application layer.
- The top layer, the applications layer, provides application services to users and programs.  The transport layer handles data consistency functions.  The transport layer is supported by two protocols, TCP and UDP.  The TCP provides a reliable delivery, whereas the UDP does not ensure delivery.  Most TCP/IP applications like Telnet and FTP use TCP, while others like voice and video use UDP, since fast delivery is more important than reliability.
- The internet layer is the key layer.  It has one protocol: IP.  IP provides many of the same functions as the network layer, such as addressing and routing.  IP provides a common address space across multiple lower-layer network protocols.
- The network layer contains whatever internetworking protocol will run over it, such as Ethernet, Token Ring, FDDI, and so on.  A network layer routes packets across a network.  The physical layer, the link, and the network layers in TCP/IP are combined to form a subnet layer.
- The requirement for universal connectivity is supported by the Internet Protocol (the network layer).  Another protocol, Internet Control Message Protocol (ICMP), a component of every IP implementation, transports error and diagnostic information for IP.  In addition to the Transmission Control Protocol (TCP) at the transport level, the User Datagram Protocol (UDP) is also utilized by a host of networking solutions.
- 	Material taken from: _Heterogeneous Internetworking, Networking Technically Diverse Operating Systems_ by Harry Singh and from http://www.whatis.com/osi.htm

**Notes:**
taken from Heterogeneous Internetworking on page 152
TCP - Transmission Control Protocol
IP - Internet Protocol
OSI - Open System Interconnection
DHCP - Dynamic Host Configuration Protocol
HTTP - Hypertext Transfer Protocol
FTP - File Transfer Protocol
SMTP - Simple Mail Transfer Protocol
DNS - Domain Name System
SNMP - Simple Network Management Protocol
UDP - User Datagram Protocol
LAN - Local Area Network
WAN - Wide Area Network
FDDI - Fiber Distributed Data Interface
ATM - Asynchronous Transfer Mode
ISDN - Integrated Services Digital Network
SMDS - Switched Multimegabit Data Service

## Who are the experts on each layer?

- Data Link

- Physical

- Session

**OSI Reference Model**

- Network

- Transport

- Presentation

- Application

- 2

- 1

- 5

- 3

- 4

- 6

- 7

- User Software Products

- Software Developers (e.g., C++ programmers who develop the “Forms” software from Module 4)

- System Administrators (e.g.,operating system experts)

- System Programmers (e.g., e-mail or file transfer experts)

- Network Engineers (e.g., LAN or WAN experts)

- Technicians (e.g., the folks who run cables and make the connections)

**Notes:**
Point out who is responsible for each layer of the network architecture model.

Emphasize that what we typically think of as “software” falls above the network architecture layers.

Now we’re going to shift gears to LANs and WANs - different kinds of networks.  Collect ideas from the class on what the differences are (the next slide shows the differences, so have them think before flipping to that page!)
Before class starts, make flip charts to collect the class’ ideas about LANs and WANs.  

Record their ideas on the charts.

## The major differences betweena LAN and a WAN

**Notes:**
Highlight the key differences between LANs and WANs.  As much as possible, use the students’ ideas from the flip charts.

## LAN and WAN

- LAN: high-bandwidth networks designed for geographically local areas, such as a building or a campus.  A typical LAN can support hundreds of users from distances of 100 meters to over a kilometer and at speeds in excess of 10 Mbps.
- WAN: enterprise networks consist of LANs of various protocols, supporting myriad media and architectures, connected to wide area networks consisting of a variety of communication systems.  These complex networks span cities, countries, and continents and are being influenced by emerging technologies driven by user demands and vendor innovations.

## This Page Intentionally Blank