ISC Redefinition - IAM Update PennNetwork.pdf · • Policy and Planning. ... • Group...

IT Orientation – ISC Technology Services

IT Orientation

Networking & Telecommunications

ISC Technology Services

September 2017

IT Orientation – ISC Technology Services 2

Agenda

• PennNet Definition

• Wired PennNet

• AirPennNet and Other Wireless Networks

• University Firewall

• PennNet DNS Services

• Penn WebLogin and other Network Authentication and

Authorization

• PennNet Phone

• Penn Video Services

• Other IT Services

• Policy and Planning


PennNet Definition

and Wired PennNet


• Interconnects 50,000+ devices in more

than 230 Penn buildings

• Provides 4 distinct connections to two

national ISPs, and 1 connection to

Internet2

• Provides core services such as DNS,

DHCP, Time Sync, & Authentication.

PennNet: The University’s Network


wallplate


PennNet Building Network

Switch stack



Building Entrance Router



Building Entrance Router

Building


PennNet Backbone

Building

Building Building

Building

Core Router


PennNet Backbone

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy


PennNet Backbone,

With Building Connections

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy


PennNet Backbone,

Redundant Building Connections

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy


PennNet – Data Centers

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy


PennNet – Internet

Internet

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy


PennNet – R&E NetworksInternet2

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy

Internet


AirPennNet and other

Wireless Networks at Penn


Wireless Architecture

HNT-BRDR

Huntsman

NicholsVAG-BRDR

Vagelos

MODVLevy

Building A Building B

Master Controller

Local Controllers

Local Controllers

Local ControllersLocal Controllers

Local Controllers

PrimaryRADIUS

SecondaryRADIUS


AirPennNet

• Primary SSID for UPenn

• Supports 802.11a/g/n/ac– 2.4GHz and 5.8GHz

– Working on larger scale AC deployment

• Speeds up to 300Mbps

• Authenticated with PennKey– 802.1x

– EAP-TTLS/PAP

– EAP-TLS


AirPennNet-Guest

• Exclusively for guests to campus– Non-PennKey holders

• Rate-limited and port-restricted

• Registrations last until midnight

• On-boarding:– Agree to terms

– Supply valid email

UpgradedApril 2017


AirPennNet-Device

• For IoT devices– Monitoring– Entertainment– Managed loaner pools– Non-802.1x-capable

• Self-serve MAC-address registration– https://penndevice.aws.cloud.upenn.edu/

• Personal registration– Five devices per PennKey-holder

• Group registration– Unlimited devices, custom configuration

Upgraded/expandedAugust 2017


AirPennNet-Help

• Configuration of Devices for AirPennNet– XpressConnect

• Captive Portal to instruct users

• Supports a wide range of devices


eduroam

• Federated Wireless Access at Participating Institutions

• Uses PennKey to authenticate– <PennName>@upenn.edu

• Configure device before leaving campus– http://eduroam.upenn.edu


Wireless Network StatisticsSeptember 2017

• Access Points: 4,600

• Wireless Devices– AirPennNet: 67,000

– AirPennNet-Guest: 93,000

– AirPennNet-Device: 1,100

– eduroam: 9,400


University Firewall


University Firewall Project

• In 2014, the Institutitutional Risk Management Committee

(IRC) selected Information Security as its inaugural topic.


University Firewall Project

• In 2016, ISC Technology Services deployed a large-scale

firewall at the PennNet border.


University Firewall

• I’m Just A Firewall Policy


University Firewall

• I’m Just A Firewall Policy

Phase Create/revise Design Validate Block

Group(s) Governance Board

Network Engineering Network Engineering and Information Security

The NOC and IP Engineering

Activities Accept input from constituents and advisors.Define firewall policy.

Interpret policy and design implementation. Test in a lab environment

Process live PennNettraffic in alert-only mode. Review and analyze alert logs. Consult with affected areas

Respond to trouble reports. Conduct diagnostics and resolve service impacts.


University Firewall “Known Bad”

• Malicious hosts: using Palo Alto intel categories– Malware

– Phishing

• REN-ISAC Feeds: of malicious domain names,

URLs, and IPs

• Vulnerability exploits: based on specific CVEs

• Malware (“anti-spyware”): with signatures marked

“critical,” “high,” or “medium”

• Malicious netblocks:– Spamhaus DROP, EDROP, and BGPCC feeds


Blocked by border router ACLs

– Inbound and outbound SNMP (UDP/161)

– Inbound CHARGEN (UDP/19)

– Inbound Windows file sharing (TCP&UDP/135,

137, 138, 139, 445)

• These apply to nearly all traffic, regardless of

firewall bypass


PennNet IP Address Space

• 262,652 publicly routable IPv4– Quickly approaching exhaustion

• 79,228,162,514,264,337,593,543,950,336 IPv6

• RFC 1918 private address– routed through the PennNet core

– often deployed locally behind a departmental NAT

• All addresses in use on PennNet must be registered


PennNet IP Address Space

• Public IPv4– 128.91.0.0/16

– 130.91.0.0/16

– 158.130.0.0/16

– 165.123.0.0/16

– 192.84.2.0/24

– 192.5.44.0/24

• Private IPv4 (RFC 1918)– 10.0.0.0/8

– 172.16.0.0/12

– 192.168.0.0/16

• Public IPv6– 2607:f470::/32


IPv6 adoption at Penn


PennNet DNS Services


DNS Service Layers

• Assignments Service– Purpose: name/address management

– Users: ISC and local IT staff

– DNS “hidden master”

• DNS Authoritative Servers– Purpose: Publish Penn’s zones to the world

– Users: Downstream, off-campus resolvers

• DNS Resolvers (recursive servers)– Purpose: Resolve names for local end-points

– Users: All nodes on PennNet


Standard DNS Resolver Service


SafeDNS Resolver Service


DNS Resolvers — Network Design


Penn WebLogin and other

Network Authentication and

Authorization


Some Definitions

• AuthN: Authentication– The process of proving that I am ‘obrienjw’

• AuthZ: Authorization– Granting the user ‘obrienjw’ some privilege

• I may be able to Authenticate as ‘obrienjw’, but I am

not Authorized to give you a raise in the payroll

system.


Some Systems of Interest

CoSign to retireOctober 2018


Who are you again? (AuthN)

• The piece of this that you will likely see the most is

the PennKey– Made up of a PennName (“obrienjw”) and a password

(“<redacted>”)

• PennNames are mutable, but you also have an

immutable identifier: your PennID number– These are not private information like SSNs

– Mine is 20810858


What can you do? (AuthZ)

• Penn Community holds information about your role

at Penn

• PennGroups contains groupings of PennNames

which are, in some sense, similar– Faculty/Staff/Student

– System Administrators For CETS

– Residents Of Suite 337

• Applications decide how to apply authorization rules

based on this information about you


How Do You Do It?

• Authentication is performed by our central servers– Generally speaking, your PennKey password should only

be handled by web pages on *.pennkey.upenn.edu


How Do You Do It?

• Some other ways in which your PennKey is used:– AirPennNet

– Library services

– Canvas, Box, …

• Use Penn Two-Step Verification!– 2-factor technology reduces the risk of someone stealing

your identity and attacking Penn

– Uses DUO mobile

– https://www.isc.upenn.edu/two-step-verification


Two-Step Verification


KITE

• KITE – Kerberos Intermediary Trust Environment

• KITE is a Windows Active Directory which is

managed by ISC, populated with Penn

faculty/staff/student account lists

– http://www.upenn.edu/computing/kite

http://www.upenn.edu/computing/kite


PennNet Phone


What is PennNet Phone?

• Penn’s primary phone system– Polycom telephone sets

• Polycom VVX 401

• Polycom VVX 201

• Polycom 6000

• Polycom 650 (plus optional sidecars)

• Polycom 321 (End of Sale)

• Polycom 550 (End of Sale)


How do I use PennNet Phone?

• It’s a phone.

• It has a web interface.– http://pps.voice.isc.upenn.edu

• Google can help you.– site:upenn.edu pennnet phone

– https://www.isc.upenn.edu/pennnet-phone

http://pps.voice.isc.upenn.edu


Some PennNet Phone features

• Bridged Line Appearances

• Call Forwarding– Advance One– Call Forward Ring No Answer– Call Forward Busy

• Ring Groups

• Scheduled call forwarding

• Voicemail

• … and more


pps.voice.upenn.edu


PennNet Phone (UC interviews)


Penn Video


• Professional, high-definition broadcast- video production

• Live streaming videos for many education, research and

special events at Penn

• Campus Television service, now

including Xfinity on Campus

• Active in several AV/Video forums on campus such as AV-

SIG

Penn Video Network


• Penn is a major player in Massive Open Online Courses (MOOCs)

• Penn Video Network (PVN) supports Penn’s participation in

Coursera, and provides production services to the Office for Online

Learning for these courses, frequently collaborating with local

school resources

• https://www.coursera.org/penn

• PVN co-chairs Penn’s Technical Advisory Committee for Online

Learning

PVN and Coursera

https://www.coursera.org/penn


Penn Broadcast Studio


Other IT Services


ISC Service Catalog

• Web hosting

• Email and calendaring (PennO365)

• Forward-only email

• Mailing lists

• File storage and sharing (Penn+Box)

• … and more

https://www.isc.upenn.edu/services


Policy and Planning


• IT Planning Task Force– Financial focus

• Network Policy Committee http://www.upenn.edu/computing/group/npc/

– Some approved policies:• Use of PennNet IP Address Space

• Use of @upenn.edu domain name

• Social Security Number policy

• Operation of DHCP Servers

• Operation and Registration for Wireless Access Points

• Authenticated Access to PennNet

• PennNet Computer Security

Policy and Planning

http://www.upenn.edu/computing/group/npc/


Acknowledgements

Thanks to the following ISC Staff members for assembling

and delivering this ITO content:

– Jeff Ballentine

– JoDe Beitler

– John Breen

– Chris Cook

– Jeff Edwards

– Mayumi Hirtzel

– John O’Brien

– Charles Rumford

– Mark Wehrle


Backup slides


Network Infrastructure Locations

71

38th

Str

eet

37

thS

tre

et

36

thS

tre

et

34

thS

tre

et

33

rdS

tre

et

32n

dS

tree

t

39th

Stre

et

40th

Stre

et 3

0th

Str

eet

Walnut Street

Sansom Street

Chestnut Street

Locust Street

41st

Stre

et

42n

dS

treet

Spruce Street

Pine Street

Baltimore Avenue

Woodla

nd

Avenue

Chester Avenue

Osage Avenue

St.

Ma

rks

Sq

uare

Un

ivers

ityA

ven

ue

Civic

Center Boule

vard

Guard

ian

Drive

CurieBoule

vard

Osler

Circle

South Street

I -76

Sch

uylk

illExp

ress

way

Convention

Avenue

Smith Walk

Blanche P. Levy Park

HamiltonVillage

SteinhardtPlaza

East S

erviceDrive

Sch

uyl

kill

Ave

nue

Delancey

Ludlow Street

Market Street

Lehman Brothers QuadMack Plaza

31

st

Str

ee

t

Sc

hu

ylk

illE

xp

res

sw

ay

Hamilton Walk

Locust Walk

St.

Ma

rks

Sq

ua

re

Ste

ve

Mu

rra

y's

Way

43

rdS

tre

et

Powelton Avenue

Perelman QuadWynn Commons

Jones Way

River Fields Drive

HealthScie

ncesDriv

e

East S

erviceDrive

West S

erviceDrive

I-76

Schuylk

illE

xpre

ssw

ay

34th

Str

eet

Grays Ferry Avenue

Walnut Street

Chestnut Street

Market Street

JFK Boulevard

Filbert Street

Lower Walnut Street

Pennovation Center

227

197

I

J

K

L

M

N

O

P

Q

R

S

T

I

J

K

L

M

N

O

P

Q

R

S

T

42 41 40 39 38 37 36 34 33 32 31 30 29

42 41 40 39 38 37 36 34 33 32 31 30 29

University of Pennsylvania

FS

FFS

FFF

F

FF

FF F

F

F

F F

235 S. 39th

F F SF

FFF

F

S

4258

3910

ChestnutHall

InternationalHouse

RalstonHouse

SheratonUniversity

City

3335 ChestnutGarage

Chestnut 34

4015Walnut The Radian

39

33

FranklinBuilding

FranklinAnnex

Module 6Retail

119 S. 38thGarage 30

SansomPlaceWest

NicholsHouse

ICA

NewmanCenter

GreenfieldCenter

Bookstore

SilvermanHall

TanenbaumHall

KingsCourt

EnglishCollegeHouse

3401Walnut

Gittis Hall

Van PeltLibrary

DietrichGraduateLibrary

MeyersonHall

JaffeHistoryof Art

FisherBennett

HallAnnenberg

Center

AnnenbergSchool

TheARCH Sweeten

AlumniHouse

FisherFine ArtsLibrary

College Hall

Houston Hall

IrvineAuditorium

CohenHall

Williams Hall

Steinberg HallDietrich Hall

McNeilBuilding

WistarInstitute

CasterBuilding

Grad Schoolof Education

HillCollegeHouse

L.R.S.M

Towne Building

MooreSchool

GradResearch

Wing

SkirkanichHall

Hayden Hall

DunningCoaches’

Ctr

WeightmanHall

FranklinField

Chemistry1973Wing Cret

Wing

1958Wing

DavidRittenhouse

Labs

Palestra

HutchinsonGymnasium

RingeSquash Crt

HechtTennisCenter

Class of 1923Ice Rink

Hospitalof the

University of PennsylvaniaHealth System

Museum ofArchaeology and

Anthropology

UniversityMuseum

AcademicWing

StemmlerHall

JohnsonBuilding

RhoadsPavilion

ClinicalResearchBuilding

Claire M.Fagin Hall

HollenbackAnnex

HollenbackCenter

Stellar-Chance

Laboratories

BlockleyHall

AnatomyChemistry

John MorganBuilding

StitelerHall

SolomonLabs

Psychology

Vance Hall

The Quadrangle

GoddardLabs

RichardsBuilding

KaskeyPark

AnnenbergPPC

StoufferCollegeHouse

RosenthalBuilding

School ofVeterinaryMedicineOld Quad

Matthew J. RyanVeterinaryHospital

of the UofP

LeidyLabs

MayerResidence Hall

HarrisonCollegeHouse

HarnwellCollegeHouse

RodinCollegeHouse

Du Bois College House

Van PeltCollege House

Class of 1925House

StewartField

University City Science Center

PhiladelphiaCenter For

Health Care Sciences

30th Street Station

Sch

uyl

kill

Riv

erChildren's Hospitalof Philadelphia

Perelman Center ForAdvanced Medicine

Children'sSeashore

House

Wood PediatricAmbulatory Care

Center

CurieGarage

TheConsortium

4200 Pine

SurreyHall

301

Parent InfantCenter

SpruceHall

SpruceWoodApts

BerkshireApts

EvansBuilding

LevyOral Health

Shopsat 40thStreet

4126-38Walnut

41

00

41

02

41

04

41

06

41

08

PhiladelphiaFreeLibrary 3808-10

3905

SteinbergConference

Center

Class of1920

Commons

President'sHouse

Fox-FelsHall

Lauder-Fischer

ColonialPennCtr

14

24

28

30

32

34

36

DuhringWing

4219

CarolynLynchLabs

BRB 2

AbramsonPediatricResearch

3025Walnut( WXPN )

3201WalnutGarage

Walnut 32

HillSquare

3815

KellyWritersHouse

UniversityMuseumGarage

MorganBldg

LernerCtr

Cyclotron

4111-25Chestnut

250 S36th

S

Jon M.Huntsman

Hall

St. Leonard'sComplex

HUPOffices

S

206

212

3401 Grays Ferry Avenue

4059

4032

4212

3918

3920

RhodesField

VagelosField

LocustHouse

ShoemakerGreen

ChildGuidanceCenter

PresbyterianMedical Center

of theUniversity ofPennsylvaniaHealth System

Penn Park

IRS

The Left Bank

Domus

Facilities and Real Estate Services : Office of the University Architect

300 450 600150Feet

50 100 150 200Meters

North

125 S. 31st Street( Translational Research )

MedicalExaminersBuilding

VANursingHome

VeteransAdministrationMedical Center

3750

3600

3550 3508 3500 3440

3535 3501 34013665

36243700

St Mary'sChurch

Rotunda

UniversityCityStation

4026-40Chestnut

VagelosLabsIAST

NewRalstonHouse

ScheieEye

Institute

HeartInstitute

3810

MedicalScience

ResearchLab

AndrewMutch Bldg

Wright/SaundersBuilding

Mabel Pew

Myrin

Pavilion

Cupp

Pavilion

Medical

Office Bldg

Parking

Garage

Medical

Arts

Bldg

CivicHouse

3907

Inn at Penn

Golkin HallChristianAssoc.

Cinema

SchattnerCenter

FreshGrocer

Module 7

3216Chancellor

AddamsHall

LevineHall

UofP / CHOPMedical

Parking Garage 51

3101Walnut

361536093611

US Post Office

Cira CenterSouth

Garage

PottruckCenter

3701

3615

Sadie Tanner Mossell AlexanderUniversity of Pennsylvania

Partnership School

SpruceHouse

Hillel atSteinhardt

Hall

Webster Manor

Hill Pavilion

AFSCME

McNeilEarly

American

HorizonHouse

F

F

MeiklejohnStadium

TheHub

RobertsProton

3711

SmilowCenter for

TranslationalResearch

ColketResearch

Center

PaleyBridge

WeaveBridge

HighlineField

3809

F

F

GarageSpruce 38

GarageWalnut 40

3100

272

192

179

212

SinghNanotechnology

Axis

Dunning-CohenChampions

Field

Ace AdamsField

HamlinTennis Center

Multi-PurposeStadium

South Green

Revised: 02/24/16Pennovation Works

3619

© Trustees of the University of Pennsylvania

PennTransplant

House

UPHSMedical Parking Garage

35

37

4124 Ludlow

KanePark

BuergerCenter ForAdvancedPediatric

Care

AdvancedCare

Pavilion

3737

EvoCira Center

South

3808

Jordan MedicalEducation Center

Hub3939

3901Walnut

MondscheinField

4039Chestnut

4109

4101

Levin Building

NewCollegeHouse

New PatientPavilion

FMC TowerPerelmanCenter forPolitical

Science andEconomics

PerryWorldHouse

RobbinsHouse

Network Aggregation Point

Data center

External connectivity

Levy

South Bank

3401 WalnutNichols

MODV

Huntsman

Vagelos


External Connectivity Locations


PennNet external peerings

73

Firewall

ISC Redefinition - IAM Update PennNetwork.pdf · • Policy and Planning. ... • Group...

Documents

Transcript of ISC Redefinition - IAM Update PennNetwork.pdf · • Policy and Planning. ... • Group...