Consider a routing environment within a large, public sector security-conscious
ID: 3891727 • Letter: C
Question
Consider a routing environment within a large, public sector security-conscious organisation; all traffic leaving its AS is encrypted using a variety of techniques including SSL, encrypted ZIP files and VPN end-points. There are two ISPs providing connectivity across the Internet and no private network links are used.
• List and describe any architectural weaknesses that could cause a loss of confidentiality; describe the layer in which the weakness occurs and suitable mitigations to reduce or eliminate the weaknesses
• If encrypted traffic is dropped by one ISP, list and describe the steps required to have the second ISP carry the traffic without packet loss. Assume that there are no pre-existing peering agreements relating to the carriage of encrypted traffic with the second ISP
Explanation / Answer
Solution
(1)
The architectural weakness is optimization of the IP network network performance.The goals of both inter AS and intra AS communications are different . When they interact(ie when source and destination addresses are not within the same AS) a good solution for intra AS traffic engineering may be a sub - optimum solution for inter AS traffic engineering and vice versa. The weakness is the non availability of the best egress point for inter AS network and best routing scheme for intra AS network to optimize overall network performance and accomodate additional network demand. The weakness affects appliation layer .The weakness can be eliminated by sequential, nested and integrated optiization techniques.
(2)
There can be multiple arrangements.First of all one ISP can be configured for VOIP and the second ISP for connected devices( computers, laptops, PDAs) . If the first line is down then the system will automatically switch to the second ISP connection without disrupting phone services. In another arrangement the second ISP connection has to be configured as secondary or back up connection and the calls will be routed vide the second ISP line if the primary connection is persistently down for a long period.In order to enable this both the ISPs have to be connected to a single router and the router should be confiured to switch ISPs automatically.Dual ISP with interopeability will help in VOIP resilience.
Feel free to reach out regarding any queries . And please do rate the answer . Thank you .