Networking

Remote access is the ability to access a network, a personal computer, a server, or other device from a distance for the purpose of controlling it or to access data. Today, remote access is usually accomplished over the Internet, although a local IP network, telephone lines, cellular service, or leased lines may also be used. With today’s ubiquitous Internet availability, remote access is increasingly popular and often results in significant cost savings by enabling greater network access and reducing travel to remote sites. Remote access is a very general term that covers a wide range of applications from telecommuting to resetting a distant server. Here are just a few of the applications that fall under the remote access umbrella:

Remote network access
A common use for remote access is to provide corporate network access to employees who work at home or are in sales or other traveling positions. This kind of remote access typically uses IPsec VPN tunnels to authenticate and secure connections.

Remote desktop access
Remote desktop access enables users to access a computer remotely from another computer and take control of it as if it were local. This kind of remote control requires that special software—which is included with most operating systems—be installed and enabled. It’s often used by those who travel frequently to access their “home” computer, and by network administrators for remote server access. This remote access method has some inherent security concerns and is usually incompatible with firewalls, so it’s important to be aware of its limitations and use adequate security precautions.

Remote KVM access
A common application in organizations that maintain servers across multiple sites is server administration through an IP-enabled KVM switch. These IP-addressable switches support one or more servers and have an integral Web server, enabling users to access them over the Internet through a Web browser. Because they’re intended for Internet use, these switches offer authentication and encryption for secure connections.

Remote power management
Anyone who’s ever had to get out of bed in the middle of the night to go switch a server off and back on again to reset it can appreciate the convenience of remote power management. Remote power managers have a wide range of capabilities ranging from simple power switching to reboot a device to sophisticated power monitoring, reporting, and management functions.

Remote environmental security monitoring
Remote environmental and security monitoring over the Internet is increasingly popular, largely because of the cost savings of using existing network infrastructure rather than a proprietary security system. This application requires IP-addressable hubs that support a variety of sensors ranging from temperature and humidity to power monitors. Some models even support surveillance cameras.

Because wireless networks are particularly vulnerable to attacks, security is a primary concern. Wireless networks can be hacked by “war drivers“—who cruise around looking for a wireless signal to exploit. Usually war drivers are just looking for free Internet access, but sometimes they’re looking for confidential information such as credit card numbers.

Although a wireless network can never be totally secure, there are important steps you can take to minimize the risk:
• Be aware of where your signal goes.
• Separate your wired network from your wireless network.
• Use encryption to lock out unauthorized users.
• Have a security plan and implement it.

When you install a wireless network near public areas, it’s very important to know where your signal is going. If it’s easily picked up outside your business—perhaps from a parked car across the street or from the building next door—then you’ve got a security problem. If you send a strong wireless signal into the coffee house next door to your business, chances are someone is going to try to take advantage of it.

A wireless analyzer can help you map exactly where your access points are sending their signals. This can help you arrange the access points in your network in order to minimize signals in public areas and maximize signals to your users. A wireless analyzer can also spot unauthorized wireless access points attached to your network as well as other wireless networks broadcasting in your area.

To add a layer of security to your wireless network, separate it from your wired network by gathering all your wireless access points into a separate LAN connected to the DMZ port of your firewall. This makes the wireless network accessible, yet safely outside of your main wired LAN. Once you separate the wireless from the wired network, insist that anything that needs to be kept secure stay on the wired network. This includes confidential data such as credit card numbers, sensitive financial data, or corporate secrets of any kind. You can, however, freely use the wireless network for less-sensitive applications such as notebook computers for taking notes at meetings, PCs for temporary workers, computer hookups for trade show booths, and bar-code readers for inventory.

Any wireless signal, no matter how heavily encrypted, can be broken into eventually. Encryption isn’t perfect, but it can go a long way towards discouraging the casual hacker—the trick is to make breaking into your network so difficult that the hackers don’t bother. Be sure to use encryption and, rather than easily hacked WEP, use higher-level encryption schemes such as Extensible Authentication Protocol-Transport Layer Security (EAP-TLS).

With a wireless network, as in any other network, it’s important to have a security plan and then implement it. The biggest security problem with wireless security is that network administrators often fail to take even the simplest of steps to ensure security, do not activate encryption at all, or fail to change the default passwords. When you fail to take these basic precautions, you leave your wireless network extremely vulnerable to casual hacking.

Yes, a wireless network is less secure than a wired network, but if you pay attention to your wireless network and implement a sensible security plan, you won’t find yourself blindsided by its vulnerabilities.

Rush hour-all day, every day.

Applications such as document imaging, video/multimedia production, and intranetworking are very demanding. They generate huge data files that often must be transferred between stations based on strict timing requirements. If such traffic is not transmitted efficiently, you end up with jerky video, on-screen graphics that take forever to load, or other irritating, debilitating problems.

These problems arise because in traditional LANs, only one network node transmits data at a time while all other stations listen. This works in conventional, server-based LANs where multiple workstations share files or applications housed on a central server. But if a network has several servers, or if it supports high-bandwidth, peer-to-peer applications such as videoconferencing, the one-station-at-a-time model just doesn’t work.

Ideally, each LAN workstation should be configured with its own dedicated LAN cable segment. But that’s neither practical nor affordable. A far more reasonable solution is a network designed to provide clear paths from each workstation to its destination on demand, whether that destination is another workstation or server.

These vehicles clear the lanes.

Unlike bridges and routers, which process data packets on an individual, first-come, first-served basis, switches maintain multiple, simultaneous data conversions among attached LAN segments.

From the perspective of an end-user workstation, a switched circuit appears to be a dedicated connection-a direct, full-speed LAN link to an attached server or other remote LAN node. Although this technique is somewhat different from what a LAN bridge or router does, switching hubs are based on similar technologies.

Which route will you choose?

Switching hubs that use bridging technologies are called Layer 2 switches-a reference to Layer 2 or the Data-Link Layer of the OSI Model. These switches operate using the MAC addresses in Layer 2 and are transparent to network protocols. Switches that use routing technologies are known as Layer 3 switches, referring to Layer 3—the Network Layer—of the OSI Model. These switches, like routers, represent the next higher level of intelligence in the hardware hierarchy. Rather than passing packets based on MAC addresses, these switches look into the data structure and route it based on the network addresses found in Layer 3. They are also dependent on the network protocol.

Layer 2 switches connect different parts of the same network as determined by the network number contained with the data packet. Layer 3 switches connect LANs or LAN segments with different network numbers.

If you’re subdividing an existing LAN, obviously you’re dealing with only one network and one network number, so you can install a Layer 2 switch wherever it will segment network traffic the best, and you don’t have to reconfigure the LAN. However, if you use a Layer 3 switch, you’ll have to reconfigure the segments to ensure that each has a different network number.

Similarly, if you’re connecting existing networks, you have to examine the currently configured network numbers before adding a switch. If the network numbers are the same, you need to use a Layer 2 switch. If they’re different, you must use a Layer 3 switch.

When dealing with multiple existing networks, you’ll find they usually use different network numbers. In this case, it’s preferable to use a Layer 3 switch (or possibly even a full-featured router) to avoid reconfiguring the network.

But what if you’re designing a network from scratch and can choose either type of switch? Your decision should be based on the expected complexity of your LAN. Layer 3 routing technology is well suited for complex networks. Layer 2 switches are recommended for smaller, less complex networks.