Laboratorio 11 – Arquitectura de Red Empresarial

Contexto empresarial

La empresa Networking SecOps ha implementado su infraestructura WAN (Laboratorio 10). Ahora necesita diseñar la arquitectura de red completa para su sede central.

Topología

Direccionamiento:

Construcción

Paso 1: Crear namespaces

sudo ip netns add Core1
sudo ip netns add Core2
sudo ip netns add Dist1
sudo ip netns add Dist2
sudo ip netns add Access1
sudo ip netns add Access2
sudo ip netns add Access3
sudo ip netns add Firewall
sudo ip netns add ServidorWeb
sudo ip netns add ServidorDNS

Paso 2: Conectar Core a Distribución

sudo ip link add veth-c1d1 type veth peer name veth-d1c1
sudo ip link set veth-c1d1 netns Core1
sudo ip link set veth-d1c1 netns Dist1
sudo ip netns exec Core1 ip addr add 10.0.0.1/24 dev veth-c1d1
sudo ip netns exec Core1 ip link set veth-c1d1 up
sudo ip netns exec Dist1 ip addr add 10.0.1.1/24 dev veth-d1c1
sudo ip netns exec Dist1 ip link set veth-d1c1 up

sudo ip link add veth-c1d2 type veth peer name veth-d2c1
sudo ip link set veth-c1d2 netns Core1
sudo ip link set veth-d2c1 netns Dist2
sudo ip netns exec Core1 ip addr add 10.0.0.2/24 dev veth-c1d2
sudo ip netns exec Core1 ip link set veth-c1d2 up
sudo ip netns exec Dist2 ip addr add 10.0.1.2/24 dev veth-d2c1
sudo ip netns exec Dist2 ip link set veth-d2c1 up

sudo ip link add veth-c2d1 type veth peer name veth-d1c2
sudo ip link set veth-c2d1 netns Core2
sudo ip link set veth-d1c2 netns Dist1
sudo ip netns exec Core2 ip addr add 10.0.0.2/24 dev veth-c2d1
sudo ip netns exec Core2 ip link set veth-c2d1 up
sudo ip netns exec Dist1 ip addr add 10.0.1.1/24 dev veth-d1c2
sudo ip netns exec Dist1 ip link set veth-d1c2 up

sudo ip link add veth-c2d2 type veth peer name veth-d2c2
sudo ip link set veth-c2d2 netns Core2
sudo ip link set veth-d2c2 netns Dist2
sudo ip netns exec Core2 ip addr add 10.0.0.2/24 dev veth-c2d2
sudo ip netns exec Core2 ip link set veth-c2d2 up
sudo ip netns exec Dist2 ip addr add 10.0.1.2/24 dev veth-d2c2
sudo ip netns exec Dist2 ip link set veth-d2c2 up

Paso 3: Conectar Distribución a Acceso

sudo ip link add veth-d1a1 type veth peer name veth-a1d1
sudo ip link set veth-d1a1 netns Dist1
sudo ip link set veth-a1d1 netns Access1
sudo ip netns exec Dist1 ip link set veth-d1a1 up
sudo ip netns exec Access1 ip link set veth-a1d1 up

sudo ip link add veth-d2a1 type veth peer name veth-a1d2
sudo ip link set veth-d2a1 netns Dist2
sudo ip link set veth-a1d2 netns Access1
sudo ip netns exec Dist2 ip link set veth-d2a1 up
sudo ip netns exec Access1 ip link set veth-a1d2 up

sudo ip link add veth-d1a2 type veth peer name veth-a2d1
sudo ip link set veth-d1a2 netns Dist1
sudo ip link set veth-a2d1 netns Access2
sudo ip netns exec Dist1 ip link set veth-d1a2 up
sudo ip netns exec Access2 ip link set veth-a2d1 up

sudo ip link add veth-d2a2 type veth peer name veth-a2d2
sudo ip link set veth-d2a2 netns Dist2
sudo ip link set veth-a2d2 netns Access2
sudo ip netns exec Dist2 ip link set veth-d2a2 up
sudo ip netns exec Access2 ip link set veth-a2d2 up

sudo ip link add veth-d1a3 type veth peer name veth-a3d1
sudo ip link set veth-d1a3 netns Dist1
sudo ip link set veth-a3d1 netns Access3
sudo ip netns exec Dist1 ip link set veth-d1a3 up
sudo ip netns exec Access3 ip link set veth-a3d1 up

sudo ip link add veth-d2a3 type veth peer name veth-a3d2
sudo ip link set veth-d2a3 netns Dist2
sudo ip link set veth-a3d2 netns Access3
sudo ip netns exec Dist2 ip link set veth-d2a3 up
sudo ip netns exec Access3 ip link set veth-a3d2 up

Paso 4: Configurar Firewall y DMZ

sudo ip link add veth-fw-wan type veth peer name veth-wan-fw
sudo ip link set veth-fw-wan netns Firewall
sudo ip netns exec Firewall ip addr add 192.168.100.1/24 dev veth-fw-wan
sudo ip netns exec Firewall ip link set veth-fw-wan up
sudo ip addr add 192.168.100.2/24 dev veth-wan-fw
sudo ip link set veth-wan-fw up

sudo ip link add veth-fw-dmz type veth peer name veth-dmz-fw
sudo ip link set veth-fw-dmz netns Firewall
sudo ip netns exec Firewall ip addr add 10.0.99.1/24 dev veth-fw-dmz
sudo ip netns exec Firewall ip link set veth-fw-dmz up
sudo ip link set veth-dmz-fw netns ServidorWeb
sudo ip netns exec ServidorWeb ip addr add 10.0.99.10/24 dev veth-dmz-fw
sudo ip netns exec ServidorWeb ip link set veth-dmz-fw up
sudo ip netns exec ServidorWeb ip route add default via 10.0.99.1

sudo ip link add veth-fw-lan type veth peer name veth-lan-fw
sudo ip link set veth-fw-lan netns Firewall
sudo ip netns exec Firewall ip addr add 10.0.0.254/24 dev veth-fw-lan
sudo ip netns exec Firewall ip link set veth-fw-lan up
sudo ip link set veth-lan-fw netns Core1
sudo ip netns exec Core1 ip addr add 10.0.0.1/24 dev veth-lan-fw
sudo ip netns exec Core1 ip link set veth-lan-fw up

Paso 5: Configurar enrutamiento y NAT

sudo ip netns exec Firewall sysctl -w net.ipv4.ip_forward=1
sudo ip netns exec Firewall iptables -t nat -A POSTROUTING -o veth-fw-wan -j MASQUERADE
sudo ip netns exec Firewall iptables -A FORWARD -i veth-fw-lan -o veth-fw-wan -j ACCEPT
sudo ip netns exec Core1 ip route add default via 10.0.0.254
sudo ip netns exec Core2 ip route add default via 10.0.0.254
sudo ip netns exec Dist1 ip route add default via 10.0.0.1
sudo ip netns exec Dist2 ip route add default via 10.0.0.1

Paso 6: Verificar

sudo ip netns exec Core1 ping -c 4 8.8.8.8
sudo ip netns exec Core1 ping -c 4 10.0.99.10

Alta Disponibilidad

Simular fallo de Core1

sudo ip netns exec Core1 ip link set veth-c1d1 down
sudo ip netns exec Dist1 ping -c 4 10.0.99.10

Segmentación VLAN

Ejercicios

Ejercicio 1: Agregar redundancia de enlaces

Conecta Access2 a Dist1 y Dist2 para redundancia.

Ejercicio 2: Configurar STP

Investiga STP y cómo prevenir bucles.

Conceptos clave

Conclusiones

La arquitectura jerárquica proporciona escalabilidad, disponibilidad y facilidad de administración. La redundancia elimina puntos únicos de fallo.

¡Laboratorio 11 completado! Continúa con el Laboratorio 12.