How the Ashmolean, Pitt Rivers and University Museums, in cooperation with the Computing Services, implemented a joint Firewall and set up cross-museum wireless access, via a Fortigate 200B cluster, Aerohive Access Points and many Gliffy diagrams

1. The Challenge of Integrating the Networks
of
Three University Museums
Jonathan Moffett : Ashmolean
Anjanesh Babu : Ashmolean
Sarah Phibbs : OUMNH
Haas Ezzet : Pitt Rivers
ICTF 2012
5 July 2012
1

2. Museum 1: Ashmolean
http://www.ashmolean.org
2

3. Museum 2 : Natural History Museum
http://www.oum.ox.ac.uk
3

4. Museum 3 : Pitt Rivers Museum
http://www.prm.ox.ac.uk
4

5. What we do
• Collections Management
• Academic Research
• Displays / Exhibitions
• Education / Outreach
• University Teaching
• Events
• Collections Online
5

6. Visitors
• Visitor Numbers : around 2 million
• Around 3 million virtual visitors
• Free to visit
• 300 - 400 staff
• 6.5 FTE ICT Staff
6

7. Why Integrate our Networks?
• Security Considerations
• Museums Reviews
• External funding
• Greater access to collections

8. Ashmolean
Natural History
Pitt Rivers
The Museum Networks in 2010
in house
8

9. Challenges
• Accommodate the variations
• Resources
• F unding (ACE / Renaissance )
• Maintaining operational continuity

10. Solutions: Option 1: Stand alone
FW 1! FW 2! FW 3!

11. Solutions: Option 2: mix match
FW 1! FW 2! FW 3!

12. Solutions: Option 3: match mix
FW 1! FW 2! FW 3!

13. Solutions: Option 4: Working Together
QinQ
c
o
r
e
QinQ
13

14. Scale of the problem
Natural History Museum
Pitt Rivers
The Ashmolean
1 mile
14

15. OUCS : The Front Door System
OUM-Frodo
QinQ
Site Default VLAN
The Ashmolean
Other vlans
QinQ
QinQ
OUMNH
Ash-Frodo
PRM-Frodo
802.1Q Trunks
QinQ
VLAN Aggregator
Site VLANS
Site Default VLAN
Other vlans
PRM
15

16. Firewall Hardware
Core Switch : Cisco 3750-X
FORTIGATE 200B
FORTIGATE 200B
Active Firewall
Passive Firewall
FORTIANALYSER 100C
Mains Power
Mains Power
Eaton EA 1000VA 2U
Eaton Source Switching
Eaton EA 1000VA 2U
16

17. Fortinet: Advantage
VDOM 1
VDOM 2
VDOM 3
One Physical Unit
17

18. Fortinet: did we get this right?
2010
2012
18

19. Aerohive advantages : wireless
• Single WPA2 network – multiple vlans
• Distributed architecture (‘the Hive’)
• Mesh network
PPSK
• Feature rich
• Cost effective
19

20. Aerohive: Single SSID: Multiple VLans
WPA2 – PSK
SSID
PRM– User list
Ash – MAC filter
PRM VLAN
OUM – MAC filter
OUM– User list
OUM VLAN
PRM – MAC filter
ASH – user list
Ash VLAN
20

21. Getting the tingles
• Wireless Network growing
• Static devices up
• Reduction in number of attacks
• Visibility into usage patterns
• Simplified management
21

22. A recap of how we were before ........
in house
22

23. Where we are now: Service Layers
edge
?

24. Reduce the Chatter
DNS
DHCP
0101010100101101010100101010101011
Core
DNS
0101010100101111
DHCP
24

25. Push to the Edge the future
Push IT Expertise to the edge
25

26. User-Savvy Tech
• Not tech savvy users
• Simpler tools to get things done - e.g. codiqa, online
noCode app development
• This is the future we are anticipating
• Enablers for change
26

27. Eternally grateful to
• Alistair James (OUCS Network Operations
Manager)
• Pierre Ramsay (OUCS Network Control)
• Mark Siddle (Network Operations)
• Stephen Madeley (Network Operations)
• Christopher Burchell (Network Operations)
• Entire OUCS Networks team
• Oxford University IT Support Staff Group
27

28. Any Questions ?
28