SERVER INFRASTRUCTURE

INFRASTRUKTURA E SERVEREVE

Osman Osmani

Prishtinë
SERVER INFRASTRUCTURE
1. The definition of IT infrastructure, Cloud computing and infrastructure model
2. Availability Concepts
3. Performance Concepts
4. Security Concepts
5. Datacenters
6. Networking
7. Storage
8. Compute
9. Operating Systems
10. Infrastructure deployment options
11. Automation
12. Documenting the infrastructure, Maintaining the infrastructure
INTRODUCTION

 Mainframe computers in the

1960s were stand-alone machines
 In the late 1960s, a number of
computers were connected by
means of the ARPANET – the
predecessor of the internet
 With PCs in the 1980s, local
Area Networks (LANs) were
introduced
 They allowed PCs to connect to each
other and to shared resources like a
file server, a printer or a router to the
internet
NETWORK TOPOLOGIES

Mesh network Bus network

Star network Ring network

OSI REFERENCE MODEL

 The OSI Reference Model (OSI-

RM) was developed in 1984 by
the International Organization
for Standardization (ISO)
 Seven layers define the different
stages that data must go through
to travel from one host to
another over a network
OSI REFERENCE MODEL

 The OSI stack allows:

 Implementing network
components independently of
each other
 Ensuring all components work
together
 Provides freedom to
implement the network stack
in an optimal way for a
certain usage
 Each layer’s payload contains
the protocol for the next layer
CABLES

 At the most elementary level, networking is about cables

 Copper based cables:
 Coax
 Twisted pair

 UTP comes in several quality ratings called categories

Category Maximum bandwidth

5 or 5e 1 Gbit/s
6 10 Gbit/s
7 10 Gbit/s
8 40 Gbit/s
FIBER OPTIC CABLING

 A fiber optic cable contains multiple strands of fiber glass or plastic

 Each provide an optical path for light pulses

 Light source:
 Light-emitting diode (LED)
 Laser

 Two types of fiber optic cable are most common:

 Multi-Mode Fiber (MMF)
 Single Mode Fiber (SMF)
PATCH PANELS

 Cables in buildings are most visible in

patch panels
 In racks in the datacenter
 In patch closets in various locations in
(office) buildings
 They connect systems in a flexible way,
without having to change the installed
cabling in the building
 Patch panels are passive connecting
devices
 Connecting systems is done using patch
cables
VERTICAL AND HORIZONTAL CABLING

 The main distribution cabling in

buildings connects the patch
panels on the floors to the
datacentre (vertical cabling)
 Endpoints in the walls are
connected to the patch panels
(horizontal cabling)
LEASED LINES

 Leased lines are dedicated data connections between two locations, provided
by a telecom provider
 Leased lines are based on:
 T or E carrier lines
 SONET
 SDH
 Dark fiber
INTERNET ACCESS

Three ways to connect to the internet:

 Cable internet access
 Uses cable television infrastructure
 Digital Subscriber Line (DSL)
 Asymmetric DSL (ADSL)
 Symmetric DSL (SDSL)
 Very High DSL (VDSL)
NETWORK INTERFACE CONTROLLERS
(NICS)

 Hardware component that connects a server or end user device to a physical

network cable
 The NIC is actually both a physical layer and data link layer device
 Provides physical access to a networking cable and an implementation of a datalink
protocol like Ethernet

 A NIC has a fixed MAC address that is uniquely assigned to its network
interface
ETHERNET

 Developed at Xerox PARC between 1973 and 1975

 Originally employed a shared medium topology, based on coax cable
 Later Ethernet used twisted pair cabling with hubs and switches
 Decreased the vulnerability of the network caused by broken cables or bad connectors

 An Ethernet packet contains:

 Source and destination MAC addresses
 Data that needs to be transported (payload)
 Cyclic redundancy check
WLAN (WI-FI)

 Wi-Fi range is about 30 m

 Access points are base stations for a wireless network
 Data encryption: Wi-Fi Protected Access (WPA)
 WPA dynamically generates a new key for each packet
 WPA includes a Message Integrity Check
 Prevents an attacker from capturing, altering and/or resending data packets
SWITCHING

 Switches split a single network segment into multiple

segments
 Each segment has one device

 Switches learn which MAC address is connected to

which port
 Data sent to a certain MAC address will only be
forwarded to the switch port that has that MAC address
connected
 On a switched network, many simultaneous data
transfers can take place, in full-duplex
IPV4 ADDRESSES

 IPv4 addresses are composed of 4 bytes (32 bits), represented by 4 decimal

numbers, and divided by a period (like [Link])
 An IP address has a network prefix and a host number
 All hosts with the same network prefix can communicate directly to each
other
 Hosts in other networks can only be reached using a router
IPV4 CLASSES

 The first three bits of the first byte

of an IP address define the class of
the address
 Three classes of networks are
defined

Max number of Number of available

Class First byte
hosts networks
A 0–127 16,777,214 128
B 128–191 65,534 16,384
C 192–223 254 2,097,152
IPV4 SUBNETTING
CIDR Available Hosts per subnet
Subnet mask
prefix subnets
 Subnetting is used to split up /24 [Link] 1 254
the host part of an IP network /25 [Link] 2 126
in smaller subnets, each /26 [Link] 4 62
forming a new IP network /27 [Link] 8 30
/28 [Link] 16 14
 The routing prefix can also /29 [Link] 32 6
be expressed in CIDR /30 [Link] 64 2
notation /31 [Link] 128 2 (only point-to-point)
 It is written as the address of
a network, followed by a
slash character (/), and ending
with the bit-length of the
network space
 For example, [Link]
is the network mask for the
[Link]/24 CIDR
notation.
IPV4 - PRIVATE IP RANGES

 Private IP addresses should be used for LANs

 The number of unique IP addresses on the internet is limited
 Hosts with public internet IP addresses can reach the internet directly

 Private IP address ranges:

 [Link] to [Link] (class A address range)
 [Link] to [Link] (class B address range)
 [Link] to [Link] (class C address range)

 Private IP addresses:
 Are not used on the internet
 Are not routed by internet routers
ICMP

 The Internet Control Message Protocol (ICMP) is an integral part of the IP

protocol
 The best-known use of ICMP:
 'ping‘
 'traceroute‘
ROUTING

 A router copies IP packages between

(sub)networks
 Routers compile routing tables to make
IP packet forwarding decisions
 Routing and switching functionality may
be combined in one device
 A switch capable of handling routing protocols
is also known as a layer 3 switch
ROUTING PROTOCOLS

 Dynamic routing protocols automatically create routing tables

 Based on information exchange with neighboring routers

 When a network connection experiences problems, the routing protocol

automatically reconfigures the routing tables to use alternative routes
 LAN and WAN routing protocols can be divided in three classes:
 Distance vector protocols (like RIP and IGRP)
 Link state protocols (like OSPF and IS-IS)
 Path vector routing (like BGP)
TRANSPORT LAYER

 The transport layer can maintain flow control, and can provide error
checking and recovery of data between network devices
 The most used transport layer protocols are TCP and UDP
TCP

 Transmission Control Protocol (TCP) uses the IP protocol to create reliable

transmission of so-called TCP/IP packets
 TCP provides reliable, ordered delivery of a stream of data between applications
 TCP introduces much overhead
UDP

 User Datagram Protocol (UDP) emphasizes reduced latency over reliability

 It sends data without checking if the data arrived
 Reduces much overhead
 UDP is typically used when some packet loss is acceptable
 Real-time voice and video streams
 When only small amounts of data are transmitted, that fit in one IP packet
TCP AND UDP PORTS

 TCP and UDP use logical port numbers

 Each side of a TCP or UDP connection uses an associated port number between
0 and 65,535
 Received TCP or UDP packets are identified as belonging to a specific
connection by its combination of the IP address, and the TCP or UDP port
number
 For instance: [Link]:80, the number after the colon represents the port number
(80 in this case)

 Servers running a specific service listen to well-known ports:

 FTP (port 21)
 SSH (port 22)
 SMTP (port 25)
 DNS (port 53)
 HTTP (port 80)
NETWORK ADDRESS TRANSLATION (NAT)

 As a packet passes a NAT enabled

router from its internal network
interface to its internet interface, NAT
replaces the packet’s private IP address
with its public IP address
 NAT allows the use of a private
addressing space within an
organization, while using globally
unique addresses for routing data to the
internet
VIRTUAL PRIVATE NETWORK (VPN)

 A Virtual Private Network (VPN) uses a public network to interconnect

private sites in a secure way
 Also known as a VPN tunnel

 VPN uses "virtual" connections based on IPsec/SSL

 Most network providers also offer private VPNs based on MPLS
VIRTUAL PRIVATE NETWORK (VPN)

 VPNs use strong encryption and strong user authentication

 Using the internet for transmitting sensitive data is considered safe

 VPN tunnels are often used for remote access to the LAN by users outside of
the organization's premises
 Most common VPN communications protocol standards:
 Point-to-Point Tunneling Protocol (PPTP) for individual client to server connections
 Layer 2 Tunneling Protocol (L2TP) for individual client to server connections
 IPsec for network-to-network connectivity

 IPsec is built into IPv6 standard and is implemented as an add-on to IPv4

SSL AND TLS

 Allow applications to communicate securely over the internet using data encryption
 Secure Sockets Layer (SSL)
 SSL is considered insecure and should not be used
 Transport Layer Security (TLS)
 TLS is securing WWW traffic carried by HTTP to form HTTPS
 TLS version 1.2 is still secure
 TLS 1.3 offers a faster TLS handshake and simpler, more secure cipher suites
 TLS relies on an application capable of handling the protocol (like a Web browser)
APPLICATION LAYER

 This layer interacts with the operating system or application

 This layer also contains the relatively simple infrastructure services
 These infrastructure services are used by the infrastructure itself
 Not necessarily used by upper layer applications
 If infrastructure services fail, usually the entire infrastructure fails!
DHCP

 DHCP dynamically assigns network related parameters to hosts:

 IP addresses
 Subnet masks
 Default gateway to be used for routing
 DNS server to be used
 A DHCP assigned IP address has a limited life span
 Typically a few hours
 This is called a lease
DNS

 For example, [Link] is translated

to [Link]
 This IP address is used by the browser to
connect to the web server
 DNS distributes the responsibility of mapping
domain names to IP addresses by designating
authoritative name servers for each domain
 DNS is a distributed database that links IP
addresses with domain names
 Translates domain names, meaningful to
humans, into IP addresses
NETWORK TIME PROTOCOL (NTP)

 NTP ensures all infrastructure components use the same time in their real-time
clocks
 Particularly important for:
 Log file analysis
 Clustering software
 Kerberos authentication

 NTP can maintain time:

 To within 10 milliseconds over the internet
 Accurate to 0.2 milliseconds or better in LANs
 When the time in an operating system is incorrect, the NTP client in the operating
system changes the operating system clock
POP AND SMTP

 POP = Post Office Protocol. Used by email clients to retrieve email messages from a mail server
 POP does not synchronize email messages between the client and server. If a user reads or deletes an
email message on their email client, it will not be synchronized back to the mail server
 SMTP = Simple Mail Transport Protocol. Used to send email messages from a mail client to a
mail server or between mail servers
 When a user sends an email message, it is sent to the user's mail server, which then forwards the message
to the recipient's mail server using the SMTP protocol. The recipient's mail server then delivers the
message to the recipient's inbox
 SMTP is a text-based protocol. Email messages are transmitted in plain text between the client and the
server
 SMTP supports TLS encryption, to create secure email communications
 MIME = Multipurpose Internet Mail Extensions.
 Enables SMTP to support file attachments in email messages
 MIME converts an attachment into a stream of ASCII characters and then embeds those characters in the
e-mail message
FTP

 FTP = File Transfer Protocol. A protocol for transferring files between computers
 The FTP client software initiates a connection to the server and sends commands to request
and transfer files
 FTP includes features such as file listing, directory creation, and file deletion
 FTP can operate in active or passive mode
 In active mode, the client opens a TCP port and the server establishes a connection to the client
 In passive mode, the server opens a TCP port (often the default port 21) and the client connects
to the server. Passive mode is often used to get around firewall restrictions that prevent
incoming connections
 FTP has some security concerns, such as sending login credentials over the network in clear
text
 FTPS (FTP Secure) and SFTP (Secure File Transfer Protocol) are alternatives to FTP that
provide encryption of data in transit
HTTP AND HTTPS

 HTTP = Hypertext Transfer Protocol

 HTTPS = HTTP Secure
 Both are protocols to transfer data over the internet
 HTTP(S) is most commonly used when browsing the web with a web browser such as
Chrome, Firefox, Safari, or Edge
 HTTP defines how messages are formatted and transmitted, and how web servers
and browsers should respond to various commands
 When a user types a web address into a web browser, the browser sends an HTTP request
to the web server, which responds with an HTTP response containing the requested
resource, such as a web page or image.
 HTTPS is a secure version of HTTP
 It adds an extra layer of security using TLS
VIRTUAL LAN (VLAN)

 VLANs enable logical grouping of network nodes on the same LAN

 Configured on network switches
 Operate at the Ethernet level
VIRTUAL LAN (VLAN)

 VLANs:
 Allow segmenting a network at the data link layer
 Allow end stations to be grouped together even if they are not physically connected to the
same switch
 Can adapt to changes in network requirements and allow simplified administration
 Enhance security by preventing traffic in one VLAN from being seen by hosts in a
different VLAN
 For VLANs to communicate with each other a router is needed
VIRTUAL NICS

 Virtual machines are only aware of virtual Network Interface Controllers (NICs)
provided to them
 Virtual machines running on physical machines share physical NICs
 Communications between virtual machines on the same physical machine are
routed directly in memory space by the hypervisor, without using the physical NIC
 The hypervisor routes Ethernet packages from the virtual NIC on the virtual
machine to the physical NIC on the physical machine
VIRTUAL SWITCH

 Virtual NICs are connected to virtual

switches
 A virtual switch is an application
running in the hypervisor, with most
of the capabilities of a physical
network switch
 A virtual switch is dynamically
configured
 Ports in the virtual switch are
configured at runtime
 The number of ports on the switch is in
theory unlimited
VIRTUAL SWITCH

 Availability:
 No cable disconnects
 No need for auto-detecting network speed
 No network hubs, routers, adapters, or cables that could physically fail
 Security:
 No easy way to intercept network communications between virtual machines from outside
of the physical machine
SOFTWARE DEFINED NETWORKING

 Software Defined Networking (SDN) allows networks to be defined and controlled

using software external to the physical networking devices
 A set of physical network switches can be programmed as a virtual network:
 Hierarchical
 Complex
 Secured
 A virtual network can easily be changed without touching the physical network
components
SOFTWARE DEFINED NETWORKING

 Control plane resides

centrally
 Data plane (the physical
switches) remain
distributed
SOFTWARE DEFINED NETWORKING

 SDN can be controlled from a single management console

 Provides open APIs that can be used to manage the network using third party
software
 In an SDN, the distributed data plane devices are only forwarding network packets
based on ARP or routing rules that are preloaded into the devices by the SDN
controller in the control plane
 This allows the physical devices to be much simpler and more cost effective
 Good examples of SDN are implemented by the public cloud providers
 AWS has Virtual Private Clouds (VPCs)
 Azure has Virtual Networks (VNETs)
 GCP has Virtual Private Cloud
NETWORK FUNCTION VIRTUALIZATION

 Network Function Virtualization (NFV) is a way to virtualize networking devices

 Firewalls
 VPN gateways
 Load balancers
 NFV appliances are implemented as virtual machines running applications that
perform the network functions
 NFV virtual appliances can be created and configured dynamically and on-demand
using APIs
 Example:
 Deploy a new firewall as part of a script that creates a number of connected virtual
machines in a cloud environment
LAYERED NETWORK TOPOLOGY

 A network infrastructure should be built

up in layers
 Improve availability and performance
 Provides scalability
 Provides deterministic routing
 Avoids unmanaged ad-hoc data streams
 Provides high availability
 Because the layering provides multiple
paths to any piece of equipment
LAYERED NETWORK TOPOLOGY

 Core layer
 This is the center of the network
 Distribution layer
 An intermediate layer between the core layer in the datacenter and the access switches in
the patch closets
 Combines the access layer data and sends its combined data to one or two ports on the
core switches
 Access layer
 Connect workstations and servers to the distribution layer
 For servers, located at the top of the individual server racks or in blade enclosures
 For workstations, placed in patch closets in various parts of the building
NETWORK TEAMING

 Network teaming is also known as:

 Link aggregation
 Port trunking
 Network bonding
 Provides a virtual network connection using multiple physical cables for high
availability and increased bandwidth
NETWORK TEAMING

 Network teaming bonds physical NICs together to form a logical network team
 Sends traffic to the team’s destination to all NICs in the team
 Allows a single NIC, cable, or switch to be unavailable without interrupting traffic
SPANNING TREE PROTOCOL (STP)

 STP is an Ethernet level protocol that runs on switches

 Guarantees that only one path is active between two network endpoints at any given time
 Redundant paths are automatically activated when the active path experiences problems
 Ensures no loops are created when redundant paths are available in the network
 A disadvantage of using the spanning tree protocol is that it is not using half of the network
links in a network, since it blocks redundant paths
 Shortest Path Bridging (SPB) allows all paths to be active simultaneously, enables much
larger topologies, supports faster convergence times, and improves efficiency by allowing
traffic to be load balanced across all paths
 While STP can take 30 to 60 seconds to respond to a topology change, SPB can respond to
changes in less than a second
SPANNING TREE PROTOCOL
THROUGHPUT AND BANDWIDTH

 Throughput is the amount of data that is transferred through the network during a
specific time interval
 Throughput is limited by the available bandwidth
 When an application requires more throughput than a network connection can
deliver:
 Queues in the network components temporarily buffer data
 Buffered data is sent as soon as the network connection is free again
 When more data arrives than the queues can store in the buffer, packet loss occurs
LATENCY

 Latency is defined as the time from the start of packet transmission to the start of
packet reception
 Latency is dependent on:
 The physical distance a packet has to travel
 The number of switches and routers the packet has to pass
 Rules of thumb:
 6 ms latency per 100 km
 WANs: Each switch in the path adds 10 ms to the one-way delay
 LANs: add 1 ms for each switch
LATENCY

 One-way latency: the time from the source sending a packet to the destination
receiving it
 Round-trip latency: the one-way latency from source to destination plus the one-
way latency from the destination back to the source
 “ping” can be used to measure round-trip latency
NETWORK ENCRYPTION

 All data that traverses the network should be encrypted

 Encrypting data on the network is called encrypting data in transit (as opposed to
encrypting data at rest)
 Data can be encrypted between two endpoints, such as a server and a client. This is
called end-to-end encryption. An example is HTTPS for traffic from a web server to
a web browser
 Even when using end to end encryption, network traffic must always be encrypted
 Encryption is often a feature of the network components in the datacenter
FIREWALLS

 Firewalls separate two or more LAN or WAN segments for security reasons
 Firewalls block all unpermitted network traffic between network segments
 Permitted traffic must be explicitly enabled by configuring the firewall to allow it
 Firewalls can be implemented:
 In hardware appliances
 As an application on physical servers
 In virtual machines
 Host based firewalls
 Protect a server or end user computer against network based attacks
 Part of the operating system
FIREWALLS

 Firewalls use one or more of the following methods to control traffic:

 Packet filtering
 Data packets are analyzed using preconfigured filters
 This functionality is almost always available on routers and most operating systems
 Proxy (also known as application layer firewalls or API gateways)
 A proxy terminates the session on the application level on behalf of the server (proxy) or the
client (reverse proxy) and creates a new session to the client or server
 Stateful inspection
 Inspects the placement of each individual packet within a packet stream
 Maintains records of all connections passing through the firewall and determines whether a
packet is the start of a new connection, part of an existing connection, or is an invalid packet
NETWORK SEGMENTATION

Segmentation

Micro segmentation
IDS/IPS

 An Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) detects

and – if possible – prevents activities that compromise system security, or are a
hacking attempt
 An IDS/IPS monitors for suspicious activity and alerts the systems manager when
these activities are detected
 An IPS can stop attacks by changing firewall rules on the fly
IDS/IPS

 Two types of IDS/IPS systems:

 A Network-based IDS (NIDS) is placed at a strategic point in the network
 Monitors traffic to and from all devices on that network
 The NIDS is not part of the network flow, but just “looks at it”, to avoid detection of the NIDS by
hackers
 A Host-based IDS (HIDS) runs on individual servers or network devices
 It monitors the network traffic of that device
 It also monitors user behavior and the alteration of critical (system) files
 DMZ

 DMZ is short for De-Militarized Zone, also

known as screened subnet, or the Perimeter
Network
 A DMZ is a network that serves as a buffer
between a secure protected internal network and
the insecure internet
RADIUS

 Remote Authentication Dial In User Service (RADIUS) is a networking protocol

that provides centralized user and authorization management for network devices
 Routers
 Modem servers
 Switches
 VPN routers
 Wireless network access points
 RADIUS
 Authenticates users or devices before granting them access to a network
 Authorizes users or devices for certain network services