LIQUID<> RMS Network

Configuration of network

This below is a detailed plan for how the local area network will be setup including the vlan
configurations as well as the IP address assignments accordingly in relation the current
setup on premises:

VLAN configuration.

On the new setup we are considering staying within the same vlans range that was being
used in the local area network on the HQ which is listed below: -

VLAN ID Vlan Name

50 AP-mngt
41 SW-mngt
15 STAFF WLAN &
Reserved CPEs
20 Guest WiFi

30 SERVERS

The additional vlan tags i.e.50 and 41 these will be used to from liquid end as the ruckus
access points management and Switch management for remote management and
maintenance or support.

IP Assignments.

On the new setup the planning for the network segmentation we’ll consider making new
subnets as were discussed will not affect after modification. The proposed new IP
assignments within the vlan segments are as below for your reference: -
VLAN ID Vlan Name IP pool assigned DHCP range Reserved GW
50 AP-mngt under vrf (from liquid) N/A N/A
41 SW-mngt under vrf (from liquid) [Link]/24 N/A
15 STAFF WLAN & [Link]/23 [Link]-[Link] 172.17.0.[2-100] [Link]
Reserved CPEs
20 Guest Wifi [Link]/23 [Link]-[Link] 10.10.0.[2-99] [Link]
30 SERVERS [Link]/24 [Link]-[Link] 172.19.0.[3-48] [Link]

Architectural design for the RMS<>HQ network setup

The below architectural design is for the network for HQ as you had requested for your
review.
VPN Site – to – site setup architecture
Sites RMS HQ <> AOS HQ

1) IP Address: AoS side ([Link]/27, [Link]/28, [Link]/27) RMS HQ Side

([Link]/20, [Link]/24)
N.B. For the VPN subnets will also be modified accordingly after setting up the other
LANs to avoid subnet overlapping.

In a nutshell this is the low-level diagram for n/w architecture. Please note that
modifications will be made according to the necessity of the changes required as the
project proceeds to the final migration phase.

DEVICE CONFIGURATIONS DETAILS

Please find the below information on the devices deployed on site with the details and
the configuration summary:

Node connected on uplink LTR vlan p2p public Ips for NAT SSIDs vlan mapped subnet WPA2/3 encryption
TLC node GE0/5/1.2196 2196 [Link]/31 RMS-Staff vlan 15 [Link]/20 Enabled
[Link]/29
FortiGate-
Core Equipment 60F WAN-1 - DIA
Microtik CSS106-5G-1S CSS106-5G-1S Ge0/0/1-mngt [Link]

Below are the details for the configuration on the CPE’s deployed on site.
Description: Routers, switches, firewall, and other network device settings deployed.

FortiGate-60F: (Core)
- WAN Interface:
- IP Address: [Link]/31 as P2P for FortiGate remote Mngt
- Subnet Mask: [Link]
- Gateway: [Link]
Public IP for NAT on WAN interface
- IP Address: [Link]/29
- Subnet Mask: [Link]
- Gateway: [Link]
- LAN Interface:
- IP Address: [Link]
- Subnet Mask: [Link]
- WLAN DHCP Server:
 - Scope: [Link]-[Link]
- Netmask: [Link]
- Lease Duration: 604800 Seconds
- Reserved: [Link] - [Link] (For the CPEs)
VLAN Interface for the servers:
- IP Address: [Link]/24
- Subnet Mask: [Link]
- Gateway: [Link]

Firewall Rules:
- Allow HTTP/HTTPS traffic from LAN to WAN
- Block all incoming traffic from WAN
- Access Control Lists (ACLs):
- Permit traffic from Staff subnet to the servers’ subnet
- Only allow traffic from Staff subnet to servers’ subnet and deny the rest.

Authentication Methods:

- Enabled RADIUS authentication for remote network access on the firewall.

- Configured LDAP for user authentication

Encryption:
- Enabled SSL/TLS for secure web access to the core firewall - FortiGate-60F
- Configure IPsec for VPN connections (Site to site between HQ and AOS)

- D-Link DGS-1210-28P: (Access switches)

VLAN Configuration:
- VLAN 50: AP-MNGT (Ports 1-10) as the native VLAN and trunk vlan 15 for the ports
connected on the Ruckus R350 and R550 access points.
- VLAN 15: Staff wlan (Ports 11-24) for the LAN access connections via RJ-45 LAN
cables
Trunk Ports:
- Port 27: Trunk to FortiGate-60F
- Port 28: Trunk to another switch in another area
- Port Security:
- Enabled MAC address filtering on all ports
 Firewall Policies:
- Allow HTTP/HTTPS traffic from LAN to WAN.
- Block all incoming traffic from WAN.

VPN Configuration:
- Enabled SSL VPN for remote access
- Configured IPsec for VPN connections between HQ site and AOS

SYSTEM INFORMATION FOR THE CORE CPEs

FortiGate-60F: (Core)
Hostname: RMS-HQ
Serial Number: FGT60FTK2309BSEH
Firmware: v7.2.11 build1740 (Mature)
FortiGate Cloud – activated

Licenses
➢ Forticare support - Registered
➢ Auto Firmware & General updates - (Expiration Date: 2028/02/07)
➢ IP filtering - (Expiration Date: 2028/02/07)
➢ Anti-virus - (Expiration Date: 2028/02/07)
➢ Web Filtering - (Expiration Date: 2028/02/07)
➢ Premium FortiGuard Unified Threat Protection license

LIST OF THE RUCKUS ACCESS POINTS DEPLOYED ON PREMISES

MAC Address Serial Number Device Model Device Name Customer Name Operational Status
A8:0B:FB:02:15:10 272322004114 R550 WAREHOUSE-AP-6-Office-Area
RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:E7:20 252373001263 R350 INBOX-AP-1 RWANDA MEDICAL SUPPLY Operational
00:33:58:08:F5:80 502322010105 R550 PEZ Block C office 3 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:EA:80 252373001317 R350 ADMIN-Corridor-AP-2 RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:01:D1:C0 272322003037 R550 PROCUREMENT-AP RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:EA:60 252373001315 R350 WAREHOUSE-AP-3 RWANDA MEDICAL SUPPLY Operational
5C:83:6C:27:DD:F0 492322005394 R550 PEZ-Block-B2-stock-2 RWANDA MEDICAL SUPPLY Operational
00:33:58:09:1F:40 502322010773 R550 PEZ-Block-B-office-2 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:14:80 252373001989 R350 PEZ-Block A-Office-II RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:01:14:30 272322000004 R550 PEZ-Block A-Stock-II RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:01:B4:30 272322002564 R550 PEZ-Block A Office 3 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:3E:20 252373002655 R350 SERVER-ROOM-AREA RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:06:C5:80 272322023321 R550 PEZ- Block A-stock-III RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:DE:B0 252373001128 R350 WAREHOUSE-AP-2 RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:01:14:20 272322000003 R550 CONTROL-ROOM RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:31:60 252373002451 R350 RECEPTION-AP RWANDA MEDICAL SUPPLY Operational
00:33:58:08:EA:F0 502322009936 R550 PEZ-Block B2 Stock 1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:E3:B0 252373001208 R350 PEZ Block C Stock 3 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:35:E0 252373002523 R350 PEZ-Block C Office 1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:D9:D0 252373003450 R350 WAREHOUSE-AP-5 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:59:80 252373003093 R350 PEZ-Block-C-Office-2 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:D9:00 252373003437 R350 Imusanze-AP RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:02:16:30 272322004132 R550 PEZ-Block-A-office-1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:28:80 252373002309 R350 ADMIN-CORRIDOR-AP-1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:68:60 252373003331 R350 PEZ-BLOCK-A-STOCK-I RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:E8:50 252373001282 R350 Board-Room-AP RWANDA MEDICAL SUPPLY Operational
00:E6:3A:18:44:A0 252373002759 R350 PEZ-block-B-Stock-3 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:DB:40 252373003473 R350 IT-DPT-Office-AP RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:E3:E0 252373001211 R350 INBOX-AP-2 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:D8:20 252373003423 R350 PEZ-BLOCK-B-OFFICE RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:D9:90 252373003446 R350 PEZ-Block-B1-stock-2 RWANDA MEDICAL SUPPLY Operational
00:33:58:09:2D:50 502322010998 R550 PEZ-Block-B-Stock-I RWANDA MEDICAL SUPPLY Operational
00:33:58:08:F0:70 502322010024 R550 PEZ-Block-B2-Office1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:DB:20 252373003471 R350 WAREHOUSE-AP-1 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:D6:20 252373003391 R350 WAREHOUSE-AP-4 RWANDA MEDICAL SUPPLY Operational
A8:0B:FB:01:CE:80 272322002985 R550 INBOX-AP-3 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:30:DA:80 252373003461 R350 INBOX-AP-4 RWANDA MEDICAL SUPPLY Operational
00:E6:3A:17:E3:A0 252373001207 R350 PEZ-Block C Stock 2 RWANDA MEDICAL SUPPLY Operational