Bằng cách xem xét lại ngay bây giờ với định dạng này câu hỏi khó khăn hơn, bạn có thể thực hiện bộ nhớ của bạn tốt hơn và chứng minh kiến thức của bạn về khái niệm và thực tế của chương này. Các câu trả lời cho những câu hỏi này được tìm thấy trong Phụ lục A. Để biết thêm | 250 Chapter 15 Designing Medium-Sized SAFE Networks Design Alternatives The Campus module discussed in the previous section can have the following alternative designs If the medium-sized network is small enough the access or building switches can be removed. The removed Layer 2 functionality is then provided by connecting the devices directly to the core switch. Any private VLAN configuration that is lost with the removal of the access switches is offered by the core switch and still mitigates against trust-exploitation attacks. The external NIDS appliance can be replaced by an integrated IDS module that fits into the core switch. This configuration option offers increased performance benefits because the IDS appliance sits directly on the backplane of the switch. If performance is not an issue it is possible to replace the Layer 3 switch with a Layer 2 switch and provide inter-VLAN routing by use of an external router. WAN Module in Medium-Sized Networks The inclusion of the WAN module in the medium-sized network design is feasible only if there is a requirement to connect to a remote site using a private circuit such as Frame Relay or ATM. The design of a WAN module includes only one device a Cisco IOS Firewall router which provides routing access-control and QoS mechanisms to remote locations. The WAN module and its associated components is shown in Figure 15-6. Figure 15-6 Medium-Sized Network WAN Module To Campus Module Mitigating Threats in the WAN Module The expected threats on the WAN module and the mitigation actions to counter them are outlined in Table 15-8. Table 15-8 Threats Against WAN Modules and Threat Mitigation Threat Threat Mitigation IP spoofing Mitigated by using Layer 3 filtering on the router Unauthorized access Mitigated by using simple access control on the router which can limit the types of protocols to which branches have access Branch Versus Headend Standalone Considerations for Medium-Sized Networks 251 Figure 15-7 shows the .
