Location

Customer Contacts

Organizational Information

Contract Information

Hosts at WGNHS (min point office) are split between the 144. and 10. subnets.  Ideally we want workstations on 10. and servers on the 144. network, but we have not completed this migration.  We do not clearly define a static and a DCHP range - you'll see reservations made throughout the whole DHCP pool on the 144.92 network.  The 10.128 network shouldn't have any static reservations or host records.  When decommissioning a server with a static IP it is important to remove old firewall rules so the next device with that IP is starting from a clean slate.

VPN access

WGNHS has a manifest group that allows access to RDP on the local subnets.  Users log into the Wisc VPN dynamic pool, but if they are part of the group they will be allowed access.  The manifest group is at https://manifest.services.wisc.edu/Group/Index/e183e7f6096a42808a5dde33e914fc6b. (uw:org:rads:wgnhs:WGNHS_VPN)

DoIT technicians can access the WGNHS networks via DS internal network (144.92.55.1/24)

Unifi Network Hardware

We have 2 unifi sites MoHo and MinPoint.  Both sites devices report to our controller (unifi.wgnhs.wisc.edu).

MoHo Site: 3 Access points.  Set to auto-update on 1st of the month.

MinPoint Site: 2 switches - both located in min point server rack.  Upgrades for these switches should be completed during quarterly server maintenance windows to avoid downtime.

Site-to-site VPN 

• We have a site to site wireguard VPN link between a PFsense VM at mineral point and a PFSense hardware firewall at Mount Horeb.  Static routes are configured on the MOHO side to route traffic from the MOHO_LAN to select resources on the WGNHS internal network, as well as the campus DC's. 
  • see attached photo for static routes
• Both pfSense machines automatically backup their configuration via netgate.  Configs can be recovered with hardware ID's and keys in the keepass. 
• The MoHo pfsense web interface (192.168.100.1) can be reached from the WGNHS internal network provided the workstation has a static route configured for 192.168.100.1/24 via 144.92.125.8.  A route also needs to be added on the MoHo side to enable traffic to the workstation.  The IT workstation WGS-CUTBANK is already configured and is the easiest way to access that firewall. 
• The moho pfsense firewall is also accessible via SSH.  Information on connecting and SSH keys are in the keepass.

Mount Horeb LAN

• MoHo LAN is DHCP with the pool at 192.168.100.10-200
• There is a ToughSwitch POE near the router that powers the 3 access points in the building.
  • NOT controlled via unifi. Login to the switch from WGS-CUTBANK at 192.168.100.5.  Creds in keepass.
  • Check for firmware periodically

Mount Horeb pfSense static routes for wireguard

Static routes for campus DC's and select WGNHS resources.

WGNHS data is stored primarily on M-S-STORAGE02. GeoBase is stored on WGS-GISDATA.  We utilize a DFS namespace and map network drives from \\ad.wisc.edu\wgnhs.  See the GPO for the current drive mapping.

Project Drives

The P: drive is heavily used by WGNHS.  By default every user has Read-Only access to all project folders.  Each project folder has a corresponding security group that will grant Write permissions to its respective folder.  When handling a P: drive folder creation request you will need to create both a new folder, and a new security group, and assign that group modify permissions on the folder. 

Wisconsin Geological and Natural History Survey (WGNHS)

WGNHS runs the majority of their own infrastructure on-site. 

Server Network Hardware

We have 2 ubiquiti switches in the server rack at Mineral Point to enable 10GB networking between hypervisors and the backup appliance.  These switches are owned and managed by us. The campus network equipment at the survey building on mineral point is in a cabinet in the basement.

ESXi Infrastructure

We use a VMware essentials license that covers 3 hosts w/ 6 sockets.  We do NOT have the capability to do High Availability, Powered-On V-Motion, or other more advanced features.  vCenter is not domain joined, credentials are in the WGNHS keepass file.  We are running vmWare v7 on all hosts.  The networking is straight forward  - all VM's and iDRAC's live on the 144.92.125.0/25 network and are secured w/ the campus firewall.

ProxMox Infrastructure

We have 1 proxmox host running M-S-UNIFI, WGS-Petrel and PBS (ProxMox Backup Service)

vmWare VMs

All VM's are in vSphere with the exception of M-S-UNIFI, WGS-Petrel and PBS which run on PEDIMENT.  See vCenter for a full list.  Not all of these machines are domain joined - reference the KeePass for credentials if AD creds do not work.

• Wisconsin Geological and Natural History Survey (WGNHS) Handling Information
• WGNHS - Server Infrastructure
• WGNHS - Server Maintenance
• WGNHS - Backups (Synology)
• [Link for document 140397 is unavailable at this time]