Self-directed small enterprise network infrastructure build for Margielos, focused on segmentation, high availability, secure administration, and repeatable validation.
- Full design and implementation notes: docs/Network_Documentation.md
- Validation plan and results: docs/validation.md
- Operations and troubleshooting: docs/runbook.md
- Device configurations: configs/
- Evidence outputs (show commands, screenshots): evidence/
- 10 routed VLANs plus VLAN 999 (native/blackhole) on a collapsed-core dual-switch design
- Redundant default gateways using HSRPv2 across two routers (VIP
.1per VLAN) - Inter-VLAN routing and policy via 802.1Q subinterfaces and router ACLs
- Internet edge using ASA PAT/NAT, with routers default-routing toward ASA transit networks
- Central services via dual Windows DCs providing AD DS, DNS, and DHCP with
ip helper-address - Operational readiness: validation artifacts, evidence outputs, and a troubleshooting runbook
- Single-site small enterprise simulation (about 15 users) built in a lab environment
- Internet egress provided via upstream lab uplink; ASA outside addressing obtained via DHCP
- Design prioritizes realistic enterprise patterns and repeatable validation over provider-grade routing complexity
Logical topology
Physical topology
HSRP addressing convention per routed VLAN X:
- VIP (default gateway):
192.168.X.1 - R1:
192.168.X.2 - R2:
192.168.X.3
| VLAN | Name | Subnet | Default Gateway (VIP) |
|---|---|---|---|
| 10 | SALES_CS | 192.168.10.0/24 | 192.168.10.1 |
| 20 | WAREHOUSE | 192.168.20.0/24 | 192.168.20.1 |
| 30 | HR_MGMT | 192.168.30.0/24 | 192.168.30.1 |
| 40 | IT | 192.168.40.0/24 | 192.168.40.1 |
| 50 | MARKETING_ECOM | 192.168.50.0/24 | 192.168.50.1 |
| 60 | PROD_FLOOR | 192.168.60.0/24 | 192.168.60.1 |
| 70 | INFRA_MGMT | 192.168.70.0/24 | 192.168.70.1 |
| 80 | SERVERS | 192.168.80.0/24 | 192.168.80.1 |
| 85 | FINANCE | 192.168.85.0/24 | 192.168.85.1 |
| 90 | GUEST | 192.168.90.0/24 | 192.168.90.1 |
| 999 | BLACKHOLE / Native | N/A | N/A |
For full IP conventions, DHCP scope ranges, and routing policies, see:
- Segmentation policy with router ACLs
- Guest VLAN is internet-only
- Warehouse and Production are restricted east-west, with only required service access permitted
- Switch hardening
- Native VLAN 999 on trunks
- Unused ports placed in VLAN 999 and administratively shut
- PortFast + BPDU Guard on access ports
- Port-security on key access interfaces
- Secure administration
- SSH-only management with restricted access patterns
- HSRPv2 per VLAN with:
- R1 preferred Active (priority 110, preempt enabled)
- R2 standby (priority 100)
- Upstream tracking on R1 for WAN failure failover behavior
- MD5 HSRP authentication on groups
AnyConnect remote-access VPN is documented with lab environment constraints (outside interface reachability varies due to DHCP-provided upstream addressing).
Out-of-scope note: a Tailscale overlay was used during development for remote lab access continuity and is not part of the baseline network design or validation evidence.
Validation outputs are documented and supported by evidence artifacts, including:
- HSRP state and failover checks
- Trunks and EtherChannel verification
- ACL segmentation behavior tests
- DHCP relay behavior across VLANs
- NAT/PAT behavior at the edge
See:
Quick “show” commands used in validation
show standby briefshow etherchannel summaryshow interfaces trunkshow ip interface briefshow ip routeshow access-listsshow nat(ASA)
Exact command outputs are stored in evidence/.
Show details
The baseline build was implemented on real Cisco/VM infrastructure (IOS + Windows Server + ASA).
This Packet Tracer extension is a planned replica used to demonstrate and validate additional network controls (“extras”) without changing the completed baseline environment.
- Implement centralized DHCP in Packet Tracer (Server-PT/router DHCP) and validate DHCP relay across VLANs.
- Implement DHCP Snooping with a clear trust boundary (trusted trunk/uplink, untrusted access).
- Implement Dynamic ARP Inspection (DAI) using DHCP Snooping bindings and validate against ARP spoofing.
- Add a basic QoS policy (classification + prioritization) and document verification outputs.
- Add a simulated branch LAN to meaningfully evaluate OSPF route exchange and convergence.
Where it will live: