🛠 Project 05 — Secure Small-Business Network Design¶
Type: Design document + partial Packet Tracer build Modules: 09 (Risk), 10 (Security in Network Design), 08 (VLANs) Difficulty: ⭐⭐⭐⭐
🎯 Objective¶
Design a defense-in-depth network for a small business: segment with VLANs, isolate public servers in a DMZ, filter traffic with ACLs/firewall rules, and produce a hardening checklist.
🧭 Scenario¶
Bright Retail (30 staff) needs a network that supports staff, guests, point-of-sale (POS), and a public web/email server — without letting a breach in one area reach the others.
🔹 Zones¶
| Zone | VLAN/Segment | Notes |
|---|---|---|
| Staff | VLAN 10 | Internal users |
| POS | VLAN 20 | PCI-sensitive, tightly restricted |
| Guest Wi-Fi | VLAN 30 | Internet only, isolated |
| Servers (DMZ) | Screened subnet | Public web/email |
| Management | VLAN 99 | Device admin only |
📌 Part A — Design Document¶
Produce a design covering:
- Logical diagram — zones, firewall, DMZ, Internet edge.
- Addressing plan — a subnet per zone (reuse Project 01 method).
- Traffic policy matrix — what each zone may reach:
| From To | Staff | POS | Guest | DMZ | Internet |
|---|---|---|---|---|---|
| Staff | — | ❌ | ❌ | web only | ✅ |
| POS | ❌ | — | ❌ | ❌ | payment host only |
| Guest | ❌ | ❌ | — | ❌ | ✅ |
| DMZ | ❌ | ❌ | ❌ | — | ✅ (replies) |
- Hardening checklist (see below).
📌 Part B — Partial Build (Packet Tracer)¶
- Create the VLANs and inter-VLAN routing.
- Place a "web server" in the DMZ segment.
- Apply ACLs implementing the policy matrix (e.g., permit Staff→DMZ:80/443, deny Staff→POS).
- Verify allowed flows succeed and denied flows fail.
📌 Hardening Checklist¶
- Change all default credentials; disable unused accounts.
- SSH (not Telnet) for management; management on VLAN 99 only.
- Port security on access ports; shut unused ports.
- DHCP snooping + Dynamic ARP Inspection enabled.
- Non-default native VLAN; DTP disabled on trunks.
- WPA3/WPA2-Enterprise on staff Wi-Fi; guest on isolated VLAN with a captive portal.
- Implicit deny verified at the end of each ACL.
- Logging to a central syslog/SIEM; MFA on remote access.
- Tested 3-2-1 backups.
✅ Verification¶
- Staff can reach the DMZ web server on 80/443 but cannot reach POS.
- Guest reaches the Internet but nothing internal.
- Management interfaces are unreachable from user VLANs.
📦 Deliverables¶
- Design document (diagram + addressing + policy matrix).
- Packet Tracer file (local) with ACLs.
- Completed hardening checklist with notes on residual risk.
See also notes: [[10-04-secure-network-design]], [[10-01-firewalls-and-acls]], [[09-01-security-concepts]]