Enterprise network design: segmentation, redundancy, documentation
Starting from requirements you design an organisation’s network — address plan, security zones, redundancy and documents — then build and test it in the lab.
Level 401 · 18 lessons · 15 practice labs
Lessons
Requirements
- Gathering requirements: users, applications, growth
- Hierarchical design: access, distribution, core
- Address and VLAN planning at scale
- Short task: write a requirements document for a company
Security zones
- Security zones and the DMZ
- Micro-segmentation and east–west traffic
- A separate management network and jump host
- Separate segments for IoT and industrial devices
- Short task: draw up the inter-zone permission matrix
Resilience
- Redundancy patterns and single points of failure
- WAN design: links, VPNs and the SD-WAN idea
- Capacity planning
- Short task: test your design against five failure scenarios
Documentation and change
- Network diagrams: physical and logical
- A single source of truth: inventory with NetBox
- Change management and rollback plans
- Short task: prepare a change plan for a VLAN change
Wrap-up
- Capstone: design, build and defend the network of a 200-person company
Practice labs
- A requirements list from interview notes: Write a requirements document for Piril Bakery that pulls user counts, applications, growth and availability needs out of the messy interview notes.
- Three floors, five departments: address and VLAN plan: Prepare a summarisable address and VLAN plan for the given user counts and two years’ growth, and apply part of it to the lab switch and router.
- Two merging companies have overlapping addresses: Compare renumbering and NAT options for two company networks using the same private block, pick one, apply the migration step in the lab and show access between the networks.
- Move the web server into a DMZ: Move the web server from the internal network into a DMZ, write rules allowing access only in the required directions and test permitted and forbidden connections.
- The matrix on paper versus the real rules: Compare the given inter-zone permission matrix with the firewall’s current rules, find the three that disagree, fix them and verify every cell with a test.
- The servers are too open to each other: Derive the east–west traffic in Harborview Hospital’s data centre from flow data, build a micro-segmentation policy from the connections that are really needed and show the applications still work.
- Management only from the jump host: Make the network devices’ management interfaces reachable only from the jump host and show an SSH attempt from a user machine being blocked.
- The cameras can see the whole network: Move Orchid Hotel’s IP cameras into a separate segment, let them reach only the recording server and prove that traffic to other targets is dropped.
- Factory machines on the office network: Design a zone separating Demirhan Machinery’s production devices from the office network, define the necessary one-way data flows, apply the rules and limit maintenance access to the jump host.
- Find the single points of failure: Review the lab network’s diagram and configuration, list the single points of failure and tabulate the impact and suggested redundancy for each.
- Test the design against five failures: Create a link, router, switch, DNS and DHCP failure one at a time in the lab network, measure the affected services each time and report whether the design meets expectations.
- The branch link is not enough: Derive the growth trend from Selvi Schools’ branch traffic measurements, write a proposal comparing link capacity and backup VPN options on cost and risk, and build the backup path in the lab.
- Draw the network’s logical diagram: Draw an accurate logical network diagram from the address, VLAN and route information you collect from the lab devices, marking each subnet’s gateway.
- The inventory does not match reality: Compare the device, interface and address records in NetBox with the live network, fix the missing and wrong entries and produce an audit output listing the differences.
- A plan and rollback for a VLAN change: Write a step-by-step change plan, verification tests and rollback plan for moving a Windy Ridge Energy department to a new VLAN, carry out the change in the lab and rehearse the rollback at one step.
About this course
Starting from requirements you design an organisation’s network — address plan, security zones, redundancy and documents — then build and test it in the lab.
What you will learn
- Requirements
- Security zones
- Resilience
- Documentation and change
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.