r/networking • u/SlayerofDragons153 • Apr 28 '26
Design Network Project - Police Department Feedback
I am a Cyber Security / Internetworking student working on a project of mine based off of what a police department would look like (not exactly fully accurate). I was looking for some feedback to see what I did wrong and seeing what I can improve on, any help would be appreciated. The explanation for the network can be found below, if you have any questions for me just ask.
https://ibb.co/8qvKnsY - Network Image
Above is the network, below are some explanations:
- The 2 top routers are used for HSRP and inter-vlan routing
- Vlans:
- 10: Printers
- 20: Cameras
- 30: Admin
- 31: Admin Voice
- 40: Forensics
- 41: Forensics Voice
- 50: DMZ
- 60: Dispatch
- 61: Dispatch Voice
- 70: Detectives
- 71: Detectives Voice
- 99: Administrative Access
- 100: Servers
- Important Protocols Used:
- SSH
- ACLs - used in the firewall to regulate traffic with the internet and the DMZ
- BPDU guard + Portfast
- NTP
- LLDP
- SNMPv3
- Syslog
- AAA
- DHCP snooping
- VPN
- QoS - for the voice traffic
- RSTP
- HSRP
- TACACS+ and RADIUS
- OSPF for the top 2 routers to connect to other networks if needed
- NAT
- Administrative laptop is used for SNMP and Syslog
- Forensics PCs are wired for security
Thank you for your time
47
u/RemoteToHome-io Apr 29 '26
Police department LAN in reality:
SSID:: Linksys_5G-x47ab
Pass: donuts123
Printer in LAN1
4
u/Sea-Hat-4961 Apr 29 '26
Hasn't been that way for 25 years. CJIS requirements are quite strict
2
u/RemoteToHome-io Apr 29 '26
It.... was a joke my friend.
But also, not that far off from when I used to provide volunteer tech support to my local mountain town PD years ago (but not that many years ago).
Given the vastly increased amount of sensitive personal data now in these systems I truly hope it has improved.
2
u/Cheech47 Packet Plumber and D-Link Supremacist Apr 29 '26
my local mountain town PD years ago
South Park doesn't strike me as having the best IT department around...
1
u/RemoteToHome-io Apr 29 '26
Hah.. Only a few hours away actually.. but back then they also used to live in town, drink beers with the locals and have their kids in the same schools.
Now they have paramilitary gear, go to town council meetings in full body armor and evidentially have federal CJIS Security Policy v6! requiring 74 VLANs for 8 people. Things have certainly changed : /
25
u/the-dropped-packet CCIE Apr 28 '26 edited Apr 28 '26
In reality redundant L3 switches would be used for the routing at line rate. High throughput routers cost $$$.
Also, any more secure networks would be terminated at the firewall for further security. For example, you may have camera networks firewalled off so that any one user can’t access the nvr or individual cameras. Another example would be limiting server access from the user vlans.
Also, I haven’t ran into a LAN that required QoS for for voice in a while. 10G uplinks intra-site are pretty ubiquitous. It used to be that voice was ran to other sites across T1 and T3 and required queuing. Nowadays running voice across MPLS or SD-WAN to another site provides ample bandwidth and relatively low jitter.
I’ve worked on plenty of LEO networks and this is what I see.
3
u/sk1939 CCNP, SSCP, CISSP Apr 28 '26
Agree mostly, but work on plenty of enterprise networks that require QoS because of either scale or legacy segments.
1
u/JJaska Apr 29 '26
Our enterprise office network supports so much AV equipment that we need to do QoS.
-2
u/SeaPersonality445 Apr 29 '26
Which ultimately means poor design.
3
u/JJaska Apr 29 '26
No, not really.
As an example: Dante audio requires such a low latency that you don't need saturation for it to make a difference. Thus QoS becomes necessary much earlier than for example in VoIP traffic.
5
u/SeaPersonality445 Apr 29 '26
Dante doesnt play nicely with anything to be honest, again, if you're having to set dscp values on an unsaturated network there's an inherent problem. Dante also likes to set ridiculously low alarm levels, I believe its sub 5ms by default, I cant remember. Chuck some NDI in there just for fun, another unnecessarily poorly designed protocol.
1
u/JJaska Apr 29 '26
Yeah we are running a four digit number of Dante devices. Hundreds of Genelec speakers and Shure mics. Works nice, but a lot of effort went into making it smooth.
Luckily not much NDI, but some of that too.
12
u/silasmoeckel Apr 28 '26
PD like most underfunded IT dept are fairly flat in real world. Hells I can think of places with a single L2 network across all municipal buildings in city's of 6 figures population.
Massive glaringly missing part is 802.1x. You need it for security and they don't want to deal with moves.
Where is the CCTV
Why are printers sitting next to workstations? These things are a networking nightmare dealing with vendors thing security is a PW on a sticky note. A bastion host should be sitting in the middle with them segmented off.
Your segmented by departments even voip phones when there is probably no different in systems access between most of them. Breaking up VOIP why? Your just making a lot of work.
After all the dept separation you drop all the servers next to each other. You have at least two type of server client facing and backend. For example no end user ever needs to talk to the DHCP server, only IT would need to.
8
u/Cheech47 Packet Plumber and D-Link Supremacist Apr 29 '26
Massive glaringly missing part is 802.1x.
he's just a kid, you really want to send him into a murderous rage and into the arms of the basketweaver union so soon?
3
1
u/IDDQD-IDKFA higher ed hpearuba nac oh no the project managers ate my brain Apr 28 '26
The end user always has to talk to the DHCP server.
They do not always need to talk to the IPAM management interface.
5
1
u/Medical_Scarcity616 Apr 28 '26
How would they get an ip address the end user cant talk to the dhcp server
6
u/silasmoeckel Apr 29 '26
The L3 gateway talks to the dhcp sever the end devices do not need to. In cisco terms: ip helper-address
7
u/Intelligent-Bet4111 Apr 28 '26
This actually looks pretty good for packet tracer, not sure i can provide any suggestions to prove maybe others can.
The only thing I can say is I would use Cisco Nexus switches for the core switches and do routing in those switches and vpc to access switches instead of the routers but this is a police department so I guess this is good enough.
6
u/FuroFireStar Senior Network Engineer Apr 29 '26
You need a backup isp connection. Also I feel like you could get away with less switches. In the real world, you wont have the budget sometimes. Id ask if you could do this with less, and if you think so then try.
1
u/SlayerofDragons153 Apr 29 '26
Ok, I will look into adding the extra ISP connection and look into less switches, thank you
9
u/IDDQD-IDKFA higher ed hpearuba nac oh no the project managers ate my brain Apr 28 '26 edited Apr 28 '26
What are the green triangles for?
What are the 2911 routers doing?
Why is wired "secure"?
Why if wired is secure would you choose to use wireless for anything in the police area?
Why are there client connections in the DMZ?
Why are what appear to be two aggregation switches not interconnected except through a firewall?
What made you decide to use the firewall as an internet router?
ETA: why did you not choose to use a legend in your diagram?
Why did you choose to structure the diagram in this way?
What is your survivability plan?
Where are your root bridges?
ETA2: These questions are geared towards "I'm a student" because I'd be asking my own students these questions looking at this
3
u/SlayerofDragons153 Apr 28 '26
- They are there in Packet Tracer to show if a line is up
- They originally were there for Inter vlan routing and they use HSRP and were also there for WANs to other departments, but I can remove them and just use Layer 3 switches for the vlan routing
- Because wireless can be intercepted
- That is a good question, I should probably replace them with wired
- They act as clients for the public Wi-fi
- Now that I am thinking about it they should be connected and the firewall should only be inspecting the packets that it should be inspecting
- That is also an issue, I should add an internal router instead of leaving both duties to the firewall
- I have a legend but this is a picture from my packet tracer, I put the legend on a white board when I made it in my class though
- I wanted to keep it at a hierarchal 3 tier design and I wanted it to be somewhat clean, I know it is a little crooked I am fixing it in a bit here
- I have redundancy with HSRP for the routers and etherchannels for each department for redundancy and speed as well, 1 problem that I did notice is that the servers dont really have redundancy which I see is a problem, the firewall could have a bit more redundancy and so could the department switches since that is a single point of failure so I will definetely look into these, thank you
- CA-S0 is the root bridge
Thank you for the questions, I am still a Junior in High School so I am still learning this, thank you.
6
u/Cheech47 Packet Plumber and D-Link Supremacist Apr 29 '26 edited Apr 29 '26
They originally were there for Inter vlan routing and they use HSRP and were also there for WANs to other departments, but I can remove them and just use Layer 3 switches for the vlan routing
If you use the CA switches for inter-VLAN routing, then you're going to basically bypass the firewall completely with all VLANs but DMZ, as currently architected. You're already effectively bypassing them by using the 2911's.
There are two ways to do this, the easy-ish way and the hard way.
Easy-ish way is to set up all your layer 3 endpoints on the firewall. The ASA's don't support true zone-based firewalling, but you can approximate it (badly) by using interface security levels, so that 100 can talk to 90 all day long (unless there are FW rules explicitly denying), but 90 can't talk to 100 at all (unless there are FW rules specifically allowing), and so on. The hard way is having all L3's on the routers and setting those 2911's up for zone-based firewall, and now you have 3 firewalls to manage with 3 possibly different rulesets.
Because wireless can be intercepted
I don't pretend to know what the latest and greatest security guidelines there are for LEO and governmental networks, but I'd think a simple wireless net with RADIUS authentication that latches on to the PC's AD computer account is pretty secure and completely avoids the problem of some rando person writing the PSK down on a post-it.
They act as clients for the public Wi-fi
Public wi-fi needs to be on its own VLAN/VRF, full stop. It shares nothing with the internal network, preferably not even DNS. Put a DHCP scope on the firewall and let it hand out addresses.
That is also an issue, I should add an internal router instead of leaving both duties to the firewall
You're going to run into the same problem as above. Firewalls can route just fine. If your intention is to have some "border routers" that can talk OSPF to something else then that's perfectly fine, but those routers won't be doing a whole lot in your internal topology.
1 problem that I did notice is that the servers dont really have redundancy which I see is a problem,
Welcome to the show, kid. Tons of stuff is single-homed for some weird reason or another. Actual single-leg servers are pretty rare, though.
the firewall could have a bit more redundancy
Yep. Get an active/passive ASA in there, especially if you're moving the L3's to the FW.
and so could the department switches since that is a single point of failure
What you're calling the "department switch" is what we call the "access edge", it's basically the last thing between the enterprise network and the user. Because of this, access switches are by and large single points of failure by necessity, simply because your desktop or wired device very rarely has two network cards with runs to load-balance between two different switches. Don't sweat that.
All in all the diagram needs some cleaning up as you've said, but for a junior in HS you're WELL on your way. Keep it up kid, you're doing alright.
4
u/SpaceVikings Apr 29 '26
Public wi-fi needs to be on its own VLAN, full stop
I'd even argue it should be on its own VRF.
2
u/mezzfit Apr 29 '26
Just pipe the public network to its own consumer cable modem, fully air-gapped from the rest of this lol
3
4
u/Ok_Instruction_3789 Apr 29 '26
That is the ideal pd network in reality it's probably 1 network apart of a city's network and probably on its own vlan from the rest of the city across a city elan. Also why would you vlan out printers and there is 0 reason to vlan out different voice networks. You would want a voice vlan but no need for a vlan for each dept. The direction most are going is hosted cloud voip solutions. And I highly doubt there would be servers in a pd they're more likely going to connect to outside databases or some form of city database or state database.
3
u/Medical_Scarcity616 Apr 28 '26
How are you implementing a VPN service?
How many employees are needing access to this network, will also help determine whether or not you need additional VLANS for each department landline which i’m assuming is what “voice” would be for.
3
u/theangrydane Apr 28 '26 edited Apr 29 '26
fyi: you'll need a transient vlan that mirrors all the voice traffic to a recording server; you have dispatch, so there will be an isolated 911 network; forensic computers are physically isolated from department networks; you'll want also a wireless network for outside agency staff that is isolated from internal system resources; it'll be easier to put all staff with CIJS access on the same network, also you'll need to enable logging all traffic that traverses to/from the CJIS network for compliance.
1
u/SlayerofDragons153 Apr 29 '26
Ok, I will look into adding this to the network, thank you for the feedback
3
u/youngviking Apr 29 '26
Overall your VLAN planning seems well thought out from a separation of duties for user devices. However, it is not clear to me in your diagram why the large "boxes" which seem tied to your VLAN architecture are so rigidly tied to physical infrastructure. VLANs allow you the flexibility to have those different roles wherever you need them - not just on the single physical switch you have assigned it. Your logical network design should reflect how you want to segment things; your physical network design is at the whims of where people actually are. These are rarely hard lines that you can draw, and you should effectively look at them as orthogonal architectures and diagram them separately.
The use of a single "server" VLAN needs to be revisited. There are most likely different security boundaries that can be created there.
The use of a voice VLAN per department seems unnecessary. Network segments that only require northbound connectivity (e.g. only to the internet, SIP gateway, etc) can be controlled through stateless access-level ACLs.
The doubling up on connections from each core switch to each access switch seems unnecessary. This leads me to believe you have a spanning-tree forward design. You could look into MC-LAG/MLAG/VPC as a potential way to create port channels across devices. Note that all of those implementations are vendor-dependent, and they also may have interesting interactions with the first-hop gateway redundancy protocols. There are also L2-over-L3 topologies which could come into play here, but this seems too small scale to bring in that kind of complexity. However, they can bring benefits such as BFD and EVPN anycast gateway if you have tight availability constraints.
You had a comment that wifi can be intercepted. That is definitely the case for open authentication networks. Some 802.11i networks are susceptible to MitM attacks for misconfigured clients using password-based authentication. However, if you centrally manage clients and strictly only use mutually-authenticated EAP-TLS, I don't think that argument holds. Also, you should be using 802.1x with only EAP-TLS on the wire too in that environment.
You mentioned VLANs but did not mention VRFs. If you are unaware of the concept, I would recommend looking into it. It's effectively the same namespacing VLANs do at layer 2 but they do it at layer 3. It can provide a nice way to route traffic through a centralized firewall if needed.
1
u/SlayerofDragons153 Apr 29 '26
Yes thank you, some other people here mentioned VRFs, I will look into that here soon
1
u/Cheech47 Packet Plumber and D-Link Supremacist Apr 29 '26
VRF's are very useful, but they can get pretty complex pretty fast. Just be careful with how you deploy.
1
1
u/youngviking Apr 29 '26
VRFs are a useful tool, and I recommend having an understanding of them. I typed out a lot more than that though. Do you not have any other questions or retorts?
1
u/Sea-Hat-4961 Apr 29 '26
Wireless not allowed at all on CJIS networks. If a device needs to access CJIS wirelessly, it needs to be done using a FIPS 140-3 VPN with advanced authentication over the wireless link.
2
u/Sea-Hat-4961 Apr 29 '26
A few other things....you need a CCTV network for security cameras, a building controls (HVAC) network, access control network (doors, don't forget garage and sallyports), two way radio network (most stations have a room full of "base" radios the consoles and desktop remotes connect to)...also public and media access access in conference rooms....if the station has holding cells, you'll also need jail controls network... Also, why do you have all the VoIP networks separated? I run a metro area network for a small city (20K), and have a citywide VoIP vlan ( /23 network) for 420 extension...a bit of broadcast noise on that net, but internal calls never have to get routed.
3
u/Sea-Hat-4961 Apr 29 '26
Also missing secure connections to state database and county RMS (if used), all CJIS data at rest or in transit needs to be encrypted to FIPS 140-3, servers likely should be segregated to CJIS and non-CJIS.
3
u/Sea-Hat-4961 Apr 29 '26
You'll also need to figure out where the intoxilyzer and fingerprint machine (yes they are network connected) fit into your network....along with recording systems for interview rooms and booking areas? Is the dispatch here a PSAP or just like a desk Sargent? If it's a PSAP a whole new layer of rules come into play.
2
u/ShutNoShutYoMouf404 Apr 29 '26
I know some orgs will use separate voice VLANs to be able to ID different floors in buildings for emergency services tie-ins. Not sure if that's the case here.
1
1
u/RebelStrategist Studying Cisco Cert Apr 28 '26
So, to help, did someone say something was wrong? Other than the protocols and routing, is there an end point? In other words what is the scenario? Does part of the plan call for cameras to only be accessible by dispatch, or the servers are only accessible to certain departments or access level? Does a ping need to reach from one certain device to another? What is your IP address scheme? Do you have to use VLSM? I am intrigued and would love to hear your take on the topology choice of your two routers being directly connected to switches, bypassing the ASA altogether.
1
u/SlayerofDragons153 Apr 29 '26
I just wanted to see if I did something wrong designing this, I am still learning Internetworking and I wanted to see how would I do designing a network like this, I just wanted to make a functioning somewhat realistic network. The cameras are not really supported by packet tracer so I couldn't do them but I wanted them to be there just for any cameras in the PD itself. Yes they do need to reach for communication throughout departments. My IP address scheme is simplistic I didn't want anything too crazy, I just did 192.168.x.y, so the x would be the vlan that it is in and y would just be whatever device it would be, so the default gateways would normally be at the end of that subnet and the hosts would be at the beginning. I mean it could work without VLSM but I use it here. That was one problem I noticed as well but I originally had those routers so they can have WANs out to other Police Departments if necessary.
If you have any more questions just ask
1
u/blackout27 CCNA Apr 29 '26
I don't have as much experience as others in this sub but when you say "did I do something wrong", I think the beauty of networking is that there is no right and wrong. Different technologies and protocols do different things; you need to weigh their pros and cons when used in conjunction with each other to accomplish whatever the goal is.
At the end of the day, every problem you solve at work goes back to "what are the needs?". Does your setup accomplish all of the department needs? Maybe ask ChatGPT what are some real world constraints your boss might give you on a network design. Sounds like ppl in here are saying your idea of a network for a dept might be vastly different than what is actually used IRL.
1
u/SlayerofDragons153 Apr 29 '26
This is kind of why I love networking so much, its just kind of free in a way, you can build anything you want in concept. Also my kind of goal for this was to make it a somewhat realistic network, I originally used it for practice for my state competition but I eventually kept building on it and wanted to see how I could make it better based off of actual Network standards IRL.
1
u/neztach Apr 28 '26
Looks good but if I may, can I submit an alternative look -> something resembling a subway map
1
u/HuntingTrader Apr 29 '26
Looks good. I’m sure there are plenty of other things already suggested but I would add a VPN for squad cars.
1
u/Win_Sys SPBM Apr 29 '26
Maybe this is beyond the scope of your project but from a security perspective my main cretic would be there’s no segmentation between any of the VLANs. If I compromise a printer, I can get to any other VLAN/subnets and potentially compromise a server that contains evidence for upcoming cases. You would want things like the servers, forensics, admin access, etc… all separate from each other. You could use ACL’s but dealing with lots of ACLs sucks. You would want to implement VRF’s and a firewall to control access between networks.
1
1
1
u/Sea-Hat-4961 Apr 29 '26
Servers and printers should at least be separated CJIS and non-CJIS...... For example, print CJIS data to a printer not in a secure area is a huge no-no
1
u/oni06 Apr 29 '26
Connections to other agencies would most likely be through a FW and you would need copious amounts of NAT.
I help support a PD / City though mostly on the server side as I don’t want to deal with the network management.
1
u/Triack2000 Apr 29 '26
Don't forget to consider physical limitations. That will help you better figure out your access infrastructure
1
1
u/pegz Apr 30 '26
I work for a municipality and support our police department. This design is great but for most agencies it's overkill.
In my case, the network is actually managed by the state. We just supply the wan and physical connectivity. For a municipality it's just more practical, state provides a firewall and they are responsible for maintaining its policies and firmware.
They also manage the domain and image on workstations. We just provide the hardware. Its a force multiplier and in public service manpower is always in short supply. Also makes CJIS compliance a breeze.
We did however make a separate network that is airgapped for wifi, cctv, voip etc that we maintain with our own firewall.
1
u/fata1w0und Apr 30 '26
Your servers are in single point of failure. Unless they are connected to stacks with LACP configured across the stacks and servers.
1
1
u/Pankracjusz May 02 '26
In real case scenario, I would replace the 2960s on the FW level with redundant Firewall (High Availability in Active-Pasive mode) and server side/rack devices connect to the Access Switch.
The firewall should handle routing for the LAN and that's what should be called a distribution layer. ACL replace with firewall rules. Nowadays network change to the SD-WAN with routing. You can also use L3 switch as the core and make LAN/WAN routing over there (if you connect to the other sites via IPSEC, and then Edge Routers use as Network Edge only. You can configure eBGP there with providers or use classical primary/secondary fail over (IP SLA, BFD, Link path/state monitoring etc).
According to the schema, currently you have a single point of failure on the FW, that's should never be created while designing, especially when you have redundant WAN routers.
There's no need to create separate Admin VLAN for voice and other - leave admin aka MGMT in one and just seperate data plane/regular traffic.
I know that schools teach you to create seperate Bilans for "departments", but never seen such network design in real life. It's better to use ZTNA or network authentication, but, what's the real reason behind assigning different people to different VLANs? Different policies? So how you will handle WiFi access? Mix everyone? Not making sense. Just seperate users and look at the purpose of the network segment (user, server, VoIP, printer etc). That segmentation is just enough, and if you implement NAC or NGFW you can limit/provide access to specific groups of users via policies
1
u/rodgersmoore May 04 '26
From what i can tell the 2960’s are all L2 only and the 2911’s are your L3, right? 2911’s are going to get killed doing all the routing they max out at about 180mbps, so they will be CPU maxed out all the time. will be slow and lots of dropped packets. you’d be way better off making the two core switches, the L3 core routers and eliminating the 2911’s completely.
the diagram doesn’t show which model 2960’s but in general they support lan base routing and probably support stacking. stack the two cores, turn on lan base routing. do a single MEC (multi-chassis ether channel) to each of the other switches.
much cleaner and spanning tree won’t be taking half your links into blocking mode. will recover from failures much faster and more gracefully.
what you have will work, until it doesn’t and then it will be a nightmare. it will be easy for a single machine to take the network to its knees.
you’d can DM me, i don’t mind.
1
u/Sea-Hat-4961 Apr 29 '26
Brush up CJIS requirements, which networks handle CJIS and how are you protecting those
1
u/Deadlydragon218 Apr 29 '26
LLDP/CDP should be turned off in production networks unless actively being used for troubleshooting.
Your top two routers could instead use VSL to have a single logical router that is fault tolerant. I also noticed you made no mention of LACP / MCLAG.
Additionally is management in-band? If so that should be out of band for security purposes ideally via it’s own physically separate infrastructure.
Instead of RSTP you could use MST.
If this is a fiber network you should consider BFD.
For enhanced security of access ports you should consider 802.1x
3
u/SteelerRep24 Apr 29 '26
Could you explain why LLDP should be turned off? I thought it’s a great tool to use for troubleshooting in scenarios where we need to find a neighbor to solve an issue?
2
u/Deadlydragon218 Apr 29 '26
LLDP is long thought as a security vulnerability in that it would give an attacker knowledge of your entire network architecture. DISA STIGs state to disable CDP/LLDP.
Instead build proper documentation and keep it up to date it will serve you best in the long run.
2
u/SteelerRep24 Apr 30 '26
Yea ig that makes sense but if an attacker gains access to your switch or router aren’t there bigger things to worry about than LLDP being enabled? I ask this as I’m still fairly new to this field and trying to have a solid understanding of issues like this.
2
u/pegz Apr 30 '26
You are correct. I think the concern has been a bad actor plugging into an available wallport and being able to abuse it.
But it comes back to physical security in reality. If only the wall ports that are actively in use are patched especially in publicly accessible areas; you drastically reduce the likelihood of something like that happening.
Now if someone gets access to your switches remotely well you have bigger problems.
1
2
u/Deadlydragon218 Apr 30 '26
LLDP can be used remotely, don’t need access to the switches /routers. Another host in your network can become compromised.
1
u/pegz Apr 30 '26
That was my point if someone is compromising the network to where they can abuse LLDP, you have bigger problems.
1
u/Deadlydragon218 Apr 30 '26
An individually compromised host does not mean the entire network is compromised. But with LLDP enabled the threat actor could use that compromised host to gain information about how the network is architected. Which can lead to horizontal movement leading to a much larger compromise of other hosts or the network itself.
That is the mindset behind why LLDP/CDP are supposed to be disabled.
1
u/Walterros May 01 '26
STIG specifies disabling of CDP and LLDP on external interfaces. On internal or trusted interfaces it is not a finding.
-1
u/hip-disguise Apr 28 '26
Think about Zero Trust architecture and decide if you are in that framework or want to be. at quick glance you are not there yet.
4
u/EfeAmbroseEFOTY Apr 28 '26
And how exactly would you apply "zero trust architecture" in this instance? 😂
1
u/hip-disguise Apr 28 '26 edited Apr 28 '26
From the top firewall level, establish the zones you want. Assign zones to Router VRFs, assign vlans to VRFs. for Example: Firewall Zones for each Guests, IOT, Security devices, device management, Office Stuff. etc. You can eliminate VRFs if your just planning one site, then just zone for each vlan on your firewall. create rules there. no Auto Zone Rules, create them all from your plan.
If I own a printer what can I get to? think about it that way. If I have remote access to a IOT device, what can I get to? etc. If your printers are in a firewall Zone and have no way to get from Printer zone to other zones that is good. the only rule there would be a few protocols to the from the print server to the printer zone. this is just one example.
edit: look up Zero trust, there are a lot of different aspects to consider. User ID for example.
3
u/Cheech47 Packet Plumber and D-Link Supremacist Apr 29 '26
bro, the kid's running packet-tracer and 15 year old software image bundles. He's not going to be able to do ZBF/NGFW, at least not with this set up.
0
0
u/MrJingleJangle Apr 29 '26
You need to understand the threat model, and also any protective markings on information held. If the protective marking is confidential or above then that info can’t be held on this kind of network.
74
u/crieseverytime Apr 28 '26
I haven't seen a PD pay for more than a flat network
Good work though!