Skip to content
QYChan Qing Yee
CV
Menu
Open to Singapore rolesDownload CV
← all projects

Enterprise network design

University coursework · 4-person team project

SECR 3242 Internetworking Technology · UTM, Semester 1 2024/25

case-study subject · Sunray Construction & Interior Sdn Bhd

A comprehensive network design for a Malaysian SME, built and verified in Cisco Packet Tracer: 8 routers across 7 departmental segments, OSPF as the interior routing protocol, VLAN-segmented staff floors, a DHCP-relayed address plan, an IPsec remote-access VPN, and ACLs that keep remote workers out of Finance and the Executive Office.

8
Routers
7
Segments
8
DHCP pools
2
VLANs
Cisco Packet TracerOSPFVLANsACLsIPsec VPNDHCP

// the brief

The brief was to act as a network consulting team for a Malaysian SME and deliver a secure, scalable design covering core and edge routing, Layer 2 segmentation, wireless and remote access, and a defensible security posture. The company — a construction and interior design firm with departments that hold very different sensitivities — was the case-study subject rather than a real client.

// topology

Two cores, seven segments, one way out

Every department hangs off its own router; the two cores carry traffic between them over a /30 link. The firewall and the Internet router sit deliberately outside the OSPF area, reached by static routes, so internal topology is never advertised outward.

  1. internet edge

    outside OSPF · static routes

    Internet server

    209.165.0.2

    Internet router

    Firewall

  2. core

    OSPF process 10 · area 0 · 192.168.6.0/30 between cores

    Core MR1

    Core MR2

  3. staff floors

    via core switch · 802.1Q trunk

    Staff Room 1

    VLAN 10 · 192.168.0.0/28

    Staff Room 2

    VLAN 20 · 192.168.0.16/28

  4. segments on MR1

    Executive Office

    192.168.4.0/24

    Remote Access

    192.168.5.0/24

  5. segments on MR2

    Finance

    192.168.1.0/24

    IT Department

    192.168.2.0/24

    Server Room

    192.168.3.0/24

// logical topology — department routers and per-room access switches collapsed into their segment

// the address plan

Seven segments, sized to what they hold

Each department sits in its own subnet behind its own router, so a fault or a filter applies to one segment rather than the whole estate. Router-to-router links are carved out of 192.168.6.0/24 as /30s — two usable addresses per point-to-point link, no waste.

  • Staff Room 1

    subnet
    192.168.0.0/28
    gateway
    192.168.0.1

    General employee floor on VLAN 10. A /28 caps it at 16 addresses — sized to the room rather than handed a wasteful /24.

  • Staff Room 2

    subnet
    192.168.0.16/28
    gateway
    192.168.0.17

    Second employee floor on VLAN 20, isolated from VLAN 10 at Layer 2 and routed only through the core.

  • Finance

    subnet
    192.168.1.0/24
    gateway
    192.168.1.1

    Financial records. The most restricted segment — guarded by a standard ACL applied outbound on the core.

  • IT Department

    subnet
    192.168.2.0/24
    gateway
    192.168.2.1

    Network operations and vulnerability management for the estate.

  • Server Room

    subnet
    192.168.3.0/24
    gateway
    192.168.3.1

    Hosts the DHCP and DNS server at 192.168.3.2 that every other segment relays to.

  • Executive Office

    subnet
    192.168.4.0/24
    gateway
    192.168.4.1

    CEO, Director, and Manager. Sensitive enough to be an explicit ACL destination alongside Finance.

  • Remote Access

    subnet
    192.168.5.0/24
    gateway
    192.168.5.1

    Work-from-home laptops over IPsec VPN, plus 802.11ac/b/g/n wireless clients on site.

// design decisions

Six choices that shape the network

routing

OSPF everywhere inside, static at the edge

A single OSPF area 0 runs across all seven internal routers, so paths survive a link failure. The Internet router is deliberately excluded and reached statically instead.

  • Keeping the edge out of OSPF means internal topology is never advertised to an external device.
  • The core originates a default route into the domain, so every internal router learns one way out.
  • Each department sits behind its own router, distributing forwarding load rather than concentrating it.

layer 2

VLAN segmentation with router-on-a-stick

The two staff rooms are separate broadcast domains — VLAN 10 and VLAN 20 — trunked to the core switch and routed by subinterfaces on the main router.

  • Access ports pinned to their VLAN in access mode so they cannot negotiate a trunk.
  • Trunk links restricted with an explicit allowed-VLAN list rather than passing every VLAN.
  • Inter-VLAN routing on tagged subinterfaces, each owning its /28 gateway; PVST keeps the switched core loop-free.

addressing

Centralised DHCP with relay agents

One server in the Server Room serves eight named pools, with every remote router relaying so broadcasts reach it across routed boundaries.

  • A helper address on each department-facing interface forwards DHCP to 192.168.3.2.
  • Pool masks are sized per segment: /24 for the large departments, /28 for the staff rooms.
  • DNS is handed out uniformly across all pools for consistent name resolution.

remote access

IPsec remote-access VPN

Work-from-home staff terminate an IPsec tunnel on the main router, authenticated per user and given an address from a dedicated VPN pool.

  • ISAKMP negotiating AES-256 with Diffie-Hellman group 5 and a 3600-second rekey.
  • ESP pairing AES encryption with SHA integrity, so tampering is detected as well as prevented.
  • A dedicated pool is what makes clients addressable — and therefore filterable — as a group.

access control

ACLs that assume the remote user is untrusted

Two ACLs enforce least privilege from different directions: an extended ACL on the remote-access router denies the VPN pool, and a standard ACL on the core admits only a named list into Finance.

  • The Finance ACL permits the Server Room, Executive Office, the transit links, and the Internet block; everything else falls to the implicit deny.
  • That permit list is legible in the test grid — the four sources that cannot reach Finance are exactly the four absent from it.
  • The VPN ACL denies the pool 192.168.3.100–.110 specifically, so it filters by allocated address rather than by segment.

perimeter

Firewall between the estate and the Internet

A dedicated firewall separates the estate from the Internet segment, with deliberately asymmetric rules in each direction.

  • Outbound: internal hosts may reach the Internet server freely.
  • Inbound: only the Internet server itself is permitted in — every other external host is refused.
  • Static routing across the firewall, since the edge intentionally sits outside OSPF.

// verification

Proving the denials, not just the reachability

Every source was ping-tested against every destination — 56 pairs, and the grid is the result. One column fails and the rest of the estate is clean, which is the whole argument of the design: the blocks are deliberate and narrow, not collateral damage from a broken route.

Remote Access

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — blocked
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

Executive Office

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — reachable
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

Server Room

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — reachable
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

IT Department

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — blocked
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

Finance

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — reachable
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

Staff Room 1

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — blocked
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable

Staff Room 2

  • RARemote Access — reachable
  • EXECExecutive Office — reachable
  • INETInternet — reachable
  • SRVServer Room — reachable
  • ITIT Department — reachable
  • FINFinance — blocked
  • SR1Staff Room 1 — reachable
  • SR2Staff Room 2 — reachable
✓ reachable✕ blocked by design· not tested
  • Finance is the only column with any denial in it — every other destination is reachable from everywhere.
  • The three sources that do get in — Executive Office, Server Room, and Finance itself — are exactly the ones named in the Finance ACL’s permit list.
  • The four that do not — Remote Access, IT, and both Staff Rooms — are absent from that list and fall to the implicit deny. The pattern in the column is the ACL, read back off the network.

// what I’d do next

  • Replace the pre-shared VPN group key with certificate-based authentication.
  • Move the flat area 0 into multiple OSPF areas with summarisation as the site grows.
  • Add switchport port-security and DHCP snooping to the access layer.
  • Log ACL denies to a syslog collector so blocked attempts are visible, not silent.

Happy to walk through the routing or the ACLs in an interview.

Get in touchqingyee0219@gmail.com