Skip to content
QYChan Qing Yee
CV
Menu
Open to Singapore rolesDownload CV
← all projects

Enterprise network design

University coursework · 4-person team project

SECR 3242 Internetworking Technology · UTM, Semester 1 2024/25

case-study subject · Sunray Construction & Interior Sdn Bhd

A comprehensive network design for a Malaysian SME, built and verified in Cisco Packet Tracer: 8 routers across 7 departmental segments, OSPF as the interior routing protocol, VLAN-segmented staff floors, a DHCP-relayed address plan, an IPsec remote-access VPN, and ACLs that keep remote workers out of Finance and the Executive Office.

8
Routers
7
Segments
8
DHCP pools
2
VLANs
Cisco Packet TracerOSPFVLANsACLsIPsec VPNDHCP

// the brief

The brief was to act as a network consulting team for a Malaysian SME and deliver a secure, scalable design covering core and edge routing, Layer 2 segmentation, wireless and remote access, and a defensible security posture. The company — a construction and interior design firm with departments that hold very different sensitivities — was the case-study subject rather than a real client.

// topology

Two cores, seven segments, one way out

Every department hangs off its own router; the two cores carry traffic between them over a /30 link. The firewall and the Internet router sit deliberately outside the OSPF area, reached by static routes, so internal topology is never advertised outward.

  1. internet edge

    outside OSPF · static routes

    Internet server

    209.165.0.2

    Internet router

    Firewall

  2. core

    OSPF process 10 · area 0 · 192.168.6.0/30 between cores

    Core MR1

    Core MR2

  3. staff floors

    via core switch · 802.1Q trunk

    Staff Room 1

    VLAN 10 · 192.168.0.0/28

    Staff Room 2

    VLAN 20 · 192.168.0.16/28

  4. segments on MR1

    Executive Office

    192.168.4.0/24

    Remote Access

    192.168.5.0/24

  5. segments on MR2

    Finance

    192.168.1.0/24

    IT Department

    192.168.2.0/24

    Server Room

    192.168.3.0/24

// logical topology — department routers and per-room access switches collapsed into their segment

// the address plan

Seven segments, sized to what they hold

Each department sits in its own subnet behind its own router, so a fault or a filter applies to one segment rather than the whole estate. Router-to-router links are carved out of 192.168.6.0/24 as /30s — two usable addresses per point-to-point link, no waste.

  • Staff Room 1

    subnet
    192.168.0.0/28
    gateway
    192.168.0.1

    General employee floor on VLAN 10. A /28 caps it at 16 addresses — sized to the room rather than handed a wasteful /24.

  • Staff Room 2

    subnet
    192.168.0.16/28
    gateway
    192.168.0.17

    Second employee floor on VLAN 20, isolated from VLAN 10 at Layer 2 and routed only through the core.

  • Finance

    subnet
    192.168.1.0/24
    gateway
    192.168.1.1

    Financial records. The most restricted segment — guarded by a standard ACL applied outbound on the core.

  • IT Department

    subnet
    192.168.2.0/24
    gateway
    192.168.2.1

    Network operations and vulnerability management for the estate.

  • Server Room

    subnet
    192.168.3.0/24
    gateway
    192.168.3.1

    Hosts the DHCP and DNS server at 192.168.3.2 that every other segment relays to.

  • Executive Office

    subnet
    192.168.4.0/24
    gateway
    192.168.4.1

    CEO, Director, and Manager. Sensitive enough to be an explicit ACL destination alongside Finance.

  • Remote Access

    subnet
    192.168.5.0/24
    gateway
    192.168.5.1

    Work-from-home laptops over IPsec VPN, plus 802.11ac/b/g/n wireless clients on site.

// design decisions

Six choices that shape the network

routing

OSPF everywhere inside, static at the edge

A single OSPF process (area 0) runs across all seven internal routers so paths are learned dynamically and survive a link failure. The Internet router is deliberately excluded and reached by static routes instead.

  • Keeping the edge out of OSPF means internal topology is never advertised to an external device.
  • The core originates a default route into the domain, so every internal router learns one way out.
  • Each department sits behind its own router, distributing forwarding load rather than concentrating it.

layer 2

VLAN segmentation with router-on-a-stick

The two staff rooms are separate broadcast domains — VLAN 10 and VLAN 20 — trunked to the core switch and routed by subinterfaces on the main router.

  • Access ports pinned to their VLAN in access mode so they cannot negotiate a trunk.
  • Trunk links restricted with an explicit allowed-VLAN list rather than passing every VLAN.
  • Inter-VLAN routing on tagged subinterfaces, each owning its /28 gateway.
  • PVST keeps the switched core loop-free.

addressing

Centralised DHCP with relay agents

One DHCP server in the Server Room serves eight named pools — one per segment — with every remote router configured as a relay agent so broadcasts reach it across routed boundaries.

  • A helper address on each department-facing interface forwards DHCP to 192.168.3.2.
  • Pool masks are sized per segment: /24 for the large departments, /28 for the staff rooms.
  • DNS is handed out uniformly across all pools for consistent name resolution.

remote access

IPsec remote-access VPN

Work-from-home staff terminate an IPsec tunnel on the main router, authenticated per user and assigned an address from a dedicated VPN pool.

  • ISAKMP policy negotiating AES-256 with Diffie-Hellman group 5 and a 3600-second rekey lifetime.
  • ESP transform set pairing AES encryption with SHA integrity, so tampering is detected as well as prevented.
  • A dynamic crypto map with reverse-route injection adds each client’s route as it connects.
  • Clients draw from a dedicated pool, which is what makes them addressable — and therefore filterable — as a group.

access control

ACLs that assume the remote user is untrusted

Two complementary ACLs enforce least privilege: one stops VPN clients reaching the sensitive departments, the other allows only known sources into Finance.

  • An extended ACL on the remote-access router denies the VPN pool to both the Finance and Executive Office subnets, then permits everything else.
  • A standard ACL applied outbound on the core permits only the Server Room, Executive Office, transit links, and the Internet block into Finance — everything else falls to the implicit deny.
  • Remote users keep access to general resources; only the sensitive segments are withheld.

perimeter

Firewall between the estate and the Internet

A dedicated firewall separates the internal network from the Internet segment, with asymmetric rules in each direction.

  • Outbound: internal hosts may reach the Internet server freely.
  • Inbound: only the Internet server itself is permitted in — every other external host is refused.
  • Static routing across the firewall, since the edge intentionally sits outside OSPF.

// verification

Proving the denials, not just the reachability

Every segment pair was ping-tested from end to end. The interesting result is the one that fails: a VPN laptop cannot reach Finance, while an Executive Office host on the same destination succeeds — which is exactly what the ACLs were written to do. A design is only proven when the denials are demonstrated, not just the reachability.

  • VPN laptop → Executive Office

    Reachable — the remote user still gets general access.

  • VPN laptop → Server Room

    Reachable across the OSPF domain.

  • VPN laptop → Staff Rooms 1 & 2

    Inter-VLAN routing works from off-site.

  • VPN laptop → Internet

    Egress through the firewall succeeds.

  • VPN laptop → Finance

    Denied by design — host unreachable, returned by the ACL on the remote-access router.

  • Executive Office → Finance

    Permitted by the Finance ACL — proving the block is source-specific, not a broken route.

// what I’d do next

  • Replace the pre-shared VPN group key with certificate-based authentication.
  • Move the flat area 0 into multiple OSPF areas with summarisation as the site grows.
  • Add switchport port-security and DHCP snooping to the access layer.
  • Log ACL denies to a syslog collector so blocked attempts are visible, not silent.

Happy to walk through the routing or the ACLs in an interview.

Get in touchqingyee0219@gmail.com