Network Design Capstone Project

The Brief

You have been hired as the network engineer for Acme Corp a 50-person company that just moved into a new office. They have three departments, a handful of remote workers, a public facing web server, and an internal file server. They have no existing infrastructure. You build it from scratch.

This is where theory becomes skill. Every concept from this course subnetting, VLANs, routing, firewalls, DNS, DHCP, VPN, TLS comes together here.

Requirements

IP Plan: Subnetting 192.168.0.0/24

The company's internal network is 192.168.0.0/24 (256 addresses). We need to divide it into 4 subnets one per department plus one for servers.

Subnetting Work

Each department needs at most 30 devices (leaving room to grow). A /27 subnet provides 32 addresses (30 usable) perfect.

Calculation:

• Block size: 256 ÷ 4 subnets = 64 addresses each (/26 gives more headroom use /26 for safety)
• /26 = 64 addresses, 62 usable hosts per subnet

Server assignments (Subnet 4 static IPs):

• 192.168.0.193 Default gateway (router interface)
• 192.168.0.194 DNS server
• 192.168.0.195 DHCP server
• 192.168.0.196 File server
• 192.168.0.197 VPN gateway
• 192.168.0.198 Internal web/intranet server
• 10.0.0.1 Public web server (DMZ, separate public IP behind NAT)

Network Topology Diagram

                          INTERNET
                              |
                         [ISP Router]
                              |
                    [Firewall / NGFW]
                    /         |        \
               [DMZ]    [Core Switch]  [VPN Gateway]
                 |       /   |   \          |
           [Web Srv]  VLAN  VLAN  VLAN   Remote
                       10   20   30     Workers
                       |     |    |
                    [Eng] [Sales][Admin]
                     /26   /26   /26
                              |
                        [Server VLAN 40]
                         /26 subnet
                        /         \
                 [File Srv]    [DNS/DHCP]

VLAN Configuration

VLANs separate broadcast domains at Layer 2, enforcing isolation even on the same physical switch.

Inter VLAN routing is handled by the firewall (Layer 3 enforcement) not the switch so all cross VLAN traffic is inspected.

Firewall Rules

Rules are evaluated top to bottom. First match wins. Default policy: DENY ALL.

DNS, DHCP, and VPN Configuration Decisions

DNS

• Internal DNS server at 192.168.0.194 (Windows Server DNS or BIND)
• Resolves internal hostnames: fileserver.acme.local, intranet.acme.local
• Forwards external queries to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google)
• DNSSEC enabled for external zone

DHCP

• DHCP server at 192.168.0.195
• Four scopes one per VLAN
• Lease time: 8 hours (office workday)
• Static reservations for printers and servers by MAC address
• DHCP snooping enabled on switches to prevent rogue DHCP servers

VPN

• Protocol: WireGuard (performance + simplicity)
• VPN gateway at 192.168.0.197 (public facing interface with NAT)
• VPN pool: 10.8.0.0/24 (separate range for remote clients)
• Split tunneling: corporate traffic through VPN; personal internet direct
• MFA required for all remote access connections
• Certificate based authentication (not password only)

Security Checklist

• All inter VLAN routing enforced through firewall (not switch)
• Default deny on all firewall policies
• Guest Wi Fi fully isolated (VLAN 99, no route to 192.168.0.0/16)
• DMZ server cannot initiate connections to internal LAN
• File server not directly reachable from internet
• VPN requires MFA
• All internal services use TLS 1.2+ for encryption
• DHCP snooping enabled on all access switches
• Dynamic ARP Inspection (DAI) enabled
• Port security on switches (limit MACs per port)
• Unused switch ports disabled
• Admin VLAN (30) separated from general VLANs
• Firewall and switch logs sent to SIEM
• Vulnerability scanning scheduled monthly
• Patch management process defined

Troubleshooting Commands

What You Learned

By completing this capstone, you have applied:

• Subnetting dividing an address space into practical, sized segments
• VLANs isolating departments at Layer 2 on shared hardware
• Firewall rules enforcing least privilege access between zones
• NAT exposing services publicly while protecting internal addresses
• VPN extending the trusted network to remote users securely
• DNS/DHCP the foundational services every network depends on
• Security principles defense in depth, default deny, least privilege, segmentation

A real enterprise network differs in scale and complexity, but every concept you used here subnetting, VLANs, firewall policy, secure remote access applies directly to networks serving thousands of users and handling millions of transactions per day.

Networking is not about memorizing protocols. It is about understanding why each layer exists and what problem it solves.