Segmented Network Core

Part of FSJ-LAB.

Goal

Build the network the way a small enterprise would: every service segmented, routing done deliberately, untrusted devices isolated, and the switches hardened. It’s also my main hands-on environment for the CCNA 200-301.

Design

• Ten VLANs, one per role: management, infrastructure, compute, storage, guest, IoT, monitoring, a CCNA practice VLAN, a firewall transit link, and a blackhole native VLAN.
• Inter-VLAN routing on the core. The Catalyst 3560 routes between internal VLANs using SVIs.
• Untrusted networks on the firewall. Guest and IoT VLANs terminate on the FortiGate, not the core switch.
• Trunk hardening. Trunks use an unused blackhole VLAN as native, and access ports run port security.

Routing and switching

• OSPFv2 single-area between the 3560 and the FortiGate, with a FULL adjacency (FortiGate is DR, the 3560 is BDR).
• Filtered redistribution. Only the guest and IoT subnets are redistributed, enforced with a prefix-list and route-map.
• RPVST+ with deterministic root election: the 3560 is primary root, the 2960S secondary.
• LLDP for neighbor discovery.

Hardening and management

• Locked-down VTY and console authentication on both switches
• SSH to legacy IOS with the older key-exchange and cipher options scoped to network-device addresses only, so modern defaults stay in place everywhere else
• Wireless via a UniFi controller VM and two APs on the access switch

What I learned

• Redistribution without filtering is how you leak routes you didn’t mean to. A route-map makes intent explicit.
• Deterministic STP root election is free stability. Leaving it to MAC-address luck isn’t.
• Most “it’s not working” moments on this network were Layer 2: native VLAN mismatches, trunk allowed lists, and port-security violations.

Next steps

• EtherChannel between the switches
• AAA and SNMPv3 hands-on practice
• Replace remaining default SNMP communities