Skip to content
Contact CV
All work

Enterprise Network Design & Security

SkyGrid Networks — Enterprise Network

Designed and built a three-tier enterprise WAN for SkyGrid Networks Ltd across three branch sites — redundant OSPF core, VLSM addressing, VLAN segmentation, hardened devices and core services — then verified it end to end with ping and traceroute.

CiscoOSPFVLANsVLSMSSHDNS

Overview

Objective
Design a network for SkyGrid Networks Ltd that links three branch sites, keeps each site's Marketing, Sales and IT traffic separated, and routes efficiently over redundant paths.
Environment
Cisco Packet Tracer
My role
Network designer & implementer
Architecture
Three-tier — core routers, distribution multilayer switches, access switches
Sites
Warsaw · London · York, each with Marketing, Sales and IT VLANs
Addressing
210.165.10.0/24 subnetted with VLSM

Methodology

  1. 01

    Addressing with VLSM

    Split 210.165.10.0/24 into right-sized subnets so each department got only what it needed — for example, in London: Marketing a /28, Sales and IT a /29 each — leaving room to grow without renumbering.

  2. 02

    Three-tier hierarchy

    Built the network in core, distribution and access layers so each layer has one job and traffic stays close to its source.

  3. 03

    VLAN segmentation & inter-VLAN routing

    Placed Marketing, Sales and IT in separate VLANs at each site, with the distribution multilayer switches acting as their gateways and routing between them.

  4. 04

    OSPF WAN core

    Linked the sites with serial WAN lines between the core routers and ran OSPF (area 0) so paths are learned automatically and re-converge over the redundant links if one fails.

  5. 05

    Security hardening

    Configured an encrypted enable secret, console and VTY passwords, SSH access (domain name, 1024-bit RSA key pair and a local account) to replace Telnet, and a Message-of-the-Day warning banner.

  6. 06

    Services

    Added DNS, an HTTP web server and wireless coverage so the network supports real-world services, not just host-to-host reachability.

Evidence

Full topology — a three-tier design across three branch sites (Warsaw, London, York): a redundant router core over serial WAN links, multilayer switches at the distribution layer and access switches connecting the hosts.
Full topology — a three-tier design across three branch sites (Warsaw, London, York): a redundant router core over serial WAN links, multilayer switches at the distribution layer and access switches connecting the hosts.
The core layer — routers joined by serial WAN links, each labelled with its OSPF cost, giving the branches redundant paths through the backbone.
The core layer — routers joined by serial WAN links, each labelled with its OSPF cost, giving the branches redundant paths through the backbone.
Intra-department reachability — MKT-01 pinging MKT-08 (210.165.10.35) with 0% packet loss.
Intra-department reachability — MKT-01 pinging MKT-08 (210.165.10.35) with 0% packet loss.
Sales VLAN — Sales-05 reaching Sales-12 (210.165.10.77), 4 of 4 replies.
Sales VLAN — Sales-05 reaching Sales-12 (210.165.10.77), 4 of 4 replies.
IT VLAN — IT-01 reaching IT-05 (210.165.10.82) across the switched segment.
IT VLAN — IT-01 reaching IT-05 (210.165.10.82) across the switched segment.
Inter-site routing — a traceroute from Sales-03 to Sales-08 (210.165.10.53) crossing four routers in five hops over the OSPF WAN.
Inter-site routing — a traceroute from Sales-03 to Sales-08 (210.165.10.53) crossing four routers in five hops over the OSPF WAN.

Testing & verification

  • Every ping test returned all four replies with 0% loss — where the first packet dropped, ARP resolution explained the one-off delay before traffic settled.
  • Traceroute showed a single hop for same-subnet traffic and multiple hops between sites, matching the OSPF-computed paths.
  • Both local switching and inter-VLAN routing were confirmed — traffic stayed within a VLAN where it should, and crossed the core only when it had to.

Troubleshooting

  • Wireless clients lost connectivity and pings timed out; switch port Fa0/5 to the wireless router sat down/down.
  • The cable was in the wireless router's Internet (WAN) port — moving it to a plain Ethernet port and running 'no shutdown' brought the link up/up and restored reach.
  • A pass over each end device's IP, mask and default gateway cleared the remaining VLAN and inter-site conflicts.

Reliability & resilience

  • OSPF senses a failed link and re-routes automatically, with no manual intervention.
  • The redundant serial links mean losing one backbone link doesn't isolate a site.
  • The three-tier hierarchy isolates faults — a broken access switch or VLAN affects only its own users, not the whole network.

What I learned

  • Segmentation is a security control, not just a tidy diagram.
  • A VLSM plan drawn up front makes routing, services and troubleshooting all easier later.
  • Most 'network' faults come down to the physical layer and a wrong gateway — check those first.

Next project

Orvexa Labs