On-Premises Network Segmentation & Security Hardening

A ground-up redesign of the organization's on-premises network: from a single flat network with no internal boundaries into a segmented, VLAN-based architecture with firewall zone policies, a hardened management router, MAC-restricted device onboarding, and integrated Wi-Fi.

I analyzed the existing network and its security gaps, designed the new segmented architecture from scratch, and implemented every layer of it myself: VLAN design, link-aggregated router-to-firewall connectivity, firewall zone and rule configuration, router hardening, DHCP reservation-based MAC allowlisting for IP issuance, and Wi-Fi access point rollout across the new VLAN structure.

The organization's on-premises network was flat: every device, regardless of role or trust level, shared the same network space, and the only real security boundary was the firewall at the network edge. There was no internal segmentation, no way to contain a compromised device from reaching everything else on the network, and no wireless access at all.

Before redesigning anything, I needed to understand exactly what was already there: which devices were connected, how the existing firewall was configured, how users actually worked and reached cloud resources day to day, and what security controls, if any, were already in place. That analysis became the requirements list for the redesign.

1. Analyzed the existing flat network end to end: connected devices, current firewall configuration, how users accessed cloud resources, and what security controls already existed, then used that analysis to define the requirements for a segmented redesign.

2. Designed the new network architecture from scratch around VLAN-based segmentation rather than retrofitting the flat network piecemeal.

3. Deployed a new management router and created multiple VLANs on it, then connected it to the existing firewall over a link-aggregated connection, three physical links bonded together, for both redundancy and throughput between the two.

4. Connected the new Wi-Fi access points to the management router and configured them against the same VLAN structure, so wireless devices land in the correct segment rather than a separate, unmanaged network.

5. Reconfigured the existing firewall with a virtual interface and a dedicated zone for each VLAN, then wrote firewall rules based on VLAN and device type rather than one flat rule set covering everything.

6. Hardened the management router itself: applied a set of hardening policies and restricted access to its management terminal to a single trusted network, blocking administrative access from every other VLAN.

7. Configured the on-premises DHCP server to control IP issuance directly: every approved device was given a DHCP reservation binding its MAC address to a specific IP, and the dynamic address pool was then closed, leaving no free addresses to hand out. A device only receives an IP address once its MAC has been registered as a reservation; unregistered devices simply don't get an address, which turns device onboarding into an allowlist rather than an open pool.

8. Rolled the new architecture out across the office, replacing the flat network with the segmented one.