This project presents a secure enterprise network design implemented using Cisco Packet Tracer. The network was designed using subnetting, routing, access control, authentication, monitoring, and firewall policies to simulate a secure enterprise environment.
The project focuses on applying practical Network Security concepts such as OSPF Authentication, ACLs, AAA, RADIUS, TACACS+, SSH, Layer 2 Security, NTP, Syslog, VPN, and Zone-Based Firewall (ZPF).
- Design and implement a subnetted enterprise network using
192.168.1.0/24. - Configure routers, switches, PCs, and servers according to the network topology.
- Apply secure basic configuration on network devices.
- Configure dynamic routing using OSPF with authentication.
- Control network access using Standard and Extended ACLs.
- Implement AAA Authentication using local database, RADIUS, and TACACS+.
- Secure remote device access using SSH.
- Apply Layer 2 Security using VLANs, Port Security, STP, PortFast, and BPDU Guard.
- Configure NTP and Syslog servers for time synchronization and centralized logging.
- Configure VPN to secure communication between network segments.
- Apply Zone-Based Firewall (ZPF) between inside and DMZ zones.
- Test and validate network connectivity and security configurations.
- Cisco Packet Tracer
- IP Subnetting
- VLANs
- OSPF Routing
- OSPF Authentication
- Access Control Lists
- AAA Authentication
- RADIUS
- TACACS+
- SSH
- Port Security
- Spanning Tree Protocol
- NTP
- Syslog
- VPN
- Zone-Based Firewall
- Network Testing and Simulation
The network uses the 192.168.1.0/24 address space and divides it into multiple subnets based on the number of required hosts.
The design includes:
- One blue network requiring 14 hosts.
- Multiple networks requiring 6 hosts.
- Point-to-point links between routers requiring 2 hosts.
- Dedicated server networks for AAA, RADIUS, TACACS+, NTP, Syslog, and Web services.
- Separate zones for inside and DMZ networks.
All routers and switches were configured with basic security settings, including:
- Hostnames
- Password protection
- Encrypted passwords
- Login banners
- Interface IP addressing
- Configuration saving
Dynamic routing was implemented using OSPF to allow communication between different network segments. OSPF authentication was added to improve routing security.
ACLs were configured to control and restrict traffic between networks.
Implemented ACL examples include:
- Named ACL:
TEST_Rules - Extended ACL:
ACL 130
These ACLs were used to permit specific traffic and deny unauthorized access.
AAA was implemented using multiple authentication methods:
- Local AAA authentication
- RADIUS server authentication
- TACACS+ server authentication
This improves device access control and centralizes user authentication.
SSH was configured to allow secure remote management of network devices instead of using insecure remote access methods.
Layer 2 security was applied on switches using:
- VLAN segmentation
- Port Security
- Sticky MAC addresses
- PortFast
- BPDU Guard
- STP protection
These features help protect the switching environment from common Layer 2 attacks and misconfigurations.
NTP was configured for time synchronization across devices. Syslog was configured to collect and monitor logs from network devices.
VPN configuration was applied to secure communication between selected network segments.
A Zone-Based Firewall policy was configured between the INSIDE and DMZ zones.
Allowed traffic includes:
- HTTPS
- ICMP
Other unauthorized traffic is restricted based on the firewall policy.
The project was tested using several verification methods, including:
- Ping tests between different networks.
- Web server access test using HTTPS.
- ACL verification.
- VLAN verification using
show vlan. - OSPF neighbor verification.
- NTP verification.
- Syslog verification.
- SSH login testing.
- Packet Tracer simulation mode.
Secure-Enterprise-Network-Design/
│
├── README.md
├── SECURITY-NOTES.md
├── .gitignore
│
├── packet-tracer/
│ └── Secure-Enterprise-Network-Design.pkt
│
├── docs/
│ ├── project-requirements.txt
│ └── project-summary.md
│
├── configs/
│ ├── 01-basic-configuration.txt
│ ├── 02-ospf-authentication.txt
│ ├── 03-acl-configuration.txt
│ ├── 04-aaa-authentication.txt
│ ├── 05-layer2-security.txt
│ ├── 06-ntp-syslog.txt
│ ├── 07-vpn-configuration.txt
│ └── 08-zpf-firewall.txt
│
├── topology/
│ └── network-topology.png
│
└── screenshots/
├── web-server-https-test.png
├── acl-test-rules.png
├── vlan-show-vlan.png
├── subnetting-table.png
├── ping-test.png
└── redacted/
└── aaa-radius-tacacs-redacted.png
- Download or clone this repository.
- Open Cisco Packet Tracer.
- Go to the
packet-tracer/folder. - Open the file:
Secure-Enterprise-Network-Design.pkt
- Review the topology, configurations, and test scenarios.
The configuration examples in this repository are sanitized and use placeholder secrets.
The Packet Tracer file may still contain lab credentials because they are part of the simulation. All credentials used in this project are for educational lab purposes only and must not be reused in any real network.
Sensitive values such as passwords, shared keys, and authentication secrets should always be replaced before publishing or reusing the project.
Completed as a network security simulation project using Cisco Packet Tracer.
Abdelrahman Sameh Cybersecurity Student Alexandria National University
This project is created for educational and training purposes only. It is not intended to represent a production-ready enterprise network.