Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a more realistic segmented network in a simulator (Packet Tracer/GNS3) with routing and core services, applying DEFENSIVE security. Requirements: (1) create at least three VLANs (e.g. Staff, Guest, Servers) with a trunk between switches (802.1Q) and inter-VLAN ROUTING via a router or Layer-3 switch; (2) stand up core services — a DHCP scope per VLAN and DNS resolution — and confirm clients auto-configure; (3) apply SEGMENTATION security: restrict traffic between VLANs with ACLs/firewall rules so, for example, Guest can reach the internet but NOT the Servers VLAN (least privilege / blast-radius containment); (4) verify the design works AND the restrictions hold (show a permitted path succeeding and a blocked path failing); (5) document the topology, the addressing/VLAN plan, and the security rationale. Frame all security as defending a network you operate.
Three+ VLANs with 802.1Q trunking and working inter-VLAN routing; a documented VLAN/addressing plan.
Per-VLAN DHCP + DNS working; ACL/firewall rules enforce least-privilege isolation between segments (defensive).
Both a permitted path succeeding and a blocked path failing are demonstrated; topology and security rationale documented.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A segmented, secure multi-VLAN network ## Goal Build a more realistic segmented network in a simulator (Packet Tracer/GNS3) with routing and core services, applying DEFENSIVE security. Requirements: (1) create at least three VLANs (e.g. Staff, Guest, Servers) with a trunk between switches (802.1Q) and inter-VLAN ROUTING via a router or Layer-3 switch; (2) stand up core services — a DHCP scope per VLAN and DNS resolution — and confirm clients auto-configure; (3) apply SEGMENTATION security: restrict traffic between VLANs with ACLs/firewall rules so, for example, Guest can reach the internet but NOT the Servers VLAN (least privilege / blast-radius containment); (4) verify the design works AND the restrictions hold (show a permitted path succeeding and a blocked path failing); (5) document the topology, the addressing/VLAN plan, and the security rationale. Frame all security as defending a network you operate. ## Acceptance criteria - [ ] VLANs & routing: Three+ VLANs with 802.1Q trunking and working inter-VLAN routing; a documented VLAN/addressing plan. - [ ] Services & segmentation: Per-VLAN DHCP + DNS working; ACL/firewall rules enforce least-privilege isolation between segments (defensive). - [ ] Verification & docs: Both a permitted path succeeding and a blocked path failing are demonstrated; topology and security rationale documented. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.