Network
Hardening

🎯 Project Overview

This project aimed to establish a secure network topology by applying a layered security approach across a simulated enterprise environment. The primary focus was identifying vulnerabilities, implementing defence-in-depth security controls, and validating their effectiveness against business security policies.

The project covers both perimeter security (firewalls, VPN) and internal security (Layer 2 controls, port security, ACLs) — reflecting a realistic, multi-layered network defence strategy.

🔐 Security Controls Implemented

• Vulnerability Assessment — conducted preliminary vulnerability scans from the command line; analysed results to prioritise remediation.
• Zone-Based Policy Firewall (ZBPF) — configured stateful firewall zones (inside, outside, DMZ) with explicit inter-zone inspection policies.
• Site-to-Site VPN (IPsec) — deployed encrypted tunnels between sites for secure inter-site communication over untrusted networks.
• Access Control Lists (ACLs) — standard and extended ACLs applied to router interfaces to filter permitted and denied traffic.
• Layer 2 Security — enabled CDP control, DHCP Snooping, Dynamic ARP Inspection (DAI), Port Security, and interface descriptions.
• Device Hardening — disabled unused services and ports; applied security best practices to routers and switches.
• Network Documentation — produced a detailed topology diagram, design rationale, and security policy document.
• Security Testing & Validation — verified all controls functioned as expected and aligned with the defined security policy.

🛠️ Workflow

1. Conduct vulnerability assessments and identify weaknesses in the baseline topology.
2. Configure ZBPF — define security zones, assign interfaces, and create inter-zone policies.
3. Implement ACLs — restrict traffic flows at router boundaries based on defined rules.
4. Configure site-to-site VPN — establish IPsec tunnels with IKE phase 1 and phase 2 configuration.
5. Apply Layer 2 security controls — enable DHCP Snooping, DAI, and port security on switches.
6. Test and validate — run connectivity and security tests to confirm controls work as intended.