Network Security Fundamentals Lab

Network security begins with understanding how traffic should move before deciding how to restrict it.

Welcome to the Network Security Fundamentals Lab.

You have already built the certification foundation through:

• CCST Cybersecurity
• CCNA
• Cisco Cybersecurity Professional Path
• CCNP Security

Now you will begin the practical Cisco/network-security lab sequence.

The objective is to move from:

I understand networking and security concepts.

to:

I can build a segmented network, analyze traffic paths, identify weak trust relationships, troubleshoot connectivity, and document security findings.

This lab is especially relevant for:

• Network Security Engineers
• SOC Analysts
• Network Engineers
• Firewall Engineers
• Security Analysts
• Cloud Security Engineers
• Security Consultants

🎯 Mission Information

Item	Details
Lab	Network Security Fundamentals
Difficulty	Beginner → Intermediate
Estimated Time	2–3 Hours
Primary Focus	Networking, Segmentation & Security Fundamentals
Target Roles	Network Security Engineer, SOC Analyst, Network Engineer
Certification Alignment	CCST Cybersecurity, CCNA, CCNP Security
Career Skill	Secure Network Design & Traffic Analysis
Environment	Cisco Packet Tracer / Approved Lab Environment
Output	Network Diagram, Traffic Matrix, Security Findings, Troubleshooting Evidence

🏢 Mission Scenario

You have joined an organization as a junior Network Security Engineer.

The organization currently has a simple network where:

• employees
• application servers
• databases
• administrators

have been connected with limited segmentation.

Security leadership is concerned that:

• user devices may reach sensitive servers directly
• management access may not be isolated
• VLAN design may be weak
• routing may allow excessive communication
• network documentation is incomplete
• security teams do not clearly understand permitted traffic

Your task is to redesign the lab environment into a more secure and understandable network architecture.

🎯 Mission Objectives

By the end of this lab, you should be able to:

• build a basic network topology
• understand IPv4 addressing
• create subnet plans
• configure VLAN concepts
• understand inter-VLAN routing
• define trust boundaries
• implement basic segmentation
• analyze packet flow
• identify unnecessary connectivity
• secure administrative access
• troubleshoot common network failures
• create network-security findings
• document remediation

📚 Prerequisites

You should understand:

• IPv4 basics
• subnet masks
• TCP/IP
• switches
• routers
• VLAN concepts
• default gateways
• basic routing
• common ports

Recommended previous learning:

• CCST Cybersecurity
• CCNA
• Cisco Cybersecurity Professional Path

🧠 Network Security Mental Model

For every connection, ask:

Source
   ↓
Source Network
   ↓
Switch / VLAN
   ↓
Default Gateway
   ↓
Routing
   ↓
Security Control
   ↓
Destination Network
   ↓
Destination Host
   ↓
Return Path

Then ask:

Should this communication exist?

That final question turns networking into security engineering.

🏗️ Lab Architecture

Build a simple enterprise network.

                         Internet
                            |
                         Router
                            |
                       Core Switch
        ____________________|____________________
       |                    |                    |
       |                    |                    |
   VLAN 10              VLAN 20              VLAN 30
    Users              Applications           Database
10.10.10.0/24        10.10.20.0/24        10.10.30.0/24

                            |
                        VLAN 40
                       Management
                     10.10.40.0/24

🧠 Intended Security Model

The target design should approximately follow:

Users
   ↓
Applications
   ↓
Databases

Administrative access should originate from:

Management Network
       ↓
Network Devices / Servers

not from every user VLAN.

🧪 Task 1 — Build the Basic Topology

Create:

• one router or Layer 3 routing device

• one or more switches

• user endpoint

• application server

• database server

• administrator workstation

Suggested names:

R1

SW1

USER-PC01

APP-SRV01

DB-SRV01

ADMIN-PC01

🧪 Task 2 — Create the Addressing Plan

Use:

VLAN	Purpose	Network
VLAN 10	Users	10.10.10.0/24
VLAN 20	Applications	10.10.20.0/24
VLAN 30	Database	10.10.30.0/24
VLAN 40	Management	10.10.40.0/24

Suggested gateways:

VLAN 10
10.10.10.1

VLAN 20
10.10.20.1

VLAN 30
10.10.30.1

VLAN 40
10.10.40.1

🧠 Why Separate Networks?

Each subnet represents a different trust or business function.

This makes it easier to apply:

• ACLs

• firewall policies

• monitoring

• routing controls

🧪 Task 3 — Assign Host Addresses

Example:

USER-PC01
10.10.10.10/24
Gateway: 10.10.10.1

APP-SRV01
10.10.20.10/24
Gateway: 10.10.20.1

DB-SRV01
10.10.30.10/24
Gateway: 10.10.30.1

ADMIN-PC01
10.10.40.10/24
Gateway: 10.10.40.1

🧪 Task 4 — Validate Local Connectivity

Before routing between networks, validate each subnet.

Check:

• IP address

• subnet mask

• switch connectivity

• local reachability

🧠 Troubleshooting Principle

Do not troubleshoot routing until local connectivity works.

Use:

Physical
   ↓
Interface
   ↓
IP Configuration
   ↓
Local Network

🧪 Task 5 — Create VLANs

Create:

VLAN 10
USERS

VLAN 20
APPLICATIONS

VLAN 30
DATABASE

VLAN 40
MANAGEMENT

Assign switch ports appropriately.

🧠 Security Benefit

VLANs create logical separation.

But remember:

VLANs alone do not enforce all security requirements.

Routing and access controls still matter.

🧪 Task 6 — Validate VLAN Membership

Confirm:

• user PC belongs to VLAN 10

• application server belongs to VLAN 20

• database belongs to VLAN 30

• administrator workstation belongs to VLAN 40

Create:

Device	VLAN	Expected
USER-PC01	10	Yes
APP-SRV01	20	Yes
DB-SRV01	30	Yes
ADMIN-PC01	40	Yes

🧪 Task 7 — Configure Inter-VLAN Routing

Configure the lab so that VLANs can communicate through an approved routing device.

The exact method depends on your topology.

Possible approaches include:

• router-on-a-stick

• Layer 3 switch

Conceptually:

VLAN 10
   ↓
Routing Device
   ↓
VLAN 20

🧠 Important Security Lesson

Routing enables communication.

Security controls determine whether that communication should be allowed.

🧪 Task 8 — Test Full Connectivity

Initially, test whether:

USER-PC01
→ APP-SRV01

USER-PC01
→ DB-SRV01

ADMIN-PC01
→ APP-SRV01

ADMIN-PC01
→ DB-SRV01

Record:

Source	Destination	Works?
User	Application
User	Database
Admin	Application
Admin	Database

🚨 Security Observation

If every network can reach every other network, routing may work perfectly while the architecture remains insecure.

This is an important distinction:

Functional does not automatically mean secure.

🧪 Task 9 — Define Trust Boundaries

Classify networks.

Example:

Network	Trust Level	Purpose
User	Standard	Employee endpoints
Application	Higher	Business applications
Database	High	Sensitive data
Management	Privileged	Administration

🧠 Trust Should Not Be Binary

Do not think only:

Trusted
vs
Untrusted

Different internal zones may require different protections.

🧪 Task 10 — Build a Traffic Requirement Matrix

Before applying security controls, document the business flows.

Example:

Source	Destination	Service	Required?
Users	Application	HTTPS	Yes
Users	Database	Database Port	No
Applications	Database	Database Port	Yes
Management	Network Devices	SSH	Yes
Users	Management	SSH	No

🧠 Security Principle

Your controls should implement this matrix.

Do not configure rules first and try to justify them later.

🧪 Task 11 — Understand Least-Privilege Networking

The desired model is:

Required Source
      ↓
Required Destination
      ↓
Required Service

Not:

Any
 ↓
Any
 ↓
Any

🧪 Task 12 — Identify an Insecure Traffic Path

Scenario:

USER-PC01
      ↓
DB-SRV01

The user network can directly reach the database.

Ask:

Does a standard employee workstation require direct database connectivity?

For this lab:

No.

Document this as a finding.

🚨 Example Finding

Finding ID:
NET-001

Title:
User Network Can Directly Access Database Network

Severity:
High

Observation:
User VLAN hosts can communicate directly with database systems.

Risk:
Compromise of an employee endpoint could provide direct network access to sensitive database infrastructure.

Recommendation:
Restrict user-to-database traffic and require access through the authorized application tier.

🧪 Task 13 — Add Basic Traffic Restrictions

Use an ACL or equivalent lab mechanism to enforce:

Users
   ↓
Applications

while denying:

Users
   X
Databases

Keep required application-to-database traffic permitted.

🧠 Security Validation

After implementation test:

User → Application
Expected: Allow

User → Database
Expected: Deny

Application → Database
Expected: Allow

🧪 Task 14 — Document ACL Logic

Do not only record commands.

Document intent.

Rule 1

Source:
User Network

Destination:
Application Network

Service:
Approved Application Traffic

Action:
Permit


Rule 2

Source:
User Network

Destination:
Database Network

Action:
Deny

🧪 Task 15 — Review Rule Order

Understand that ACL rule order matters.

Conceptually:

Specific Permit
      ↓
Specific Deny
      ↓
Broader Rules
      ↓
Implicit Deny

Incorrect ordering can:

• allow too much

• block required traffic

🧪 Task 16 — Secure the Management Network

The administrator workstation should use:

ADMIN-PC01
      ↓
Management Network
      ↓
Network Infrastructure

Standard users should not directly administer devices.

🚨 Insecure Pattern

User Network
      ↓
SSH / Telnet
      ↓
Router

without a business requirement.

🧪 Task 17 — Prefer Secure Administration

Where supported in your lab, prefer:

SSH

rather than:

Telnet

🧠 Why?

Telnet transmits data without the protections expected from secure remote administration.

🧪 Task 18 — Restrict Administrative Source Networks

Design the rule:

Management VLAN
      ↓
SSH
      ↓
Router / Switch

and restrict equivalent access from:

User VLAN

🧪 Task 19 — Review Device Credentials

For your lab devices:

• avoid default credentials

• use strong local credentials

• separate normal user and administrative access where feasible

🧠 Security Principle

Network-security controls are weakened if device administration itself is insecure.

🧪 Task 20 — Understand AAA

Create the conceptual model:

Administrator
      ↓
Authentication
      ↓
Authorization
      ↓
Accounting

Explain:

Authentication

Who is accessing the device?

Authorization

What actions are permitted?

Accounting

What activity was performed?

🧪 Task 21 — Create an Administrative Access Matrix

Source	Target	Protocol	Allowed?
Management VLAN	Router	SSH	Yes
User VLAN	Router	SSH	No
Internet	Internal Switch	SSH	No

🧪 Task 22 — Review Common Services

Identify the security relevance of:

Port	Service	Security Question
22	SSH	Who needs admin access?
53	DNS	Which resolver is authorized?
80	HTTP	Should encryption be required?
443	HTTPS	Is the service intended to be reachable?
3389	RDP	Should this be exposed?

🧠 Important

A port being open is not automatically a vulnerability.

Ask:

Is the service required, appropriately restricted, and securely configured?

🧪 Task 23 — Analyze a Packet Path

Scenario:

USER-PC01
10.10.10.10

→

APP-SRV01
10.10.20.10

Explain:

USER-PC01
      ↓
SW1
      ↓
VLAN 10
      ↓
Default Gateway
10.10.10.1
      ↓
Routing Decision
      ↓
ACL
      ↓
VLAN 20
      ↓
APP-SRV01

🧠 Packet-Flow Skill

You should be able to explain what happens at each stage.

🧪 Task 24 — Analyze an Unauthorized Packet Path

Scenario:

USER-PC01
      ↓
DB-SRV01

Explain:

User
 ↓
Gateway
 ↓
Routing
 ↓
Security ACL
 ↓
DENY

🧠 This Is the Goal

Not simply:

ping failed.

You should know:

where and why it failed.

🧪 Task 25 — Create a Controlled Misconfiguration

Intentionally introduce one error.

Examples:

• wrong subnet mask

• wrong gateway

• wrong VLAN

• missing route

• incorrect ACL

Then troubleshoot it.

⚠️ Important

Only break your controlled lab environment.

🧪 Task 26 — Troubleshoot Wrong IP Address

Scenario:

USER-PC01
IP: 10.10.10.10

Mask:
255.255.0.0

when the design requires /24.

Investigate:

• host configuration

• expected subnet

• gateway

🧪 Task 27 — Troubleshoot Wrong Default Gateway

Scenario:

USER-PC01
IP:
10.10.10.10/24

Gateway:
10.10.20.1

Ask:

Is the gateway in the local subnet?

🧪 Task 28 — Troubleshoot VLAN Misassignment

Scenario:

A user PC receives correct cabling but cannot communicate as expected.

Review:

• switch port

• VLAN assignment

• VLAN existence

• trunk if required

🧪 Task 29 — Troubleshoot Routing

Scenario:

Hosts communicate locally but cannot reach another subnet.

Use:

Source IP
   ↓
Local Gateway
   ↓
Routing Table
   ↓
Destination Network

🧪 Task 30 — Troubleshoot an ACL Issue

Scenario:

Application traffic stops after a new ACL is deployed.

Use:

Source
 ↓
Destination
 ↓
Protocol
 ↓
Port
 ↓
ACL Direction
 ↓
Rule Order
 ↓
Implicit Deny

🧠 Do Not Fix With Any/Any

A common bad troubleshooting approach is:

permit any any

just to restore connectivity.

Instead identify the exact required flow.

🧪 Task 31 — Troubleshoot Return Traffic

Remember communication is not only:

Source
→
Destination

There must also be a valid return path.

Think:

Source
   ↓
Destination
   ↓
Response
   ↓
Source

🧭 Network Troubleshooting Framework

Use this order:

Physical
   ↓
Interface
   ↓
IP Address
   ↓
Subnet
   ↓
VLAN
   ↓
Gateway
   ↓
Route
   ↓
ACL / Firewall
   ↓
Destination Service
   ↓
Return Path

🧪 Task 32 — Create a Segmentation Assessment

Review the final architecture.

Ask:

• can users reach databases?

• can users reach management interfaces?

• can applications reach databases?

• can administrators manage infrastructure?

• are unnecessary paths denied?

Create:

Source Zone	Destination Zone	Required	Actual	Finding
Users	Applications	Yes
Users	Database	No
Users	Management	No
Application	Database	Yes

🧪 Task 33 — Identify an Overly Broad Trust Relationship

Example:

Users
   ↓
Management
   ↓
Network Infrastructure

If standard users can administer infrastructure, this is a high-risk design.

🧪 Task 34 — Create a Management Access Finding

Finding ID:
NET-002

Title:
Network Devices Allow Administrative Access From User Network

Severity:
High

Observation:
Administrative network-device access is available directly from the general user VLAN.

Risk:
Compromise of an employee endpoint could provide a path toward network infrastructure administration.

Recommendation:
Restrict management access to the dedicated management network and use secure administrative protocols.

🧪 Task 35 — Identify a Flat-Network Finding

Finding ID:
NET-003

Title:
Insufficient Internal Network Segmentation

Severity:
High

Observation:
Multiple workloads with different sensitivity levels share broad connectivity.

Risk:
Compromise of one endpoint may enable unnecessary lateral movement.

Recommendation:
Separate workloads by trust and business function and enforce approved traffic flows between segments.

📊 Basic Network Risk Rating

Use:

Reachability
+
Privilege
+
Asset Sensitivity
+
Exposure
+
Business Impact
=
Risk

🔴 Critical

Examples:

• direct uncontrolled external access to critical infrastructure

🟠 High

Examples:

• user-to-database connectivity

• broad management access

• major segmentation failure

🟡 Medium

Examples:

• unnecessary service exposure

• overly broad internal rule

🔵 Low

Examples:

• missing labels

• stale documentation

• unused VLAN configuration

🧪 Task 36 — Build a Network Security Checklist

Control	Status	Risk	Recommendation
VLAN segmentation
IP addressing documented
User-to-database blocked
Application-to-database allowed
Management network isolated
Secure administration
ACLs follow least privilege
Routing documented
Traffic matrix documented
Troubleshooting validated

🚨 Scenario — Compromised User Workstation

Assume:

USER-PC01

has been compromised.

Ask:

Which network paths could an attacker use?

Create:

Compromised User
      ↓
Application
      X
Database
      X
Management

🧠 Blast-Radius Thinking

Good segmentation should reduce what a compromised endpoint can reach.

🚨 Scenario — Compromised Application Server

Now assume:

APP-SRV01

is compromised.

Potential path:

Application Server
       ↓
Database

Ask:

• which database port is permitted?

• is management accessible?

• can the server reach users?

• what additional controls are needed?

🧠 Security Lesson

Segmentation reduces risk.

It does not make compromise harmless.

🚨 Scenario — Unauthorized Administrator

Suppose a standard employee attempts:

User VLAN
    ↓
SSH
    ↓
Router

Expected:

Deny.

Document whether your lab enforces this.

🎤 Network Security Fundamentals Interview Questions

Practise without notes.

Networking

1. What is an IP address?

2. What is a subnet?

3. What is a default gateway?

4. What is a VLAN?

5. What is inter-VLAN routing?

6. What is a MAC address?

7. What is ARP?

8. What is a router?

9. What is a switch?

Security

10. What is network segmentation?

11. Why should user and database networks be separated?

12. What is an ACL?

13. What does least privilege mean in networking?

14. Why use a dedicated management network?

15. Why is Telnet considered insecure for administration?

16. What is AAA?

Troubleshooting

17. A host cannot reach its gateway. What would you check?

18. Two VLANs cannot communicate. What would you investigate?

19. An ACL blocks an application unexpectedly. What would you check?

20. Why does return routing matter?

🚨 Scenario Interview Question 1

Users need HTTPS access to an application, but they should not directly access its database.

Design:

Users
  ↓
TCP 443
  ↓
Application
  ↓
Database Port
  ↓
Database

Then enforce:

Users ─X→ Database

🚨 Scenario Interview Question 2

A user has the correct IP address but cannot reach a server in another subnet.

Review:

IP
 ↓
Subnet
 ↓
Gateway
 ↓
VLAN
 ↓
Routing
 ↓
ACL
 ↓
Destination

🚨 Scenario Interview Question 3

A user can access both the application server and the database directly.

Discuss:

• business need

• trust boundaries

• segmentation

• ACLs

• least privilege

🚨 Scenario Interview Question 4

Network engineers manage switches directly from the user VLAN.

Discuss:

• management segmentation

• AAA

• secure protocol

• monitoring

🚨 Scenario Interview Question 5

Connectivity breaks immediately after an ACL change.

Do not respond:

Remove the ACL.

Determine:

• expected flow

• source

• destination

• protocol

• port

• ACL placement

• rule order

🧠 Interview Answer Framework

For network-security questions use:

Requirement
   ↓
Source
   ↓
Destination
   ↓
Network Path
   ↓
Security Control
   ↓
Validation

For troubleshooting:

Symptom
   ↓
Local Configuration
   ↓
VLAN
   ↓
Gateway
   ↓
Route
   ↓
ACL
   ↓
Service
   ↓
Return Path

💬 Interview Tip

Avoid:

“I would ping everything.”

A stronger answer is:

“I would first identify the expected source, destination, protocol and network path, verify local addressing and VLAN membership, confirm gateway and routing, review the relevant ACL or firewall control, then validate the destination service and return path.”

That demonstrates structured troubleshooting.

📁 Portfolio Evidence

After completing the lab, create a sanitized portfolio package.

Include:

Network Diagram

Internet
   ↓
Router
   ↓
Core Switch
   ├── Users
   ├── Applications
   ├── Database
   └── Management

IP Addressing Plan

Document all networks and gateways.

Traffic Matrix

Show:

• allowed flows

• prohibited flows

Security Findings

Create at least 2–3 findings.

Troubleshooting Case

Document:

Problem
 ↓
Evidence
 ↓
Root Cause
 ↓
Fix
 ↓
Validation

📝 Resume Examples

Instead of:

Knowledge of network security fundamentals.

Use:

Built a segmented enterprise networking lab using VLANs, IPv4 subnetting, inter-VLAN routing, and least-privilege traffic controls across user, application, database, and management networks.

Or:

Performed network-security validation and troubleshooting by analyzing VLAN membership, gateway configuration, routing paths, ACL behavior, and return traffic.

⭐ Job-Readiness Check

After this lab, you should be able to:

• explain network topology

• design basic IP addressing

• explain VLANs

• understand inter-VLAN routing

• define trust boundaries

• create a traffic matrix

• understand least-privilege networking

• identify unnecessary network paths

• understand ACL enforcement

• secure administrative access

• troubleshoot VLAN/routing/ACL issues

• create professional network findings

If your security design still means:

put everything on one network and install a firewall,

repeat the lab.

The goal is:

understand which systems should communicate, separate workloads according to trust, permit only required traffic, and be able to explain exactly where connectivity succeeds or fails.

🧹 Lab Clean-Up

After completing the lab:

• remove temporary insecure rules

• restore intentionally broken configurations

• remove test credentials

• save the final secure configuration

• export or save your topology

• preserve sanitized screenshots for portfolio use

🏆 Mission Complete

You have now practised:

Network Topology
      ↓
IPv4 Addressing
      ↓
VLAN Segmentation
      ↓
Routing
      ↓
Trust Boundaries
      ↓
Traffic Control
      ↓
Secure Administration
      ↓
Troubleshooting
      ↓
Security Findings

These are foundational skills for:

• Network Security Engineers

• Network Engineers

• SOC Analysts

• Firewall Engineers

• Security Consultants

• Cloud Security Engineers

🚀 What’s Next?

You now understand how to create basic network trust boundaries and control traffic between different network segments.

The next lab goes deeper into one of the most important network-security controls:

➡️ Next: ACL Security Lab

In the next lab, you will work with:

• standard ACL concepts

• extended ACL concepts

• source and destination filtering

• protocol and port restrictions

• ACL placement

• rule order

• implicit deny

• least-privilege access

• ACL troubleshooting

• security findings

• interview scenarios