A secure business network lab: FortiGate, Huawei switches, five isolated VLANs, IPsec VPN and monitoring.
LabA lab: designed and documented end to end, modelled on the installations I work on as an apprentice. Not a client engagement.
Stack
- Networking
- FortiGate
- Huawei VRP
- VLAN 802.1Q
- LACP
- IPsec
- DHCP Snooping
- SNMP
- Infra
- Grafana
Context
Same fictional company: 40 employees, IP telephony, guest Wi-Fi, cameras and travelling sales staff. The starting point is a flat network behind the ISP router: one infected laptop or one curious guest can see every camera and the file server.
Role
Lab project: addressing plan, VLAN design, filtering policy, device configuration and operations documentation. These are the devices and settings I work with as an apprentice.
Architecture
Internet
FTTO fibre + 4G backup
FortiGate
Inter-VLAN routing, filtering, IPsec VPN
Huawei core switch
LACP bundle to the FortiGate
PoE access switches
One per floor, 802.1Q trunks
VLAN 10 · Data
Workstations and file server
VLAN 20 · Voice
IP-PBX and phones
VLAN 30 · Guests
Wi-Fi, Internet only
VLAN 40 · Video
Cameras and NVR, isolated
VLAN 99 · Admin
Device management
Addressing plan
| VLAN | Name | Network | Allowed access |
|---|---|---|---|
| 10 | Data | 10.10.10.0/24 | Internet, file server, printers |
| 20 | Voice | 10.10.20.0/24 | IP-PBX and carrier SIP trunk only |
| 30 | Guests | 10.10.30.0/24 | Internet only, Wi-Fi client isolation |
| 40 | Video | 10.10.40.0/24 | Recorder (NVR) only, no Internet |
| 99 | Admin | 10.10.99.0/24 | Device management interfaces |
Challenges
Isolating without getting in the way: inter-VLAN routing on the FortiGate with explicit rules (guests only reach the Internet, cameras only talk to the recorder, management is only reachable from its own VLAN); making the core-to-firewall link resilient with LACP; hardening access ports (DHCP snooping, BPDU protection, unused ports shut down); and giving remote staff clean access over IKEv2 IPsec with FortiClient rather than SSL VPN, which Fortinet is phasing out.
Outcome
A segmented, documented network: addressing plan, allowed-flows matrix, backed-up configurations and SNMP monitoring of every device in Grafana (throughput, port status, uptime). Every rule has a written reason, which makes operations and support much simpler.
Highlights
- 5 isolated VLANs, inter-VLAN routing filtered by the FortiGate
- Core ↔ firewall link in LACP (2 × 1 Gb/s)
- Hardened access ports: DHCP snooping, BPDU protection, unused ports shut
- IKEv2 IPsec VPN for remote staff, SNMP monitoring in Grafana