Building Enterprise-Grade Network Infrastructure: From Design to Deployment

Caleb Adewuyi

12 min read

·

Nov 17, 2025

--

Listen

Share

When Theory Meets Reality: My Journey Through Enterprise Network Design

What happens when you take everything you’ve learned about networking and apply it to solve real-world business challenges? This is the story of designing and implementing a complete enterprise network infrastructure that doesn’t just work — it works securely, efficiently, and reliably.

The Challenge: Connecting a Multi-Site Enterprise

Imagine this scenario: A growing organization with a headquarters in one city and two branch offices in different locations. Each location has distinct departments — Finance, Engineering, Sales, IT, and Voice services — all needing secure, isolated network segments. The headquarters houses critical servers (DNS, Web, NTP), and everything must communicate seamlessly while maintaining strict security boundaries.

This isn’t just about connecting computers. It’s about building a network that:

• Scales as the business grows
• Secures sensitive departmental data
• Automates IP address management
• Synchronizes time across all devices
• Prevents unauthorized access at every layer
• Connects remote sites reliably

This is exactly what I set out to build, and this is how I did it.

Architecture Overview: Building Blocks of Enterprise Infrastructure

Press enter or click to view image in full size

The network follows industry-standard hierarchical design principles:

Headquarters (3-Tier Architecture):

• Core Layer: High-speed backbone connecting all distribution switches
• Distribution Layer: Aggregation point with routing and policy enforcement
• Access Layer: End-user connectivity with VLAN segmentation

Branch Offices (2-Tier Architecture):

• Distribution Layer: Combines routing and core functions
• Access Layer: Local user connectivity

Interconnection:

• GRE Tunnels: Secure site-to-site connectivity over the internet
• OSPF Routing: Dynamic route propagation across all sites

Network Segmentation Strategy

Each location implements VLAN-based segmentation:

• VLAN 10: Sales (CRM Access)
• VLAN 20: Finance (Restricted Access)
• VLAN 30: Engineering (Development Resources)
• VLAN 40: Voice (QoS Priority)
• VLAN 100: BlackHole (Unused Ports for Security Purpose)
• VLAN 150: IT Management (Management Purpose)
• VLAN 1000: Native VLAN (Untagged Traffic)

This segmentation isn’t arbitrary — it maps directly to business requirements and security policies.

Phase 1: Foundation — DHCP Infrastructure

Why DHCP Matters in Enterprise Networks

Manual IP address assignment in an organization with 100+ devices? That’s a recipe for IP conflicts, misconfigurations, and hours of troubleshooting. DHCP automation is essential, but it must be done right.

Implementation Strategy

Centralized DHCP Server:

• Deployed on a dedicated router in each of the branches
• Configured multiple DHCP pools for each VLAN across all sites
• Included DHCP options for DNS servers and default gateways

Press enter or click to view image in full size

Key Configuration Elements:

ip dhcp excluded-address 192.168.1.1 192.168.1.10

This reserves the first 10 IPs in each subnet for static assignments (routers, servers, printers).

VLAN-Specific Pools:

ip dhcp pool VLAN-10
 network 192.168.1.0 255.255.255.192
 default-router 192.168.1.1
 option 43 ip 192.168.0.35

ip dhcp pool VLAN-20
 network 192.168.1.64 255.255.255.224
 default-router 192.168.1.65

Notice the /26 and /27 subnet masks? This implements Variable Length Subnet Masking (VLSM) to efficiently allocate IP space based on actual needs. Sales VLAN gets a larger subnet, while smaller departments receive appropriately sized blocks.

DHCP Relay Configuration

Here’s where it gets interesting. Each VLAN don’t run their own DHCP servers — they relay requests to dedicated DHCP server which is the WAN router on the branches. This centralizes management while maintaining local functionality.

On distribution switches:

interface Vlan10
 ip address 192.168.1.2 255.255.255.192
 ip helper-address 192.168.1.133
 standby 1 ip 192.168.1.1
 standby 1 preempt

The ip helper-address command forwards DHCP broadcasts to the central server. The standby configuration? That's HSRP (Hot Standby Router Protocol) providing gateway redundancy. If one distribution switch fails, the other takes over instantly.

Result: Users plug in their devices, get IP addresses automatically, and never know there’s a complex infrastructure working behind the scenes.

Phase 2: Security Layer 1 — DHCP Snooping

The Rogue DHCP Server Threat

Here’s a real-world attack scenario: Someone brings a home router to the office and plugs it in. That router starts handing out IP addresses with itself as the gateway. Now, all traffic from nearby users flows through the attacker’s device. Credentials, emails, sensitive data — all compromised.

DHCP Snooping prevents this attack vector.

How DHCP Snooping Works

Think of DHCP Snooping as a bouncer at a club. It maintains a list of trusted DHCP servers and blocks all others. It also builds a database mapping MAC addresses to IP addresses, switch ports, and VLANs — a critical foundation for other security features.

Configuration on Access Switches:

ip dhcp snooping vlan 10,20,30
ip dhcp snooping

This enables snooping on target VLANs. But here’s the critical part — by default, ALL ports are untrusted. You must explicitly trust uplink ports:

interface FastEthernet0/1
 switchport access vlan 10
 ip dhcp snooping limit rate 15
 switchport mode access
 switchport port-security mac-address sticky

On access ports, we limit DHCP requests to 15 per second (preventing denial-of-service attacks). On uplink ports connecting to our DHCP relay-enabled switches, we configure:

interface GigabitEthernet1/0/1
 description ## Uplink to DSW1 ##
 ip dhcp snooping trust

The Result: Rogue DHCP servers are blocked. The network tracks every device’s MAC-to-IP binding. This database becomes the foundation for Dynamic ARP Inspection and IP Source Guard — additional security layers.

Phase 3: Access Control Lists (ACLs) — Enforcing Security Policy

From Business Requirements to Technical Controls

“Finance shouldn’t access Engineering resources.”
“Sales can access the internet but not the server farm.”
“Only IT can manage network devices.”

These business rules must translate into technical enforcement. That’s where ACLs come in.

Standard vs. Extended ACLs

I implemented standard ACL based on use case:

Standard ACLs — Simple source-based filtering
Extended ACLs — Granular control (source, destination, protocol, port)

Finance Department Isolation:

ip access-list standard DENY-FINANCE-ENGINEERING
 remark deny both Finance and Engineering
 deny   192.168.1.64 0.0.0.31
 deny   192.168.1.96 0.0.0.15
 permit any

This ACL uses wildcard masks (the inverse of subnet masks) to identify the Finance and Engineering subnets, then denies inter-department traffic.

Departmental Traffic Control:

ip access-list standard DENY-SALES-ENGINEERING
 remark Deny both Sales and Engineering
 deny   192.168.1.0 0.0.0.63
 deny   192.168.1.96 0.0.0.15
 permit any

ip access-list standard DENY-SALES-FINANCE
 remark Deny both Sales and Finance
 deny   192.168.1.0 0.0.0.63
 deny   192.168.1.64 0.0.0.31
 permit any

Strategic ACL Placement

ACLs are applied at distribution layer VLAN interfaces — the traffic aggregation point. This provides:

• Efficiency: Filter once instead of on every access port
• Manageability: Central policy enforcement
• Performance: Minimal latency impact

The Implicit Deny:
Every ACL ends with an invisible deny any. This follows the security principle of "deny by default, permit explicitly."

Phase 4: Port Security — Endpoint Protection

The Last Line of Defense

You’ve secured DHCP, implemented ACLs, but what if someone unplugs a legitimate device and connects an unauthorized laptop? Port security addresses endpoint-level threats.

Three-Tiered Port Security Strategy

1. MAC Address Limiting:

switchport port-security maximum 1

Limits each port to 1 MAC addresses (primary device).

2. MAC Address Learning:

switchport port-security mac-address sticky

The switch dynamically learns and saves authorized MAC addresses. This eliminates manual MAC address configuration while maintaining security.

3. Violation Response:

switchport port-security violation restrict

When a violation occurs:

• Restrict mode: Drops unauthorized traffic, increments counter, keeps port up
• Alternative modes: shutdown (disables port), protect (drops silently)

Voice VLAN Integration

switchport access vlan 10
switchport mode access
switchport voice vlan 40

This configuration:

• Places data traffic in VLAN 10
• Directs voice traffic to VLAN 40
• Prioritizes voice for QoS
• Allows both a PC and IP phone on one port

Complete Access Port Configuration:

interface FastEthernet0/3
 switchport access vlan 10
 ip dhcp snooping limit rate 15
 switchport mode access
 switchport voice vlan 40
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Result: Each port becomes a security checkpoint, preventing unauthorized device connections while supporting legitimate business needs.

Phase 5: Network Time Protocol (NTP) — Synchronization & Forensics

Why Time Matters in Network Security

When a security incident occurs, investigators need to correlate events across multiple devices. If each device has a different time, this becomes impossible. NTP solves this by synchronizing all network devices to a single authoritative time source.

NTP Hierarchy Implementation

Stratum 1 (Authoritative Source):

• NTP server at headquarters (192.168.0.2)
• Connected to external time source or configured as master

Stratum 2 (Distribution):

• All network devices synchronize to the central NTP server

Router NTP Configuration:

ntp server 192.168.0.2

Verification Commands:

DSW1#show run | section ntp
ntp server 192.168.0.2

DSW1#show ntp associations

The output shows:

• Server address: 192.168.0.2
• Stratum level: 1
• Synchronization status: Selected and active (*)

Beyond Time: The Security Benefits

Synchronized time enables:

• Accurate logging: Precise correlation of events
• Compliance: Many regulations require time synchronization
• Troubleshooting: Clear sequence of network events
• Certificate validation: PKI requires accurate time

Notice the sys.peer designation with the * symbol? This indicates successful synchronization and active time source selection.

Phase 6: WAN Connectivity — GRE Tunnels & OSPF Routing

Connecting Distributed Sites

Branch offices need secure, reliable connectivity to headquarters. While VPN solutions exist, I implemented GRE (Generic Routing Encapsulation) tunnels combined with OSPF dynamic routing.

Why GRE Tunnels?

GRE provides:

• Protocol flexibility: Carries any Layer 3 protocol
• Routing protocol support: OSPF can run over tunnels
• Simplicity: Easier to configure than full IPsec
• Scalability: Easy to add new sites

GRE Tunnel Configuration (WANR — Headquarters):

interface Tunnel1
 ip address 10.1.0.2 255.255.255.252
 mtu 1476
 tunnel source Serial0/1/0
 tunnel destination 203.0.113.2

interface Tunnel2
 ip address 10.1.0.10 255.255.255.252
 mtu 1476
 tunnel source Serial0/1/0
 tunnel destination 203.0.113.6

Key elements:

• MTU 1476: Accounts for GRE overhead (24 bytes)
• Point-to-point addressing: /30 subnets for efficient IP usage
• Source/Destination: Physical interface and remote public IP

OSPF Configuration

router ospf 1
 log-adjacency-changes
 network 192.168.1.0 0.0.0.63 area 0
 network 192.168.1.64 0.0.0.31 area 0
 network 192.168.1.96 0.0.0.15 area 0
 network 192.168.1.112 0.0.0.15 area 0

OSPF provides:

• Dynamic routing: Automatic route updates
• Fast convergence: Quick failover if links fail
• Load balancing: Equal-cost multipath routing
• Scalability: Hierarchical design with areas

Redundancy with HSRP

interface Vlan10
 ip address 192.168.1.2 255.255.255.192
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt

HSRP configuration across distribution switches ensures:

• No single point of failure: Automatic gateway failover
• Transparent to users: Virtual gateway IP remains constant
• Priority-based election: Designated primary and backup
• Preemption: Primary reclaims role after recovery

Phase 7: Additional Services & Final Integration

DNS & Web Services

The DNS/WEB server provides:

• DNS resolution: Internal name resolution for enterprise.com domain
• Web hosting: Company intranet and IT services portal
• DHCP services: Central IP address management

Press enter or click to view image in full size

The successful web access demonstrates:

• End-to-end connectivity
• DNS resolution functioning
• ACL policies permitting appropriate traffic

Spanning Tree Protocol

spanning-tree mode pvst
spanning-tree extend system-id
spanning-tree vlan 10 priority 24576

STP prevents Layer 2 loops by:

• Blocking redundant paths: Prevents broadcast storms
• Enabling redundancy: Activates backup paths on failure
• Per-VLAN optimization: Different root bridges per VLAN

SSH & Device Management

ip ssh version 2
ip domain-name Enterprise.com

Secure device management through:

• SSH v2: Encrypted administrative access
• Local authentication: Username/password protection
• AAA potential: Foundation for RADIUS/TACACS+ integration

Verification & Testing: Proving It Works

End-to-End Connectivity Tests

Client receives:

• IP Address: 192.168.2.22 (DHCP assigned)
• Subnet Mask: 255.255.255.192
• Default Gateway: 192.168.2.1
• DNS Server: 192.168.0.10

This proves:

• DHCP relay functioning across sites
• VLAN segmentation working
• Gateway redundancy operational

Security Verification

Port Security Status:

• MAC addresses learned and secured
• Violation counters at zero (no security breaches)
• Sticky MAC addresses persisted to configuration

DHCP Snooping Database:

• All clients have binding entries
• MAC-to-IP-to-port mappings recorded
• Foundation for DAI/IPSG ready

ACL Hit Counters:

deny   192.168.1.64 0.0.0.31 (15 matches)
deny   192.168.1.96 0.0.0.15 (8 matches)
permit any (2847 matches)

This proves ACLs are actively filtering traffic as designed.

Time Synchronization Validation

All devices synchronized to NTP server:

• Consistent timestamps across infrastructure
• Security event correlation enabled
• Compliance requirements met

Lessons Learned: What This Project Taught Me

Technical Insights

1. Design Before Implementation
The hierarchical architecture wasn’t arbitrary. Planning VLAN schemes, IP addressing, and security zones upfront saved hours of reconfiguration.

2. Security in Layers
No single security feature is sufficient. DHCP Snooping + Port Security + ACLs create defense in depth. Each layer catches threats the others might miss.

3. Redundancy is Non-Negotiable
HSRP, redundant distribution switches, and OSPF dynamic routing ensure the network stays operational even when components fail.

4. Documentation is Critical
Throughout implementation, documenting IP schemes, VLAN assignments, and security policies made troubleshooting exponentially easier.

Challenges Overcome

Challenge 1: ACL Placement & Direction
My ACLs didn’t behave as expected because I applied them in the wrong direction on the wrong interface.
Lesson: ACL effectiveness depends heavily on placement (inbound/outbound) and interface selection.

Challenge 2: Packet Tracer Limitations
Some advanced features like DHCP Snooping, IP SLA, and certain ARP inspection behaviors didn’t work reliably.
Lesson: Packet Tracer is excellent for learning, but not all IOS features behave exactly like real hardware.

Professional Growth

This project transformed theoretical knowledge into practical expertise:

• Problem-solving: Debugging complex multi-layer issues
• Security mindset: Thinking like an attacker to defend better
• Business alignment: Translating requirements into technical solutions

Conclusion: Building Networks That Matter

This enterprise network implementation represents more than just connected devices — it’s a secure, scalable infrastructure that enables business operations while protecting against modern threats.

Key Achievements

✅ Automated IP Management: DHCP across multi-site environment
✅ Layered Security: DHCP Snooping, Port Security, ACLs
✅ Department Isolation: VLAN-based segmentation with policy enforcement
✅ High Availability: HSRP gateway redundancy, redundant switches
✅ Site Interconnection: GRE tunnels with dynamic OSPF routing
✅ Time Synchronization: NTP for security and compliance
✅ Secure Management: SSH access with strong authentication

Real-World Application

The skills demonstrated here directly apply to:

• Enterprise IT roles: Network administrators, engineers, architects
• Security positions: Understanding defense-in-depth strategies
• Consulting opportunities: Designing networks for clients
• Career advancement: Demonstrating practical implementation ability

What’s Next?

This network provides a foundation for advanced features:

• QoS implementation: Prioritizing critical applications
• IPv6 dual-stack: Future-proofing the infrastructure
• Wireless integration: Secure Wi-Fi with 802.1X authentication
• Network monitoring: SNMP, NetFlow, syslog integration
• Automation: Python scripts for configuration management

Final Thoughts

Building an enterprise network taught me that networking isn’t just about protocols and configurations — it’s about creating infrastructure that people depend on daily. Every security feature protects someone’s data. Every redundancy mechanism prevents business disruption. Every design decision impacts user experience.

If you’re on your own networking journey, remember: The best way to learn is to build. Start with fundamentals, layer on complexity, break things, fix them, and document everything. The skills you develop through hands-on implementation are what transform you from someone who knows networking to someone who builds networks.

Want to discuss enterprise network design, security implementations, or have questions about specific configurations? Connect with me — I’m always eager to share knowledge and learn from the networking community.

This project was built using Cisco Packet Tracer, demonstrating that world-class network design doesn’t require a physical lab. With determination, structured learning, and hands-on practice, anyone can master enterprise networking.

#CCNA #NetworkEngineering #CyberSecurity #EnterpriseNetworking #ITInfrastructure