Networking Fundamentals Capstone
Allocate a verified VLSM plan, enforce zone boundaries, and test an ordered firewall policy against permitted flows.
Brief
Halcyon Freight is opening an office with 100 staff devices, 50 guest devices, 20 servers and 10 management endpoints. Its assigned block is 10.42.0.0/23. An operations lead proposes four equal subnets and says separate VLAN labels will prevent guests from reaching payroll. You must replace both assumptions with an address plan and a testable traffic policy before cutover.
The device counts exclude one gateway per zone and already include planned growth. Allocate the smallest conventional IPv4 subnet for each zone, largest first, from the lowest available aligned address, without gaps between allocated zones. Reserve the remainder. Then review proposed rules for staff HTTPS access to one application, management SSH to that application, and guest isolation; configuration approval alone does not prove the boundary works.
A subnet is an address boundary, not an authorization decision: routed traffic still needs an enforced policy.
Size, align and reserve the address space
For ordinary broadcast subnets, a prefix /p provides 2^(32-p) addresses and two are unavailable to hosts: the network and broadcast addresses. Add the gateway before sizing: staff need 101 usable addresses, guests 51, servers 21 and management 11. A /26 has only 62 usable addresses, so it cannot hold staff; the required sizes are /25, /26, /27 and /28 respectively. Point-to-point /31 semantics are not applicable to these multiaccess LANs.
Allocate staff 10.42.0.0/25, guests 10.42.0.128/26, servers 10.42.0.192/27 and management 10.42.0.224/28. Their broadcasts are .127, .191, .223 and .239. Choose each first usable address as gateway: .1, .129, .193 and .225. The server range ends at .222, not .223. The remaining space is 10.42.0.240/28 plus 10.42.1.0/24; it is reserved rather than silently assigned to guests.
Alignment matters as much as capacity: 10.42.0.160/26 is not a valid network boundary because /26 blocks begin at multiples of 64. Verify strict network parsing, containment within the /23 and pairwise non-overlap with an address library. Preserve the inputs and verification output alongside the approved plan; an auditor can then reproduce capacity and boundary checks rather than trusting a diagram.
Turn zones into enforceable paths
Place each subnet in a distinct VLAN and route inter-zone traffic through a stateful enforcement point with no alternate routing path. A guest frame reaches its gateway using local address resolution; the gateway then makes a routing and policy decision for a server destination. Separate broadcast domains prevent local broadcasts crossing, but an unrestricted router would still forward guest packets to servers. Prevent source spoofing at ingress so a guest cannot claim a management source address.
Use 10.42.0.200 as the application host. The exercise policy permits new staff-to-application TCP destination port 443 and new management-to-application TCP destination port 22. Guests may initiate only TCP destination port 443 to public destinations; all destinations inside the company /23 are excluded. This lab models inter-zone and outbound filtering after local DHCP and name resolution; those infrastructure flows are outside its scope. Everything else is denied, with established return traffic allowed by state tracking.
A guest device can still attack another guest inside its own VLAN without visiting the routed firewall. If peer isolation is required, use access-layer isolation or endpoint controls as well. Record which boundaries are routed and which are local: the least-privilege control cannot claim coverage for paths that never traverse its enforcement point. An audit question is whether the actual forwarding path matches the approved zone map.
Evaluate ordered rules, not reassuring labels
Assume first-match evaluation for new connections. An allow from any source to 10.42.0.192/27 on any service placed before a guest deny defeats that deny for server traffic. A later, narrower rule does not override the earlier match. Distinguish an overly broad rule from a correctly scoped rule made ineffective by position: the repair may require both narrowing and reordering, not adding one more deny at the bottom.
A rule named secure-web that allows UDP destination port 443 does not satisfy this exercise's TCP requirement, even though other protocols can legitimately use that UDP port. Similarly, allowing staff TCP 443 to the entire server subnet exceeds permission for the single application .200. Port, transport, source, destination, direction and ordering all participate in the authorization decision; a familiar service label is not evidence.
Review each candidate against the policy and its stated placement. Retain rejected changes and their reason, approved rule identifiers, owner and review date. For a temporary exception, require scope, expiry and an accountable approver instead of silently broadening the baseline. This gives a least-privilege review a complete decision trail, including requests that never reached production.
Prove the deployed boundary
Before cutover, establish a recovery route for administrators, export the current configuration and document rollback triggers. Test permitted staff-to-.200 TCP 443 and management-to-.200 TCP 22 connections, plus denied guest-to-.200 TCP 443 and staff-to-.200 TCP 22 connections. Include a guest attempt to an unused address inside the company /23: an unavailable service is not proof of a firewall denial, so inspect rule-hit logs or a packet capture at the enforcement point.
After policy changes, clear only the relevant test sessions or use fresh flows because an established state entry may survive a change to the rules for new connections. Record timestamp, source zone and address, destination, transport, destination port, expected outcome, observed outcome and matching rule identifier. A successful ping does not prove TCP 443 works, and a timeout alone cannot distinguish filtering from routing failure or an offline endpoint.
Bundle the verified address plan, zone-path diagram, approved ordered rules, deployed configuration digest and positive and negative test results under one change identifier. Have a reviewer reconcile the deployed rules to the approved version. The audit claim is bounded: these paths and protocols were enforced at this time; repeat testing after address, route or policy changes rather than treating one successful cutover as perpetual evidence.
This room is the track's final project. Every lab below is one step of a single deliverable - clear them all and the Networking Fundamentals track is complete.
Next on your path · Cloud Fundamentals
Cloud Concepts and Shared Responsibility
Classify cloud services, locate the operational boundary, and prove the controls that remain with the customer.
Community
Discussion & writeups
Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.
Loading discussion…