Secure Hybrid Enterprise, IoT & Endpoint Management Lab

Executive Overview

This case study documents the staged modernization of a real mixed small-business technology environment using enterprise-style architecture, change control, rollback planning, and validation. The starting environment combined users, infrastructure, storage, printing, wireless access, and IoT systems on broadly shared network paths. The target is a controlled enterprise foundation in which management, users, storage, printers, servers, lab systems, guests, and IoT/OT workloads are separated by security zone and connected only through explicit policy.

The work is intentionally sequenced rather than performed as a single redesign. Each change captures current state, prepares the target service path, validates business functionality, and preserves a rollback option before the next dependency is moved.

Business & Architecture Problem

The original environment functioned, but several unrelated device classes shared the same user network. That design increased east-west trust, mixed administrative and business traffic, and made it difficult to apply least-privilege policy. The modernization program therefore focuses on service continuity while reducing implicit trust and improving operational control.

Target Architecture

The target architecture separates management, servers, protected storage, users, IoT/OT, printers, guests, and lab/testing systems. Inter-zone access is explicitly governed by business need instead of broad network adjacency. The physical design now also includes a secondary Cisco managed switch connected to the primary switching layer through an 802.1Q trunk.

Network Segmentation Foundation — Current Progress

The segmentation foundation now includes a dedicated privileged-management plane and a validated multi-switch VLAN architecture. Management, server, storage, IoT, printer, and lab service paths have been validated through the intended security boundaries. CHG-014 has passed final acceptance after server, storage, and lab acceptance across the Cisco/Fortinet trunk, trunk cleanup, configuration persistence, recovery backups, and real print/scan workflow validation.

Security & Operations Remediation

CHG-001 — DHCP Gateway Remediation PASS

Corrected a stale DHCP gateway configuration and established deterministic routing on the management workstation while preserving Internet access and administrative reachability.

CHG-002 — WAN Administrative Access Hardening PASS

Removed unnecessary web-management and auxiliary administrative services from the WAN-facing interface while retaining limited troubleshooting capability.

CHG-003 to CHG-005 — Privileged Access Governance PASS

Introduced a named MFA-protected administrator restricted to trusted management sources, converted the built-in administrator into an emergency break-glass account, and removed an unused privileged account.

CHG-006 — Logging Baseline PASS

Improved denied-traffic visibility while deliberately avoiding excessive high-volume session logging until persistent external logging is implemented.

CHG-007 — DNS Path Correction PASS

Removed an unintended ISP-provided DNS override, renewed the client lease, and validated successful name resolution against the intentionally configured system resolvers.

CHG-008 — Management-Plane Separation PASS

Removed web administration from the ordinary user network while preserving management access through the existing administrative path. Validation confirmed that the user network could no longer reach the firewall management interface over HTTPS.

CHG-009 — IoT Segmentation & End-to-End Service Validation PASS

A wired LoRaWAN/IoT gateway was migrated out of the shared user network and into a dedicated IoT security zone. The migration preserved outbound connectivity while restricting access to required management and application services only.

Validated end to end: VLAN and DHCP migration, outbound connectivity, restricted management access, local network-server administration, real endpoint join and application uplinks, explicit MQTT policy, raw broker publish/subscribe, and application-level ingestion/decoding of live telemetry.

CHG-010 — Infrastructure Address Stabilization PASS

Critical service dependencies were stabilized with centrally managed DHCP reservations. This removed avoidable address drift from firewall objects and service integrations while retaining central network control rather than relying on manually configured endpoint addresses.

CHG-011 — Printer Security-Zone Segmentation PASS

A shared multifunction printer was migrated from the user network into a dedicated printer zone. Access from the user network is limited to required printing and status services instead of general connectivity.

• Dedicated printer VLAN and DHCP scope created before migration.
• Stable printer reservation established.
• RAW printing, IPP, and LPR connectivity validated after migration.
• Business printing functionality preserved.
• Web administration from the user network remains blocked by design.

CHG-012 — Protected Storage Segmentation PASS

Network-attached storage was migrated from the shared user segment into a dedicated storage zone. Rather than allowing the full user network to reach protected storage, SMB access is scoped to explicitly authorized endpoints.

• Dedicated storage VLAN and DHCP scope created before migration.
• Stable storage reservation established.
• Host-scoped SMB policy limits access to approved endpoints.
• Windows and macOS access validated after migration.
• Authentication and share enumeration validated.
• Real create/read/delete operations completed using non-production test data.
• Storage web administration is available through the dedicated management plane rather than the ordinary user network.

CHG-013 — Dedicated Management VLAN PASS

A dedicated privileged-management plane was established for infrastructure administration. The primary Windows management workstation now uses a dedicated management interface while ordinary user connectivity remains separate.

• Dedicated management VLAN and DHCP scope implemented.
• MFA-protected firewall administration validated from the management path.
• Primary management workstation validated against firewall and switch administration.
• Explicit management policies provide administrative access to storage, printer, and IoT infrastructure without reopening the ordinary user network.
• A separate fallback management endpoint and legacy recovery path were retained during the migration.
• Host firewall, disk encryption, Secure Boot, TPM, forwarding, bridge, and Internet Connection Sharing state were reviewed on the primary management workstation.

CHG-014 — Cisco Integration, 802.1Q Trunk & Workflow Closure PASS

CHG-014 integrated the Cisco secondary switch into the segmented architecture without flattening the environment. The work was intentionally completed in stages: preserve recovery, establish switch management, build and validate the trunk, prove multiple VLANs end-to-end, remove unnecessary trunk membership, save and back up configuration, then validate real print/scan workflows from both management and ordinary user endpoints.

Phase A — Safe Cisco Management Integration

• 014-A1: inspected the existing Cisco configuration and captured a pre-change backup.
• 014-A2: moved Cisco management into the dedicated management zone while retaining a direct fallback path.
• 014-A3: validated management over the production uplink before trunk conversion.
• 014-A4: aligned management, server, storage and lab VLAN roles in the Cisco VLAN database.

Phase B — 802.1Q Trunk & Server/Lab Foundation

• 014-B1: built the server VLAN gateway and DHCP scope.
• 014-B2: built the lab VLAN gateway and DHCP scope.
• 014-B3: converted the Cisco uplink to an 802.1Q trunk with management native/untagged and server/storage/lab tagged.
• 014-B4: matched the FortiSwitch uplink to the intended trunk.
• 014-B5: validated a physical server-zone endpoint with DHCP and a 235-packet gateway test at 0% loss.
• 014-B6: validated server-zone Internet/NAT and DNS.
• 014-B7: proved that the server VLAN could not administer the management plane.

Phase C — Trunk Acceptance, Cleanup & Real Workflow Validation

• 014-C1: restored a temporary staging switch port to its documented default/quarantine baseline.
• 014-C2: validated the storage VLAN across the Cisco trunk using DHCP, gateway reachability and an actual SMB service test.
• 014-C3: validated the lab VLAN and confirmed management HTTPS remained blocked from that zone.
• 014-C4: restored the test port to its normal server access role and repeated the server acceptance tests.
• 014-C5: removed unnecessary default-VLAN membership from the Cisco trunk while preserving management reachability.
• 014-C6: copied running configuration to startup configuration and verified the unsaved-change indicator cleared.
• 014-C7/C8: captured final Cisco and FortiGate post-change backups.
• 014-C9: repeated the final server-zone DHCP/gateway/Internet/isolation acceptance test.
• 014-C10: restored the ASUS lab endpoint to its normal connectivity.
• 014-C11: extended the proven copier scan service to authorized user endpoints without exposing printer administration.
• 014-C12: corrected a clean ASUS printer queue to a stable-IP Standard TCP/IP RAW printing model; new and previously queued jobs physically printed.
• 014-C13: completed a real cross-VLAN scan from the previously unconfigured ASUS.
• 014-C14: removed an obsolete diagnostic UDP scan path from the firewall and Windows host firewall, then repeated physical scans to prove the retained TCP workflow was sufficient.

Result: the inter-switch trunk is now frozen as a validated baseline. Management remains isolated, server/storage/lab VLANs have been proven end-to-end, Cisco and FortiGate recovery artifacts are preserved, and authorized user computers can print and scan to the isolated multifunction copier using stable network addressing while administration remains restricted to the management plane.

Printer / Scanner Access Model After CHG-014

The multifunction copier remains isolated in the printer VLAN. Ordinary user computers receive only the services required for printing, status and PC-initiated scanning, while web administration remains restricted to the management plane.

Discovery note: automatic broadcast-style discovery was not relied upon across routed VLAN boundaries. The validated deployment pattern uses the copier’s stable network address. This provides a predictable enterprise configuration and can later be automated through endpoint management rather than weakening segmentation for discovery traffic.

Troubleshooting & Fault Isolation

The work deliberately separates physical link, VLAN membership, routing, transport, service, authentication, and application evidence. Firewall counters are not treated as proof of application success. For IoT, the path was validated independently through network-server events, packet capture, MQTT publish/subscribe, and application ingestion. For storage, connectivity was separated from authentication and permissions before the NAS was moved.

During server-VLAN trunk testing, a test workstation briefly had both Wi-Fi and Ethernet active. Rather than treating confusing reachability symptoms as a trunk failure, Wi-Fi was disabled and the Ethernet path was re-tested in isolation. The resulting sustained test completed 235 gateway replies with 0% loss. This reinforced the operating principle of eliminating alternate paths before diagnosing VLAN or routing faults.

Change-Control Method

• Capture current state before every meaningful change.
• Preserve a known-good recovery path during management-plane and trunk changes.
• Make one controlled change at a time and define rollback before implementation.
• Use source-interface evidence and packet capture to prove which path actually carried a test.
• Validate real workflows, not only port reachability: management login, DHCP, DNS, Internet, SMB, physical printing and physical scanning.
• Remove temporary diagnostic rules only after a successful disable-and-retest sequence.
• Save running configuration to startup and capture final backups as explicit acceptance items.

Architecture Decisions & Trade-offs

• Incremental segmentation: preserves availability while security zones are introduced one workload at a time.
• Dedicated management plane: infrastructure administration is separated from ordinary user traffic rather than temporarily reopening administrative services on the user network.
• 802.1Q trunking: extends multiple controlled security zones to a secondary switch while preserving a native management path.
• Central DHCP reservations: provides stable infrastructure dependencies without spreading manual static-address configuration across devices.
• Service-specific printer access: preserves printing while withholding administrative interfaces from ordinary users.
• Host-scoped storage access: protects sensitive storage more aggressively than a broad user-subnet allow rule.
• Management isolation for server endpoints: server Internet access does not imply administrative access to network infrastructure.
• Validate at multiple layers: link state, VLAN assignment, routing, transport, authentication, service behavior, and application outcomes are tested independently.
• Document licensing reality: expired subscription-backed security services are not represented as active protection.

Leadership Perspective

The objective is not simply to configure individual devices. The work demonstrates architecture sequencing, risk reduction, service continuity, change governance, fault isolation, documentation, and the ability to move between business requirements and hands-on implementation. The environment is being built as a governed platform in which network, endpoint, server, and IoT/OT capabilities can be introduced without returning to broad implicit trust.

Public Disclosure

This case study intentionally sanitizes infrastructure evidence. Exact addressing, hostnames, MAC addresses, serial numbers, account names, credentials, SSIDs, security tokens, NAS share names, radio identifiers, tenant/application IDs, and screenshots containing sensitive administrative data are withheld or redacted.

Final Secure Infrastructure Milestone — CHG-015

CHG-015 extends the segmented network foundation into a resilient compute and application platform. The work combines protected storage, layered recovery, containerized workloads, virtualization readiness, and a controlled release path for locally validated services.

Resilient Storage & Recovery Foundation VALIDATED

A mirrored storage pool, encrypted application volume, hardened workload shares, scheduled snapshots, and a secondary-NAS recovery path were built and tested. Least-privilege backup access and staggered production jobs were then validated. A separate Microsoft OneDrive proof demonstrated off-site backup and successful cloud-to-NAS restore before broader rollout was intentionally deferred.

Containerized Application Platform VALIDATED

Container Station was deployed and validated with a local NGINX workload, controlled network-port publishing, stop/start lifecycle testing, and persistent host-folder bind mounts. These checks established a repeatable runtime pattern before introducing real application content.

Virtualization Foundation VALIDATED

Virtualization Station passed firmware, hardware-virtualization, and memory prerequisite checks. An isolated virtual switch was created without changing the production management path, providing a safe network foundation for the planned LAB-VM-01 workload.

Git-Based Application Deployment VALIDATED

A public portfolio repository was cloned from GitHub into persistent NAS storage using a temporary Git container and then served through a separate NGINX container on the internal network. The deployment was validated in parallel with the existing public site, demonstrating a staged release pattern that preserves production availability while changes are reviewed locally.

Application & Hosting Architecture

The platform remains intentionally staged: secure publishing and production application workloads are still planned, the QNAP application and hosting layer remains in progress, and the local plus off-site data-protection foundation has now been validated.

CHG-015 Validation Record

Control	Validation / Outcome	Status
Storage & snapshots	Mirrored storage, encrypted application volume, hardened workload shares, and scheduled snapshot protection are operational.	Validated
Local backup & restore	Least-privilege secondary-NAS backup operations and a successful restore path were validated.	Validated
Off-site recovery proof	Microsoft OneDrive backup and a cloud-to-NAS restore proof were completed successfully before broader rollout.	Validated
Container runtime	Container Station, NGINX runtime behavior, controlled port publishing, lifecycle operations, and persistent bind-mounted storage were validated.	Validated
Virtualization foundation	Virtualization Station prerequisites and an isolated virtual switch were validated without changing the production management path.	Validated
Git-based local deployment	A public repository was cloned into persistent NAS storage and served locally through a separate NGINX container for staged acceptance.	Validated
LAB-VM-01	Memory planning and the first isolated lab-VM workload remain to be completed.	Planned
Secure publishing	External DNS, tunnel/reverse-proxy publishing, and production application exposure remain gated behind local acceptance and hardening.	Planned

CHG-015 Remaining Work

The remaining CHG-015 work completes the QNAP application-platform milestone before this Secure Infrastructure roadmap is considered complete.

• Formalize the Git-based local-to-production update workflow and rollback sequence.
• Review memory requirements and complete LAB-VM-01 planning.
• Continue secure publishing design only after local application acceptance and platform hardening.
• Introduce production-oriented application workloads as separate documented and validated milestones.