Secure enterprise network infrastructure built from scratch for a simulated SME, featuring VLAN segmentation, next-gen firewalling, centralised SIEM, endpoint protection, and red/blue team validation. Designed, deployed, and documented over 13 weeks as a team of four.
Unit: VU23220 — Develop and carry out a cyber security industry project
Institution: The Gordon Institute of TAFE
Framework: ASD Essential Eight — targeting Maturity Level 2
Methodology: Agile / SCRUM
graph TD
Internet["🌐 Internet"] --> PA["Palo Alto Firewall"]
PA -->|"VLAN 50 – 192.168.50.0/24"| DMZ["DMZ Zone"]
PA -->|"VLAN 100 – 192.168.100.0/24"| INFRA["Infrastructure Zone"]
PA -->|"VLAN 101 – 192.168.101.0/24"| CA["Clients Group A"]
PA -->|"VLAN 102 – 192.168.102.0/24"| CB["Clients Group B"]
PA ---|"Trunk (All VLANs)"| SW["MikroTik Switch"]
SW -->|"ether5 – Access"| DMZ
SW -->|"ether2 – Access"| INFRA
SW -->|"ether3 – Access"| CA
SW -->|"ether4 – Access"| CB
DMZ --> DMZS["Ubuntu Web Server (Secure)"]
DMZ --> DMZI["Ubuntu Web Server (Insecure)"]
INFRA --> DC["Windows Server 2025\n(Domain Controller)"]
INFRA --> SIEM["SIEM Server\n(Elasticsearch + Kibana)"]
CA --> C1["Windows 10 – George"]
CA --> C2["Windows 10 – Sam"]
CB --> C3["Windows 10 – Dakotah"]
CB --> C4["Windows 10 – Will"]
| VLAN | Subnet | Zone | Purpose | Devices |
|---|---|---|---|---|
| 50 | 192.168.50.0/24 | DMZ | Public-facing web servers | 2x Ubuntu |
| 100 | 192.168.100.0/24 | INFRA | Domain Controller + SIEM | Win Server 2025, Elastic Stack |
| 101 | 192.168.101.0/24 | CLIENTS_A | Workstation group A | 2x Windows 10 |
| 102 | 192.168.102.0/24 | CLIENTS_B | Workstation group B | 2x Windows 10 |
Inter-VLAN traffic is routed through the Palo Alto with zone-based security policies. Client groups A and B cannot communicate with each other. All zones reach INFRA for AD/DNS/SIEM, and all outbound traffic is NATed through the firewall.
12 security policies control all inter-zone traffic, plus a custom Security Profile Group (Default-Secure) applied to all rules:
- Antivirus: Custom
Corp-AVprofile - Anti-Spyware: Strict (connection reset on detection)
- Vulnerability Protection: Strict (connection reset)
- URL Filtering: Strict (connection reset)
- WildFire Analysis: Default
A 13th temporary policy was added during red team testing to bypass security profiles for attack simulation, then removed post-testing.
Elastic Stack (Elasticsearch + Kibana + Fleet) deployed on a dedicated Ubuntu server. All agent-to-SIEM communication encrypted.
Elastic Agents deployed to 8 endpoints:
- SIEM server, Domain Controller, 2x DMZ servers, 4x Windows clients
Custom and prebuilt detection rules (14 active + 1,400+ default Elastic rules)
The project targeted ASD Essential Eight Maturity Level 2. Here's what we implemented:
| Strategy | Implementation | Status |
|---|---|---|
| Application Control | AppLocker policies via Group Policy | Implemented |
| Patch Applications | Manual patching of all applications | Implemented |
| Configure Microsoft Office Macros | Macro restrictions via GPO | Implemented |
| User Application Hardening | Browser and app hardening via GPO | Implemented |
| Restrict Administrative Privileges | Role-based AD groups, least-privilege enforcement | Implemented |
| Patch Operating Systems | All Windows and Ubuntu systems patched | Implemented |
| Multi-factor Authentication | MFA configured for privileged accounts | Implemented |
| Regular Backups | SSD-based backups of all system images | Implemented |
Testing was conducted after-hours on isolated systems with dummy accounts to avoid disrupting live services.
Red team activities:
- External reconnaissance with Nmap and Nikto against DMZ services
- Vulnerability scanning of the full network perimeter
- Payload delivery via simulated social engineering (reverse shell)
- Privilege escalation attempts using Meterpreter
- Data exfiltration simulation
Blue team activities:
- Real-time monitoring via Kibana dashboards and Elastic Security alerts
- Rule tuning during purple team collaboration
- Incident investigation and alert triage
Key outcomes:
- Palo Alto security profiles blocked initial attack attempts (policy had to be temporarily relaxed to test defence in depth)
- Elastic detection rules successfully triggered on payload delivery, privilege escalation, and lateral movement
- Segmentation policies prevented cross-VLAN movement between client groups
- Average SIEM alert trigger time: ~5 minutes. Palo Alto response: near-instantaneous
| Component | Technology |
|---|---|
| Firewall | Palo Alto (NGFW) |
| Switch | MikroTik (VLAN-capable, managed) |
| SIEM | Elastic Stack (Elasticsearch + Kibana) |
| Endpoint Agents | Elastic Agent (via Fleet) |
| Domain Controller | Windows Server 2025 + Active Directory |
| Clients | Windows 10 (domain-joined) |
| DMZ Servers | Ubuntu Linux (Apache2) |
| Prototyping | GNS3 + VirtualBox + OPNsense |
| Project Management | Trello, Microsoft Project, GitHub |
Duration: 13 weeks (25 March — 26 June 2025)
Budget: $9,900 actual vs $16,470 baseline (under budget)
Work hours: 284h actual vs 473h baseline
| Phase | Period | Key Activities |
|---|---|---|
| Planning | April | WBS, scope document, Trello setup, MS Project migration |
| Infrastructure | Late April — May | Physical cabling, MikroTik switch config, Palo Alto setup, Windows Server/AD, GNS3 prototyping |
| Security & Monitoring | May — June | Elastic SIEM deployment, agent rollout to 8 endpoints, detection rule config, GPO hardening, AppLocker |
| Testing & Handover | June | Red/blue team exercises, documentation, final presentation |
The WBS (Microsoft Project file) and monthly reports contain the full scheduling and tracking detail.
| Member | Role | Primary Responsibilities |
|---|---|---|
| George | SCRUM Master | Network infrastructure (MikroTik, Palo Alto), VLAN/subnet design, inter-VLAN routing, project coordination, stakeholder comms, meeting documentation |
| Will | Team Member | Windows Server 2025, Active Directory, Group Policies, firewall security policies, AppLocker |
| Sam | Team Member | Elastic SIEM installation, agent deployment, detection rules, log configuration |
| Dakotah | Team Member | Elastic SIEM configuration, Kibana dashboards, agent troubleshooting, detection rules |
The team operated in pairs: George + Will on core infrastructure and networking, Sam + Dakotah on SIEM and endpoint security. All members contributed to documentation and red/blue team testing.
The MikroTik variation was a double-edged sword. Switching from a Cisco switch to MikroTik saved on licensing costs but introduced unexpected issues with SIEM NetFlow ingestion that consumed significant troubleshooting time. The team eventually made the pragmatic call to deprioritise NetFlow and focus on core deliverables. In hindsight, locking in hardware decisions earlier and assessing integration compatibility upfront would have saved weeks.
AppLocker is harder than it looks. Configuration was more time-consuming than anticipated, with overly restrictive policies locking out legitimate applications. Iterative paired testing (one person triggering, one monitoring) was the approach that eventually got it working reliably.
Prototyping in GNS3 first was one of our best decisions. Using OPNsense as a stand-in for the Palo Alto in a virtual environment let us validate segmentation logic and firewall rules before touching production hardware. This saved significant rework.
Documentation debt is important. Early documentation was too loose and had to be significantly tightened mid-project. The retrospective decision to dedicate end-of-day time to documentation paid off and reduced the handover workload substantially.
Know when to cut scope. The NetFlow decision, the fifth client VLAN that never materialised, and the compressed red/blue testing window were all scope cuts that let us deliver a complete, functional system rather than an ambitious but incomplete one.
- Project Scope — objectives, deliverables, constraints, assumptions, and approvals
- Technical Documentation (AT2) — full implementation detail across all three phases
- Finalisation Retrospective — risk register, budget analysis, critical path, and project Q&A
- Monthly Reports — progress tracking, cost analysis, and sprint retrospectives
- SIEM & Elastic Documentation — Elastic Stack setup, Fleet, agent deployment, and rule config
Completed as part of the Certificate IV in Cyber Security (22603VIC), delivered through The Gordon Institute of TAFE.