Enterprise network architecture case study for a fictional two-site insurance brokerage, integrating segmentation, secure WAN connectivity, resilience, structured cabling, physical security and five-year investment planning.
This project presents the proposed enterprise network architecture for AM – Corretor de Seguros, Lda., a fictional insurance brokerage with:
- Lisbon headquarters: 40 employees;
- Porto branch office: 10 employees.
The design translates operational, security, continuity and growth requirements into a complete infrastructure proposal covering network topology, IPv4 planning, VLAN segmentation, routing, WAN connectivity, security controls, active and passive infrastructure, backup strategy, electrical protection and financial planning.
The project is intentionally documented as an architecture and infrastructure design case study. It does not claim that the complete solution was physically deployed in production.
The organization handles operationally sensitive information and depends on continuous access to digital services for activities such as insurance policy processing, claims management, accounting and communication with insurers and clients.
The network therefore needs to support:
- secure departmental separation;
- controlled access to shared infrastructure;
- reliable Internet connectivity;
- secure communication between Lisbon and Porto;
- protection against lateral movement;
- operational continuity during partial infrastructure failures;
- future growth without immediate redesign;
- predictable medium-term investment.
| Area | Lisbon Headquarters | Porto Branch |
|---|---|---|
| Users | 40 | 10 |
| Physical topology | Hierarchical star | Simplified star |
| Switching | Layer 3 core + managed PoE+ access layer | Managed Layer 2 PoE+ access switch |
| Inter-VLAN routing | Layer 3 core switch | Local firewall |
| WAN | Dual fixed ISP | Fixed ISP + 4G/5G backup |
| Inter-site connectivity | Site-to-site IPsec VPN endpoint | Site-to-site IPsec VPN endpoint |
| Wireless | Managed APs + isolated Guest network | Managed AP + isolated Guest network |
| Physical security | CCTV + access control | CCTV + access control |
| Technical space | Dedicated rack / technical room | Wall-mounted mini-rack |
High-level WAN architecture connecting Lisbon and Porto through site-to-site IPsec, with site-specific Internet redundancy.
Portfolio note: the diagrams in this repository are visual representations of the proposed architecture. They document design intent and should not be interpreted as production deployment evidence.
Lisbon uses a hierarchical design to separate core and access functions.
The proposed architecture includes:
- enterprise perimeter firewall;
- Layer 3 core switch;
- managed PoE+ access switches;
- 10 Gb internal backbone;
- centralized server and storage infrastructure;
- managed wireless access;
- VoIP;
- CCTV;
- physical access control;
- dual-ISP connectivity.
Topology comparison used to justify the hierarchical headquarters design.
Porto uses a smaller architecture proportional to its operational scale.
Rather than reproducing the headquarters design, the branch uses:
- local enterprise firewall;
- managed Layer 2 PoE+ access switch;
- firewall-based inter-VLAN routing;
- managed wireless access;
- VoIP;
- CCTV;
- physical access control;
- fixed Internet access with 4G/5G backup.
This reduces unnecessary hardware and complexity while preserving the same segmentation and security principles.
Porto branch design: simplified switching, firewall-based routing and a cellular backup path.
The original academic report identifies 10.0.0.0/16 as the global private block while also assigning 10.1.X.0/24 networks to Porto.
Because 10.1.X.0/24 is outside 10.0.0.0/16, the public portfolio version corrects the hierarchy while preserving the VLAN subnets themselves:
- Private enterprise space:
10.0.0.0/8 - Lisbon site allocation:
10.0.0.0/16 - Porto site allocation:
10.1.0.0/16 - Individual VLANs:
/24
This keeps the location-based addressing convention coherent and avoids changing the original departmental VLAN assignments.
| VLAN | Function | Subnet | Gateway |
|---|---|---|---|
| 10 | Direction / CEO | 10.0.10.0/24 |
10.0.10.1 |
| 20 | Human Resources | 10.0.20.0/24 |
10.0.20.1 |
| 30 | Claims | 10.0.30.0/24 |
10.0.30.1 |
| 40 | Commercial | 10.0.40.0/24 |
10.0.40.1 |
| 50 | Administration | 10.0.50.0/24 |
10.0.50.1 |
| 60 | Accounting | 10.0.60.0/24 |
10.0.60.1 |
| 70 | IT | 10.0.70.0/24 |
10.0.70.1 |
| 80 | Voice / VoIP | 10.0.80.0/24 |
10.0.80.1 |
| 85 | CCTV | 10.0.85.0/24 |
10.0.85.1 |
| 90 | Servers | 10.0.90.0/24 |
10.0.90.1 |
| 99 | Infrastructure Management | 10.0.99.0/24 |
10.0.99.1 |
| 170 | Guest Wi-Fi | 10.0.170.0/24 |
10.0.170.1 |
| VLAN | Function | Subnet | Gateway |
|---|---|---|---|
| 40 | Commercial | 10.1.40.0/24 |
10.1.40.1 |
| 50 | Administration | 10.1.50.0/24 |
10.1.50.1 |
| 60 | Accounting | 10.1.60.0/24 |
10.1.60.1 |
| 70 | IT | 10.1.70.0/24 |
10.1.70.1 |
| 80 | Voice / VoIP | 10.1.80.0/24 |
10.1.80.1 |
| 85 | CCTV | 10.1.85.0/24 |
10.1.85.1 |
| 170 | Guest Wi-Fi | 10.1.170.0/24 |
10.1.170.1 |
The /24 model deliberately provides more host capacity than the current organization requires, preserving room for growth without renumbering individual VLANs.
The design follows a least-privilege, deny-by-default approach.
Inter-VLAN traffic is blocked unless a business or technical requirement explicitly justifies the flow.
Key policy principles include:
- departmental VLANs can reach required internal services;
- departmental traffic to other departments is blocked by default;
- Internet access is restricted to required services;
- the IT VLAN can perform controlled administrative access;
- Guest Wi-Fi is isolated from all internal VLANs;
- Guest traffic is allowed only to the Internet through NAT;
- Voice traffic is isolated and limited to required VoIP flows;
- CCTV is isolated from user networks and direct Internet access;
- infrastructure management uses a dedicated management VLAN;
- server outbound access is restricted to required updates and external services.
Conceptual deny-by-default segmentation model: only explicitly justified inter-VLAN flows are permitted.
At Lisbon, inter-VLAN routing is performed by the Layer 3 core switch, while filtering policies are centralized through the security architecture.
At Porto, both inter-VLAN routing and filtering are performed by the local firewall.
This split reflects the different scale and topology of the two locations.
Lisbon and Porto are connected through a proposed site-to-site IPsec VPN over Internet connectivity.
A dedicated WAN service such as MPLS was considered, but the higher recurring cost was not considered proportional to the organization's size.
IPsec was selected to provide:
- encrypted inter-site traffic;
- integrity protection;
- gateway authentication;
- lower recurring cost than a dedicated private circuit.
Lisbon
- two fixed Internet providers;
- automatic failover at the firewall.
Porto
- primary fixed Internet connection;
- secondary 4G/5G connection.
The objective is to reduce dependence on a single provider and preserve essential connectivity during ISP failure.
The proposed firewall architecture includes:
- IDS/IPS;
- deny-by-default policies;
- NAT;
- application and service control;
- VLAN-aware filtering;
- IPsec termination;
- WAN failover;
- centralized or forwarded event logging.
A centralized syslog capability is proposed in Lisbon to consolidate security and infrastructure events, support troubleshooting and improve auditability.
Security controls mapped across the OSI model, from physical protection to application-layer safeguards.
VoIP is assigned to a dedicated VLAN.
QoS capability is included in the switching design to prioritize latency-sensitive voice traffic and reduce the effect of congestion on call quality.
Guest Wi-Fi is isolated from the corporate network.
The Guest VLAN is designed for Internet-only access and is not permitted to communicate with internal business segments.
CCTV uses a dedicated VLAN to prevent cameras from becoming a path into corporate user networks.
The proposal includes:
- 8 PoE IP cameras in Lisbon;
- 4 PoE IP cameras in Porto;
- local NVR storage;
- physical access control;
- restricted access to surveillance infrastructure.
The proposed design includes:
- enterprise NGFW with dual-WAN and IDS/IPS;
- Layer 3 core switch with 10 Gb uplinks;
- managed PoE+ access switching;
- physical server platform for virtualization;
- enterprise NAS;
- managed wireless access points;
- CCTV and access-control infrastructure;
- WAN backup capability.
- enterprise firewall with IPsec capability;
- managed Layer 2 PoE+ switching;
- managed wireless access point;
- CCTV and local access-control infrastructure;
- 4G/5G WAN backup.
Equipment selection was based on business scale, security functionality, supportability and a five-year lifecycle rather than lowest initial purchase price alone.
The passive infrastructure is designed around Cat6A horizontal cabling.
Planning estimates include:
| Location | Estimated network points | Estimated Cat6A |
|---|---|---|
| Lisbon | 120 | ~2,300 m |
| Porto | 31 | ~400 m |
The physical design also includes:
- patch panels;
- rack organization;
- structured labeling;
- technical cable routing;
- installation margin for reorganization and future growth.
Functional layout used to relate departmental areas, network services and physical infrastructure planning.
The rack diagrams represent the intended functional organization of network, security and power-protection equipment rather than as-built production documentation.
The Lisbon backbone between core and access switching uses multimode OM4 fiber at 10 Gb.
The choice was justified by:
- bandwidth;
- immunity to electromagnetic interference;
- longer useful lifecycle;
- preparation for future throughput requirements.
The architecture combines local and external protection.
The proposed backup strategy includes:
- NAS-based local backups;
- encrypted off-site/cloud copies;
- scheduled backup policies;
- configuration backups for network equipment;
- retention planning;
- differentiated recovery targets by service criticality.
Example recovery objectives from the design include:
| Data / Service | RPO | RTO |
|---|---|---|
| Active Directory / DNS | 24 h | < 4 h |
| Internal file services | 24 h | < 6 h |
| Firewall configurations | 7 days | < 2 h |
| Core / switch configurations | 30 days | < 4 h |
| Microsoft 365 backup | 24 h | < 8 h |
Backup, retention and recovery objectives for critical infrastructure and business services.
The backup design is therefore treated as part of operational continuity rather than as a standalone storage feature.
UPS protection is included at both sites.
The proposed UPS protects critical core infrastructure including:
- firewall;
- core switching;
- server;
- NAS.
The design includes enough autonomy to support controlled shutdown during a prolonged power interruption.
UPS protection covers the smaller local infrastructure, including firewall, PoE switching and WAN backup equipment.
The architecture uses a five-year planning horizon.
The design considers:
- firewall and switch lifecycle;
- server and NAS capacity;
- UPS battery replacement;
- vendor support and security updates;
- growth margin;
- energy efficiency;
- upgrade potential.
The objective is to avoid both premature replacement and unnecessary over-dimensioning.
The project separates initial infrastructure investment from recurring operating costs.
| Category | Planned Cost |
|---|---|
| Active equipment — Lisbon, excluding UPS | €9,660 |
| Active equipment — Porto, excluding UPS | €2,580 |
| Passive infrastructure | €6,078 |
| Electrical protection / UPS | €1,350 |
| CCTV and physical access control | €2,810 |
| Total CAPEX | €22,478 |
The detailed site equipment tables include the site UPS line items; the consolidated financial summary excludes those UPS values from the site subtotals because electrical protection is accounted for separately.
The design estimates recurring costs for:
- telecommunications;
- security subscriptions / UTM licensing;
- Microsoft 365;
- cloud backup;
- preventive maintenance.
Estimated five-year OPEX: €43,600
Estimated five-year Total Cost of Ownership: €66,078
Equivalent planning average:
approximately €1,101/month
All financial values are planning estimates used for architecture and investment analysis rather than supplier quotations.
Five-year investment summary separating initial infrastructure cost from recurring operating expenditure.
The most important design decisions are documented separately in:
Key trade-offs include:
- hierarchical headquarters design vs. simplified branch design;
- Layer 3 core routing vs. firewall routing;
- IPsec over Internet vs. dedicated WAN service;
- security segmentation vs. unrestricted internal communication;
- resilience proportional to business scale;
- enterprise equipment lifecycle vs. lowest upfront cost.
This repository documents a proposed enterprise network architecture.
It demonstrates:
- requirements analysis;
- architecture design;
- subnetting and addressing;
- VLAN segmentation;
- policy design;
- resilience planning;
- equipment selection;
- passive infrastructure planning;
- continuity strategy;
- financial analysis.
It does not claim that the complete infrastructure was physically installed or deployed in a production insurance environment.
secure-enterprise-network-design/
├── README.md
├── notes/
│ ├── overview.md
│ ├── design-decisions.md
│ └── technical-scope.md
└── assets/
├── architecture/
│ ├── headquarters-topology-comparison.png
│ ├── lisbon-porto-wan-architecture.png
│ └── porto-branch-topology.png
├── segmentation/
│ ├── deny-by-default-segmentation.png
│ └── security-controls-osi-layers.png
├── physical-infrastructure/
│ ├── lisbon-functional-layout.png
│ ├── lisbon-rack-design.png
│ └── porto-mini-rack-design.png
├── resilience/
│ └── backup-rpo-rto-policy.png
└── financial-planning/
└── financial-planning-summary.png
The repository deliberately uses a curated visual set rather than reproducing the complete academic report. The emphasis is on architecture, engineering decisions, security policy, resilience and investment planning.
Architecture design completed.
The project provides a complete proposed solution covering:
- two-site enterprise topology;
- IPv4 and VLAN planning;
- inter-VLAN security policy;
- IPsec WAN connectivity;
- ISP redundancy;
- structured cabling;
- active infrastructure;
- backup and recovery planning;
- electrical protection;
- physical security;
- five-year financial planning.
Technologies & Concepts: VLAN · IEEE 802.1Q · IPv4 · Subnetting · Layer 3 Switching · ACL · IPsec · IDS/IPS · NAT · QoS · PoE+ · Syslog · Cat6A · OM4 Fiber · UPS · RPO · RTO · CAPEX · OPEX · TCO