Debre Berhan University
College of Computing Science
Department of Information Technology
Network Design and Simulation for North Shewa Zone High Court
Prepared By: Matias Bahiru
ID NO: DBU1803339
Submitted to: Mr Binyam Tekalign
January 26, 2026
Network Design and Simulation for North Shewa Zone High Court
Introduction
North Shewa Zone High Court is one of the leading institutions providing judicial
services under the Amhara Supreme Court. As its name suggests, this institution is
located in Debre Berhan city, North Shewa Zone. The institution's building has three
floors, including the ground floor, and contains many service offices, courtrooms,
and a large conference hall. This court has a total of around 167 employees and is
providing efficient and fair judicial services to the community.
Requirement of the organization
Support 150 employees with fast, reliable and secure internet connectivity for
communication.
Deploying centralized server.
Future scalability for additional users and services.
Ensure 24/7 network availability.
Deploying Network access across all the building offices.
Network infrastructure currently used and their descriptions
Minimal existing infrastructure, primary computers and printers connected
throughout the facilities, wired Ethernet and basic wireless connectivity with few
devices needing upgrade to support critical applications. No dedicated server or
centralized network management.
User requirements
Reliable and high-speed LAN connectivity.
VPN access for remote users.
Wireless access points for mobile devices.
High security for sensitive legal data.
1
Simplified troubleshooting.
Uninterrupted network access(24/7 uptime)
Support for future expansion.
Redundant link.
Scope
Design a hierarchical, scalable network aligned with the re-engineering network
design methodology (core, distribution, access layers). Ensure security
enhancements and management with VLAN segmentation and firewall, high-
availability connectivity across floors with fiber optic backbone and managed
switches, wireless access coverage throughout premises, LAN expansion throughout
the floors and deployment of centralized server.
Critical application
North Shewa Zone High Court has no more critical application but for the time being
it has court case management system as a critical application.
Selecting networking equipment
Router for internet connectivity
Firewall for security
Router for backbone connectivity (connecting all distribution layers)
Distribution switches (layer 3) for routing, VLAN segmentation, security
policy enforcement and managing traffic to and from the core.
Access switches (layer 2) on each floor for connecting end-user devices
(computers, printers) and access points
ISP link to higher bandwidth
End user devices(pc)
2
Logical Topology
I have put Demilitarized Zone for the purpose of enhancing security, controlling
access and treat containment. And also I have configuring link aggregation control
protocol (LACP) ether channel link between two multi-layer switch for increasing
bandwidth, provides redundancy and enables load balancing between switches,
routers, and servers without causing Spanning Tree Protocol (STP) loops.
On the first multi-layer switch
en
conf t
int range gig1/0/21-23
channel-group 1 mode active
exit
interface Port-channel 1
switchport mode trunk
exit
do wr
3
On the second multi-layer switch
en
conf t
int range gig1/0/21-23
channel-group 1 mode passive
exit
interface Port-channel 1
switchport mode trunk
exit
do wr
Configuring spanning-tree portfast on DMZ switch
en
conf t
int range fa0/2-24
spanning-tree portfast
spanning-tree bpduguard enable
exit
Configuring spanning-tree portfast on each access switch
en
conf t
int range fa0/3-24
spanning-tree portfast
spanning-tree bpduguard enable
exit
do wr
Firewall
Used for threat-focused security services.
en
conf t
int gig1/1
no shut
nameif inside1
4
security-level 100
ip add [Link] [Link]
ciscoasa(config-if)#exit
int gig1/2
no shut
nameif inside2
security-level 100
ip add [Link] [Link]
exit
int gig1/4
no shut
nameif dmz
security-level 100
ip add [Link] [Link]
exit
int gig1/3
no shut
nameif outside
security-level 0
ip add [Link] [Link]
exit
do wr
wr MEM
Firewall inspection policy configuration
route OUTSIDE [Link] [Link] [Link]
object network INSIDE1-OUTSIDE
subnet [Link] [Link]
nat (INSIDE1,OUTSIDE) dynamic interface
exit
conf t
object network INSIDE1a-OUTSIDE
subnet [Link] [Link]
nat (INSIDE2,OUTSIDE) dynamic interface
exit
wr mem
exit
conf t
5
access-list RESOURCE-ACCESS extended permit icmp any any
access-list RESOURCE-ACCESS extended permit udp any any eq 67
access-list RESOURCE-ACCESS extended permit udp any any eq 68
access-list RESOURCE-ACCESS extended permit udp any any eq 53
access-list RESOURCE-ACCESS extended permit tcp any any eq 53
access-list RESOURCE-ACCESS extended permit tcp any any eq 80
access-list RESOURCE-ACCESS extended permit tcp any any eq 25
access-list RESOURCE-ACCESS extended permit tcp any any eq 20
access-list RESOURCE-ACCESS extended permit tcp any any eq 21
access-group RESOURCE-ACCESS in interface dmz
access-group RESOURCE-ACCESS in interface OUTSIDE
wr mem
Open Shortest Path First (ospf)
Due to its fast convergence, high scalability using areas, and metric-based routing
(bandwidth) rather than simple hop counts I have select OSPF algorithm.
OSPF configuration on multi-layer switch, routers and firewalls looks like
On multi-layer 1
router ospf 15
router-id [Link]
log-adjacency-changes
network [Link] [Link] area 0
network [Link] [Link] area 0
do wr
On multi-layer 2
router ospf 15
router-id [Link]
log-adjacency-changes
network [Link] [Link] area 0
network [Link] [Link] area 0
do wr
On ISP-Router
router ospf 15
router-id [Link]
network [Link] [Link] area 0
network [Link] [Link] area 0
6
do wr
On Internet-Router
router ospf 15
router-id [Link]
network [Link] [Link] area 0
do wr
On Firewall
router ospf 15
router-id [Link]
network [Link] [Link] area 0
network [Link] [Link] area 0
network [Link] [Link] area 0
network [Link] [Link] area 0
exit
wr
do wr
Sub netting and ip addressing
Category Network and Valid host Default Broadcast
subnet mask address gateway address
LAN [Link]/24 [Link] [Link] [Link]
to
[Link]
[Link]/24 [Link] [Link] [Link]
to
[Link]
[Link]/24 [Link] [Link] [Link]
to
[Link]
DMZ [Link]/27 [Link] [Link] [Link]
to
[Link]
7
ISP-router, Internet-router, firewall and multi-layer switches
Category Network address
ISP-internet [Link]/30
Firewall to ISP-R [Link]/30
Firewall to MSW1 [Link]/30
Firewall to MSW2 [Link]/30
Firewall to DMZ [Link]/27
Basic configuration on each access switches
en
conf t
hostname SFSW
line console 0
password assignment2
login
exit
enable password assignment2
banner motd #UNAUTHORIZED ACCESS IS PROHIBITED!!!#
no ip domain-lookup
service password-encryption
username cisco password assignment2
ip domain-name [Link]
crypto key generate rsa general-keys modulus 1024
ip ssh version 2
line vty 0 15
login local
transport input ssh
exit
do wr
8
Basic configuration on each Multilayer switches
en
conf t
hostname MSW2
line console 0
password assignment2
login
exit
enable password assignment2
banner motd #UNAUTHORIZED ACCESS IS PROHIBITED!!!#
no ip domain-lookup
service password-encryption
username cisco password assignment2
ip domain-name [Link]
crypto key generate rsa general-keys modulus 1024
ip ssh version 2
line vty 0 15
login local
transport input ssh
exit
do wr
Create the VLAN on Multi-layer switches
vlan 10
name Ground_Floor
exit
interface range fa 0/3 - 22
switchport mode access
switchport access vlan 10
9
spanning-tree portfast
exit
int range fa0/1-2
switchport mode trunk
exit
do wr
###first-Floor#####
vlan 20
name First_Floor
exit
interface range fa 0/3 - 22
switchport mode access
switchport access vlan 20
spanning-tree portfast
exit
int range fa0/1-2
switchport mode trunk
exit
do wr
###Second-Floor#####
vlan 30
name Second_Floor
exit
interface range fa 0/3 - 22
switchport mode access
switchport access vlan 30
spanning-tree portfast
exit
int range fa0/1-2
switchport mode trunk
exit
do wr
10