Networking Fundamentals for Office Network Design

Device Analysis and Architectural Foundation

Before designing a secure and functional office network, it is critical to analyze the core hardware
components that govern how data is routed, switched, and secured. A corporate network is not
merely a collection of connected cables, it is a carefully structured environment where traffic flow
must be strictly controlled across multiple layers of the OSI model.
This initial analysis examines the four primary pillars of network infrastructure: Routers, Switches,
Access Points, and Firewalls. By understanding the distinct operational behaviors of each device,
such as how a switch utilizes MAC addresses for local forwarding versus how a router utilizes IP
addresses for external pathfinding, we can establish secure network boundaries. This foundational
knowledge is essential for mitigating risks such as unauthorized lateral movement, packet
interception, and external intrusion, serving as the architectural blueprint for the subsequent office
network design.
Network devices comparison table

Network Device Purpose OSI Layer Office Use Cases

Router The primary job of a router is to Layer 3 Connecting the entire
connect different networks office LAN to the ISP’s
together, most commonly, internet connection.
connecting the internal LAN to Handing out IP
the WAN. They use IP addresses addresses via DHCP
to determine the best path to (Dynamic Host
send packets to their final Configuration
destination using routing tables. Protocol)
Switch The primary purpose of a switch Layer 2 Providing physical
is to facilitate communication and Layer ethernet ports to wire
between devices on the same 3 in employee desktop
network. Switches can be Layer 2 computers, network
or Layer 3 with the latter handling printers, etc.
some extra routing
responsibilities when VLANs are Network segmentation
established within a network and through VLANs to limit
SVIs are assigned to those a breach in case one
VLANs. Switches connect happens
devices on a network through
their MAC addresses and.
Access Point An Access point takes a wired Layer 2 Allows Employee and
connection and projects it as a guest devices to
wireless signal (Wi-Fi). It acts a connect to the
bridge between wireless devices network over Wi-Fi
(laptops, phones) and the wired
switch. An AP dos not assign IP
addresses or routes traffic. It
simply translates radio waves into
electrical frames to pass onto the
switch
Firewall A firewall is a device within a Layer 3, Blocking unauthorized
network responsible for Layer 4, external access to the
determining what traffic is allowed Layer 7 office’s internal file
to enter and exit. It is the border server and preventing
security for a network. An employees from
administrator can configure to accessing known
permit or deny traffic from malicious domains.
entering or exiting a network
based on numerous factors
The firewall can be stateless or
stateful
Private IP, Public IP and DHCP

Public IP Addresses:
Globally unique identifiers assigned to a network edge device (usually a router) by an ISP. They are
visible and routable across the public internet. No two devices on the internet can share the same IP
simultaneously.

Private IP Addresses:
These are localized identifiers used strictly inside your LAN. They are completely hidden from the
outside world. Because they are isolated, different organizations all over the globe can reuse the
exact same private IP ranges simultaneously without any conflict.

IANA (Internet Assigned Numbers Authority) reserved three specific blocks of IPv4 space
strictly for private internal networks

Class A: [Link] to [Link] (Used by large enterprises and universities)

Class B: [Link] to [Link] (Used by medium sized networks)
Class C: [Link] to [Link] (Standard for small offices and home networks)

Feature Private IP Address Public IP Address

Scope LAN WAN
Routability Non-routable on the public Fully routable across the
internet. Dropped by public global internet
routers
Uniqueness Must be unique only within Globally unique across the
the local network. Reused entire world
globally
Cost Completely free to assign and Provided by ISPs. Usually
use incurring a monthly cost
Typical Device Employee laptops, internal Router, WAN interface of the
switches, office printers etc office edge firewall

Static IP vs Dynamic IP

Feature Static IP Address Dynamic IP Address

Assignment Manually configured by a Automatically assigned by a
human DHCP Server
Permanence Permanent Temporary
Management Overhead High since it requires manual Low since it is completely
tracking to prevent duplicate automated by software
IP conflicts
Primary Use Case Core Infrastructure (Domain End-user devices (Laptops,
controllers, file servers, smartphones, etc)
printers)

Current Private IP Address : [Link]

Public IP Address : [Link]
Which private IP range your device belongs to?

Looking at the private IP Address it is clear that it belongs to the class C range which is :
[Link] to [Link]

Why private and public ips differ?

There is a simple reason for this. Unavailability. With the ever increasing number of devices, there
will not be enough IP addresses to assign to every device in the world. Hence the idea of separating
the ips into two subsets came up. The public ips remain universally routable while the private ips
can only be accessed from within the network. This facilitates the reuse of the private ips across
different networks, saving a lot of IP addresses from being used.
Although even that is not enough, since the number of networks will only continue to grow. Hence
we have come up with IPv6 addresses which more combinations are possible and can fit a
significantly more number of networks, solving this problem for the near future.

How NAT is used in your network?

The Network Address Translator or NAT, acts as a bidirectional translator on the network perimeter.
It allows an entire office building containing hundreds of devices using private addresses to share a
single, shared public internet connection. It intercepts every outbound packet, tracks the connection
states dynamically, swaps out private indicators for public ones, and safely funnels incoming
responses back to the exact internal host that requested them.

Why do organizations not assign public ips to every device?

Assigning public ips to every device would account for massive security risks. A public IP means a
device is directly addressable and reachable by anyone on the internet. If every office computer had
a public IP, threat actors could scan and directly attempt exploitation techniques against end-user
workstations without needing to break through a perimeter boundary first. Private IP addresses act
as a natural shield because external systems cannot initiate direct inbound connections to them.

DHCP

Instead of manual configuration for hundreds of corporate laptops, a DHCP server automates the
entire onboarding process. When a device boots up and connects via ethernet or Wi-Fi, it
participates in a four-step handshake known as DORA:
1. Discover: The client broadcasts a message looking for any available DHCP server.
2. Offer: The DHCP server responds with an available IP address, subnet mask, default
gateway, and DNS servers.
3. Request: The client replies, confirming it wants to lease that offered configuration.
4. Acknowledge: The server finalizes the lease and logs it in its database.
TCP (Transmission Control Protocol) vs UDP (User Datagram Protocol)

Feature TCP UDP

Connection Requirements Connection-Oriented: TCP Connectionless: UDP Sends
requires a “3-Way- data immediately without
Handshake” (SYN, SYN- establishing a prior
ACK, ACK) to establish a connection
connection before any data is
sent
Reliability High and Guarantees Low and no guarantee of
delivery. Packets are tracked delivery. No tracking or
and acknowledged by the acknowledgment
receiver mechanisms
Error Recovery If a packet is lost or If a packet is dropped by a
corrupted, TCP automatically router along the way, it is
requests a retransmission of gone forever. UDP does not
the missing data and reorders attempt to retransmit.
out-of-sequence packets.
Speed Slower Faster, it just blasts packets
onto the network as fast as
possible

Real World Applications

Web-Browsing (HTTP/HTTPS):
You might need an entire webpage to load flawlessly. If packets are dropped and not retransmitted,
an image might render as half-broken, or a critical piece of HTML/CSS code might be missing,
breaking the site entirely.

Email (SMTP, IMAP, POP3):

Data integrity is non-negotiable. You cannot have “most” of an email or have a corrupted PDF
attachment. It must be delivered exactly as it was sent.

Video Streaming:
Here it varies slightly.
For sites like Netflix, quality is prioritized over real-time delivery. Our browser buffers a video a
few seconds ahead. If a packet is lost, TCP retransmits it in the background while we watch the
buffered content ensuring a high quality experience.
For sites like YouTube, speed is prioritized. We experience a temporary degradation in quality
sometimes which is caused to the packet loss.

DNS Queries:
DNS Queries are tiny single packet requests. Setting up a 3-way TCP handshake just to ask one
quick question is horribly inefficient. If the UDP packet gets lost, the computer simply asks a
millisecond later.
Online Gaming:
Speed and real-time positioning are critical. If a player moves, the server needs that data now. If a
movement packet is dropped, TCP would pause the game to re-request the old packet, causing
massive "rubber-banding." UDP just ignores the lost packet and accepts the next immediate
coordinate update.
VoIP Calls:
In a live voice conversation, a lost packet just sounds like a tiny pop or a microsecond of silence.
Human brains easily ignore this. If TCP were used, the retransmitted audio packet would arrive a
second late, talking over the current conversation and ruining the flow.
Video Conferencing:
Similar to VoIP, live interactions demand zero latency. It is much better for a coworker's video feed
to drop in quality or pixelate for a split second (dropped UDP packets) than for the entire video to
freeze while waiting for an old packet to be re-sent (TCP).
Ports and Protocols

Reference Sheet for the network administrator

Protocol Port Number TCP/UDP Secure / Insecure

HTTP 80 TCP Insecure

HTTPS 443 TCP Secure

DNS 53 UDP/TCP Insecure*

FTP 20 / 21 TCP Insecure

SSH 22 TCP Secure

Telnet 23 TCP Insecure

SMTP 25 TCP Insecure

POP3 110 TCP Insecure

IMAP 143 TCP Insecure

RDP 3389 TCP/UDP Varies

LDAP 389 TCP/UDP Insecure

LDAPS 636 TCP Secure

SMB 445 TCP Insecure*

SNMP 161 UDP Insecure*

NTP 123 UDP Insecure

Syslog 514 UDP Insecure

VNC 5900 TCP Insecure

MySQL 3306 TCP Insecure*

 Protocol Port Number TCP/UDP Secure / Insecure

PostgreSQ
5432 TCP Insecure*
L

MSSQL 1433 TCP Insecure*

Oracle DB 1521 TCP Insecure*

Purpose and Business usecase of each port

HTTP:

Purpose:
Facilitates the transfer of unencrypted web page data between a web server and a browser.

Use-case:
Accessing basic, unencrypted internal web portals or redirecting traffic to HTTPS.

HTTPS:

Purpose:
Facilitates encrypted web traffic, securing data like passwords and session cookies during transit.

Use-case:
Secure web browsing, e-commerce, and accessing corporate web applications

DNS:

Purpose:
Translates human readable website names into the IP addresses that computers use to route traffic

Use-case:
Allowing employee laptops to find servers by name rather than memorizing IPs.

FTP:

Purpose:
Facilitates the unencrypted uploading and downloading of files between a client and a central
server.

Use-case:
File transfers

SSH:

Purpose:
Provides a secure, encrypted CLI to remotely manage network devices and servers
Use-case:
Admins securely logging into a Linux web server or configuring a core router from their desks

Telnet:

Purpose:
Provides unencrypted, remote command-line access to devices

Use-case:
Legacy remote administration, should be disabled on modern networks

SMTP:

Purpose:
Facilitates the routing and sending of outbound emails from a server to a local client, typically
removing them from the server

Use-case:
Moving an email from a corporate exchange server to a recipient’s Gmail server

POP3:
Purpose: Facilitates downloading emails from a server to a local client, typically removing them
from the server.
Use-case: Older setups where an employee downloads email locally to a single machine to save
server space.
IMAP:
Purpose: Facilitates reading and syncing emails across multiple devices while leaving the original
copies on the server.
Use-case: Allowing an employee to see the exact same inbox state on their phone, laptop, and web
browser.
RDP:
Purpose: Provides a graphical interface to remotely view and control a Windows computer over a
network.
Use-case: Allowing an employee to work from home by graphically logging into their physical
office desktop.

LDAP:
Purpose: Facilitates querying directory services to verify user identities, group memberships, and
network permissions.
Use-case: A firewall checking Active Directory to see if a user has permission to access a restricted
network segment.
LDAPS:
Purpose: Performs the same directory queries and identity verifications as LDAP, but securely
encrypted over TLS/SSL.
Use-case: Securely verifying passwords when employees log into enterprise applications.
SMB:
Purpose: Facilitates shared access to files, printers, and serial ports across a local Windows network.
Use-case: Employees accessing a shared "S: Drive" to collaborate on Word documents or sending
jobs to a network printer.
SNMP:
Purpose: Facilitates the collection of health, bandwidth, and performance metrics from networking
hardware.
Use-case: An admin dashboard showing that the main switch is operating at 95% CPU capacity.
NTP:
Purpose: Facilitates the continuous synchronization of device clocks across a network to ensure
precise timestamps.
Use-case: Ensuring a firewall log timestamp perfectly matches a server log timestamp during a
forensic incident investigation.
Syslog:
Purpose: Facilitates the automated forwarding of system and security event logs to a centralized
monitoring server.
Use-case: Sending all firewall block alerts to a central SIEM (Security Information and Event
Management) platform.
VNC:
Purpose: Provides cross-platform, graphical remote desktop control by transmitting keyboard and
mouse events.
Use-case: IT Helpdesk remotely taking over a user's Mac or Linux machine to fix a software issue.
MySQL:
Purpose: Facilitates queries, updates, and management of MySQL and MariaDB relational
databases.
Use-case: A web server requesting user profile data from a backend database to load a webpage.
PostgreSQL:
Purpose: Facilitates communication and data manipulation for PostgreSQL relational databases.
Use-case: Backend data processing and storage for web applications or internal analytics tools.
MSSQL:
Purpose: Facilitates data transactions and management for Microsoft SQL Server databases.
Use-case: Storing and retrieving enterprise data for heavily integrated Windows/Microsoft
environments.
Oracle DB:
Purpose: Facilitates database operations and connections for enterprise Oracle databases.
Use-case: Managing massive, high-throughput enterprise databases (often used in finance or large
logistics).

Network Segmentation
Instead of having a “flat” network where every device can talk to every other device by default,
segmentation breaks the network into isolated, tightly controlled zones. It is one of the most
powerful defensive strategies you can implement.

Network Segment Devices Included Why a segment should be

separated
Guest Network Visitor laptops, employee’s These devices are not
personal smartphones, managed by the corporate IT,
vendor tablets. meaning they can be infected
with malware. Separation
ensures a compromised
guest laptop cannot scan or
infect internal corporate
servers
CCTV Network IP Security Cameras, IoT devices are difficult to
Network Video Recorders patch and often have weak
(NVR), badge access default security. Separating
controllers. them prevents an attacker
from hacking a lobby camera
and using it as a pivot point to
reach the HR database.
Management Network IT Administrator workstations, Only highly priviledged IT
router/switch management staff should be able to
Interfaces (SSH ports), configure network hardware.
Firewall WebUIs Separation ensures that a
standard employee cannot
even see the login screens
for the core infrastructure.

Architectural Questions

What risks arise if all devices share the same network?

A network where all devices share the same space is known as a “flat network”. The primary risk is
unrestricted lateral movement. If an attacker compromises a receptionist’s computer via a phishing
email, a flat network allows them to scan, communicate with, and attack every other device in the
building. Additionally, a flat network suffers from performance degradation due to massive amounts
of unrestricted broadcast traffic from every device hitting every other device simultaneously

Why should guest users not access internal systems?

Guests users operate unmanaged and unverified devices. The organization has no visibility into
whether a guest’s laptop has active antivirus software, the latest OS patches, or existing malware
infections. Allowing them access to internal systems is huge risk. The introduction of malware can
be intentional or unintentional.

Which network segement should have the highets level of security?

The management network requires the highest level of security. This segment has the administrative
interfaces for the firewalls, core routers, etc. If an attacker breaches the standard corporate network,
they can steal data, but if an attacker breaches the management network, they gain complete control
over the entire infrastructure. They can rewrite firewall rules to lock IT staff out, delete network
backups and reroute all company traffic to themselves. Access to this segment should require strict
MFA, and IP whitelisting

Firewall Fundamentals
After segmenting the physical network into isolated networks, we install and configure firewalls.
A firewall does not care what kind of device is sending the data, it only cares what the Access
Control List (ACL) says. A properly designed firewall [Link] operates on the principle of Implicit
Deny (or Default Deny) which states that “if there is not a specific rule explicitly allowing this
traffic, drop it immediately.”

Firewall Rule Determinations

Guest Wi-Fi → Employee Network

DENY

As explained before, guest wi-fi is an untrusted zone. We have zero control over the devices
connected to it. A visiting contractor might have a laptop infected with a ransomware worm, or a
malicious actor might be sitting in the lobby. If we allow traffic from the guest network into the
employee network, that worm can freely scan your internal file servers, and lock them down. The
guest network should only have a rule allowing it to go straight to the outside internet.

Employee Network → Internet

ALLOW (with conditions)

Employees obviously need the internet to do their jobs. Therefore, a baseline “Allow” rule is
required. However, in a real enterprise environment, “Allow All” is not used.

A network administrator will specifically allow ports 80 (HTTP) and 443 (HTTPS) outbound.
They will force this traffic through the firewall’s DPI (Deep Packet Inspection) or a Web Filter to
actively block employees from visiting known malicious domains, adult content, or unauthorized
file-sharing sites.

Outbound ports that are typically abused by malware (like Telnet, RDP, or SMB) are strictly denied
from leaving the Employee network

CCTV Network → Internet

DENY

IoT devices, including IP cameras are extremely insecure. They are rarely patched, often ship with
hardcoded default passwords, and are prime targets for threat actors. If a CCTV camera has an open
path to the internet, massive risks arise like Botnet recruitment and Remote Viewing

Management Network → CCTV Network

ALLOW

Traffic flow is unidirectional. While the CCTV network should not be allowed to initiate a
conversation with the Management Network, the Management Network must be allowed to reach
into the CCTV Network. IT Administrators sitting in the Management zone need to log into the
cameras. Because the Management Network is the most highly secured, trusted zone in the
building, it is granted privileged, one-way access to manage lower-trust zones.
Planning Table
Device Type Static IP or DHCP Network Segment
25 Employee Laptops DHCP Employee Network
3 Network Printers Static IP Employee Network
8 CCTV Cameras Static IP CCTV Network
Guest Wi-Fi Devices DHCP Guest Network
Management Team Static IP Management Network

Conclusion

The final network architecture successfully mitigates the most common cybersecurity
vulnerabilities inherent in flat networks. By implementing logical network segmentation, highly
vulnerable IoT devices (CCTV) and untrusted guest devices are completely isolated from core
business operations. Furthermore, traffic is heavily restricted to only necessary, directional flows.
Finally, the strategic deployment of Static IPs for fixed infrastructure prevents operational outages,
while DHCP ensures seamless connectivity for a dynamic workforce.