Network Segmentation & IPS Design - Assignment
Assignment Answer: Network Segmentation & IPS Design
1. Introduction
Network Segmentation is the process of dividing a network into multiple smaller sub-networks (VLANs/Subnets) to
improve security, performance, and access control.
An Intrusion Prevention System (IPS) is used to detect and automatically block malicious traffic in real time.
This design provides a secure segmented network with IPS integrated to prevent unauthorized access and
cyber-attacks.
2. Proposed Network Segmentation Design
2.1 Network Segments (VLANs / Subnets)
Segment Name | VLAN ID | IP Range | Purpose
Management Network | VLAN 10 | [Link]/24 | Admin access, monitoring
Employee Network | VLAN 20 | [Link]/24 | Staff PCs and laptops
Server Network | VLAN 30 | [Link]/24 | Database, application servers
Guest Network | VLAN 40 | [Link]/24 | Visitor Wi-Fi access
DMZ Network | VLAN 50 | [Link]/24 | Web server, mail server
Security/Monitoring | VLAN 60 | [Link]/24 | SIEM, log server
3. Network Diagram (Text Representation)
INTERNET
|
[ISP Router]
|
[Firewall + IPS]
|
------------------------
||
[DMZ Switch] [Core Switch]
||
------------------ -------------------------
||||||
[Web Server] [Mail Server] VLAN20 VLAN30 VLAN40 VLAN10
[Link] [Link] | | | |
||||
[Employees] [Servers] [Guest] [Admin]
192.168.20.x 192.168.30.x 192.168.40.x 192.168.10.x
|
[Monitoring VLAN60]
SIEM/Log Server
[Link]
4. Security Rules (Access Control Policies)
4.1 VLAN Access Rules
Source VLAN | Destination VLAN | Allowed? | Reason
Employee (20) | Server (30) | Yes (Limited) | Only required ports
Employee (20) | Management (10) | No | Prevent unauthorized admin access
Guest (40) | Any internal VLAN | No | Guests should not access internal network
Guest (40) | Internet | Yes | Internet-only access
DMZ (50) | Server VLAN (30) | Limited | Only DB queries if needed
Management (10) | All VLANs | Yes | Admin monitoring/control
Security VLAN (60) | All VLANs | Yes | Log collection and alerts
5. IPS Integration Design
5.1 IPS Placement
The IPS is placed between:
- Internet Router and Firewall
- or integrated inside the Next-Generation Firewall (NGFW)
Best Placement:
Inline IPS after Firewall and before Core Network
Reason: It blocks malicious traffic before it enters internal VLANs.
6. IPS Implementation Plan
Step 1: Requirement Analysis
- Identify critical assets (Servers, Admin systems)
- Identify traffic types (HTTP, DNS, SSH, DB traffic)
- Define security goals
Step 2: Select IPS Solution
Possible IPS tools:
- Cisco Firepower
- Palo Alto NGFW IPS
- Fortinet IPS
- Snort IPS (Open-source)
- Suricata IPS
Recommended for lab/assignment: Snort / Suricata IPS
Step 3: IPS Deployment
Deployment mode: Inline Mode (Recommended)
- Detect and block in real time
Connection: IPS connected between Firewall and Core Switch
Step 4: Configure IPS Policies
Main IPS rules to enable:
- Attack Prevention Rules
- SQL Injection Detection
- XSS attack detection
- Brute force login detection
- Port scanning detection
- Malware signature detection
- DDoS detection
Step 5: Define IPS Actions
Threat Type | IPS Action
Port scanning | Block IP + Alert
Malware traffic | Drop packet
SQL Injection | Drop + Log
Brute force login | Block temporarily
Suspicious DNS | Alert + Monitor
Step 6: Logging and Monitoring
Logs are sent to: SIEM / Log Server (VLAN 60)
Monitoring tools:
- Splunk
- ELK Stack
- Graylog
Log contents:
- Source IP
- Destination IP
- Attack type
- Timestamp
- Rule triggered
- Action taken
Step 7: Testing & Validation
Testing attacks using tools:
- Nmap (port scan)
- Metasploit (exploit simulation)
- SQLmap (SQL injection test)
Expected Result:
- IPS detects attack
- IPS blocks traffic
- Alert is generated in logs
Step 8: Maintenance Plan
- Update IPS signatures weekly
- Review logs daily
- Tune false positives
- Backup configurations monthly
7. Scenario-Based Execution Example
Scenario 1: Guest tries to access Server Network
- Guest VLAN 40 sends request to [Link]
- Firewall rule blocks it
- IPS logs suspicious attempt
Result: Guest is blocked from internal servers
Scenario 2: Employee PC infected with malware
- Employee PC tries to connect to malicious IP
- IPS detects malware signature
- IPS blocks connection automatically
Result: Malware traffic prevented
Scenario 3: SQL Injection attack on Web Server
- Hacker attacks DMZ web server ([Link])
- IPS detects SQL injection pattern
- IPS drops the packet and blocks attacker IP
Result: Web server protected
8. Benefits of the Proposed Design
- Improves network security using VLAN segmentation
- Prevents unauthorized access between departments
- Guest users remain isolated
- DMZ protects internal servers
- IPS blocks attacks in real time
- Central monitoring and logging is enabled
9. Conclusion
This segmented network design uses VLANs and security policies to separate employees, guests, servers, and
management systems. The IPS is integrated in inline mode to monitor traffic and block malicious attacks
automatically. This improves confidentiality, integrity, and availability of the network.
Final Deliverables Summary
Deliverable 1: Network Diagram – Provided (text-based network architecture)
Deliverable 2: IPS Implementation Plan – Provided (step-by-step plan with rules, monitoring, testing)