INFRASTRUCTURE DIGITAL

TECHNICIAN SPECIALIST MASTER PORTFOLIO

Owner: Issam Oullah | Level: 2nd Year OFPPT | Focus: Systems & Networks

Project Index

01. Windows AD & Automation 02. pfSense Firewall Security

03. HAProxy Load Balancing 04. WDS/MDT Deployment

05. Docker Private Cloud 06. Network Monitoring (Zabbix)

07. VPN Remote Access (OpenVPN) 08. Failover Clustering (File Server)

09. Centralized Logging (ELK) 10. Cisco Campus Network

01. Enterprise Active Directory Infrastructure

Objective: Build a domain controller for "TechCorp" completely via PowerShell. This proves you can
manage servers at scale, not just via GUI.

1. Prerequisites (VMware)

1 RAM: 4GB (Required for Desktop Experience).

2 Network: LAN Segment named "Office_LAN". Static IP: [Link].

3 Hostname: Rename to DC01-HQ before starting.

2. Installation Script

# Open PowerShell as Administrator

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

Install-ADDSForest `
-DomainName "[Link]" `
-DomainNetbiosName "TECHCORP" `
-InstallDns $true `
-LogPath "C:\Windows\NTDS" `
-SysvolPath "C:\Windows\SYSVOL" `
-Force:$true

3. Advanced GPO: Drive Maps

Do not just map a drive. Use Item-Level Targeting.

1 Path: User Config > Preferences > Windows Settings > Drive Maps.

2 Action: Update. Path: \\DC01-HQ\Shared\HR. Letter: H:.

3 Targeting: Click "Common" tab > Check "Item-level targeting" > Click Targeting > New Item >
Security Group > Select "HR_Group".

4 Result: Only HR users get the drive. Sales users do not.

02. Secure Gateway & Firewall (pfSense)

CRITICAL: You must add 3 Network Adapters to the VM *before* booting.

1. Interface Assignment

1 WAN (em0): Bridged (Gets Internet).

2 LAN (em1): LAN Segment "Office_LAN" -> IP [Link]/24.

3 DMZ (em2): LAN Segment "DMZ_Net" -> IP [Link]/24.

2. Firewall Rules (Strict Security)

Go to Firewall > Rules > DMZ Tab. Create these exact rules:

# Rule 1: Allow DNS

Action: PASS | Proto: TCP/UDP | Source: DMZ Net | Dest: Any | Port: 53

# Rule 2: ISOLATION (Most Important)

Action: BLOCK | Proto: IPv4 | Source: DMZ Net | Dest: LAN Net
# Why? If a hacker breaks into the web server, they cannot jump to the AD Ser

# Rule 3: Internet Access

Action: PASS | Proto: TCP | Source: DMZ Net | Dest: Any | Port: 80, 443

03. High Availability Web Cluster (HAProxy)

1. Concept

We use Round Robin load balancing. Request 1 goes to Server A, Request 2 goes to Server B.

2. Configuration

File: /etc/haproxy/[Link]

frontend http_front
bind *:80
default_backend http_back

backend http_back
balance roundrobin
# The 'check' parameter pings the server to see if it's alive
server web1 [Link]:80 check
server web2 [Link]:80 check

3. Verification (The "Pull the Plug" Test)

1 Run watch curl [Link] (Load Balancer IP).

2 Go to Web1 VM and disconnect the network adapter.

3 Result: The curl command should continue working flawlessly, serving content only from Web2.

04. Automated Deployment (WDS & MDT)

1. DHCP Configuration

On your DC01 (DHCP Server), set these Scope Options so PXE works:

1 Option 66: IP of WDS Server (e.g., [Link]).

2 Option 67: boot\x64\[Link] (Legacy) or boot\x64\[Link] (UEFI).

2. The "Port 67" Conflict Fix

If WDS and DHCP are on the same server, run this command or PXE will fail:

wdsutil /set-Server /UseDhcpPorts:No /DhcpsOption60:Yes

3. Automation ([Link])

Use Windows System Image Manager to create an XML that sets SkipUserOOBE=true and
HideEULAPage=true. This makes the installation "Zero Touch".

05. Private Cloud (Docker Compose)

1. Docker Compose File

Create [Link]. This launches Nextcloud and MariaDB together.

version: '2'
services:
db:
image: mariadb:10.5
restart: always
environment:
- MYSQL_ROOT_PASSWORD=secret
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
- MYSQL_PASSWORD=cloudpass
volumes:
- db_data:/var/lib/mysql

app:
image: nextcloud
restart: always
ports:
- 8080:80
links:
- db
volumes:
- nextcloud_data:/var/www/html

volumes:
db_data:
nextcloud_data:

Run: docker-compose up -d

06. Network Monitoring (Zabbix)

Objective: Monitor a Cisco Router via SNMP. If the router goes down, you must know immediately.

1. Cisco Router Config (GNS3/Packet Tracer)

Router(config)# snmp-server community public RO

! Enables Read-Only access with password 'public'
Router(config)# snmp-server enable traps
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip address [Link] [Link]

2. Zabbix Server Setup

1 Install Zabbix Appliance (easiest way).

2 Web Interface > Configuration > Hosts > Create Host.

3 Interfaces: Add SNMP Interface -> IP [Link] Port 161.

4 Templates: Link new template "Template Module Interfaces SNMPv2".

5 Macros: Set {$SNMP_COMMUNITY} = public.

Verification: Wait 5 minutes. Go to "Monitoring > Graphs". You should see a graph line showing traffic on
Gig0/0.

07. VPN Remote Access (OpenVPN)

Networking Challenge: VPN clients get a virtual IP (10.8.0.x). They cannot talk to the LAN
(192.168.10.x) without NAT.

1. Server Configuration ([Link])

port 1194
proto udp
dev tun
server [Link] [Link]
push "route [Link] [Link]" # Tells client how to find the LAN
push "dhcp-option DNS [Link]"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3

2. IP Forwarding & NAT (The Missing Link)

Run these commands on the Linux VPN Server:

# 1. Enable Routing in Kernel

echo 1 > /proc/sys/net/ipv4/ip_forward

# 2. Add IPTables Masquerade Rule

iptables -t nat -A POSTROUTING -s [Link]/24 -o eth0 -j MASQUERADE
# This makes VPN traffic look like it comes from the Server's LAN IP.

08. Windows Failover Cluster (File Server)

Architecture: You need 3 VMs: Node1, Node2, and StorageServer (iSCSI Target).

1. Storage Server Setup

1 Install role: iSCSI Target Server.

2 Server Manager > File and Storage Services > iSCSI.

3 Create iSCSI Virtual Disk (10GB).

4 Access Servers: Add IP addresses of Node1 and Node2.

2. Cluster Creation (PowerShell)

# Run on Node 1
Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools

# Validation Test (Mandatory before creation)

Test-Cluster -Node Node1, Node2

# Create Cluster
New-Cluster -Name FileCluster -Node Node1, Node2 -StaticAddress [Link]

# Add the Shared Disk

Get-ClusterAvailableDisk | Add-ClusterDisk

09. Centralized Logging (ELK Stack)

1. Architecture

Instead of logging into 10 servers to check "Event Viewer", we send all logs to one ElasticSearch server.

2. Winlogbeat Config (Windows Side)

Install Winlogbeat on your Domain Controller. Edit [Link]:

winlogbeat.event_logs:
- name: Application
- name: Security
event_id: 4624, 4625 # Only capture Login Success/Failure
- name: System

[Link]:
hosts: ["[Link]:9200"]

[Link]:
host: "[Link]:5601"

3. Visualization

Open Kibana ([Link] Go to Discover. You will see a live stream of Windows logs
appearing in the browser.

10. Cisco Campus Network (Switching &

Routing)

Topology: Core Switch (Layer 3) connected to Access Switches (Layer 2).

1. Core Switch (Inter-VLAN Routing)

Core(config)# ip routing
Core(config)# vlan 10
Core(config-vlan)# name HR
Core(config)# vlan 20
Core(config-vlan)# name SALES

! Configure Gateways (SVI)

Core(config)# interface vlan 10
Core(config-if)# ip address [Link] [Link]
Core(config-if)# no shut

2. Access Switch (Port Security)

Prevent unauthorized laptops from plugging into the wall.

Access(config)# interface fastEthernet 0/1

Access(config-if)# switchport mode access
Access(config-if)# switchport port-security
Access(config-if)# switchport port-security maximum 1
Access(config-if)# switchport port-security violation shutdown
Access(config-if)# switchport port-security mac-address sticky
! The switch learns the MAC of the first PC connected.
! If anyone else connects, the port shuts down instantly.

© 2026 Issam Oullah | OFPPT Infrastructure Digital Master Guide