Design and Simulation of a Secure Campus Area Network

Design and Simulation of a Secure Campus Area Network
Overview
This project presents a comprehensive design and simulation of a Secure Campus Area Network (SCAN) using Cisco Packet Tracer. The network addresses the critical requirements of modern educational institutions: logical segmentation, controlled inter-departmental communication, centralized IP management, and robust security enforcement. The design follows a hierarchical three-tier architecture with VLAN-based segmentation, dynamic routing, and ACL-driven security policies.
________________________________________
1. Project Objectives
• Design a scalable multi-building campus network supporting academic, administrative, and student residential operations.
• Implement logical network segmentation using VLANs to isolate departments and reduce broadcast traffic.
• Enforce security policies through Access Control Lists (ACLs) and firewall rules that restrict unauthorized inter-VLAN communication.
• Provide centralized network services including DHCP, DNS, and web services in a secured DMZ.
• Simulate and validate network behavior using Cisco Packet Tracer, including connectivity tests, routing verification, and security policy validation.
________________________________________
2. Network Architecture
2.1 Hierarchical Design Model
The network follows a three-tier hierarchical architecture:
Layer Function Devices
Core Layer High-speed backbone connecting distribution layers; Internet edge connectivity Core multilayer switch(es), edge router
Distribution Layer Inter-VLAN routing, policy enforcement (ACLs), aggregation of access switches Multilayer distribution switches (one per building)
Access Layer End-device connectivity, port security, VLAN access port assignment Layer 2 access switches
This hierarchical approach ensures scalability, simplifies troubleshooting, and contains network changes within specific layers.
2.2 Campus Building Topology
Building Departments / Zones VLAN Assignment
Building A — Administration Admin, HR, Finance VLAN 10 (Admin), VLAN 20 (HR), VLAN 30 (Finance)
Building B — Academics Computer Science, Electrical Engineering, Faculty VLAN 40 (CS), VLAN 50 (EE), VLAN 60 (Faculty)
Building C — Student Services Library, Student Labs, Hostel VLAN 70 (Library), VLAN 80 (Labs), VLAN 90 (Hostel)
Data Center / DMZ DNS, DHCP, Web, Email servers VLAN 99 (Server Farm)
________________________________________
3. IP Addressing and VLSM Plan
A Variable Length Subnet Mask (VLSM) scheme is used to allocate address space efficiently based on actual host requirements, avoiding the waste associated with fixed-size subnets.
Parent Network: 192.168.0.0/22 (1,024 addresses)
VLAN Department Subnet Prefix Usable Hosts Gateway
10 Admin 192.168.0.0 /26 62 192.168.0.1
20 HR 192.168.0.64 /27 30 192.168.0.65
30 Finance 192.168.0.96 /27 30 192.168.0.97
40 CS 192.168.0.128 /25 126 192.168.0.129
50 EE 192.168.1.0 /26 62 192.168.1.1
60 Faculty 192.168.1.64 /26 62 192.168.1.65
70 Library 192.168.1.128 /27 30 192.168.1.129
80 Student Labs 192.168.1.160 /27 30 192.168.1.161
90 Hostel 192.168.2.0 /23 510 192.168.2.1
99 Server Farm 192.168.3.0 /28 14 192.168.3.1
— Core Links 192.168.3.16 /30 (×N) 2 each —
Design rationale: The Hostel VLAN receives a /23 due to high device density, while smaller departments receive /27s. Point-to-point core links use /30s to conserve addresses.
________________________________________
4. Key Technologies and Configurations
4.1 VLAN and Trunking
Each department is assigned a dedicated VLAN to provide logical isolation. Access ports on switches are assigned to specific VLANs, while 802.1Q trunk links carry multiple VLANs between access and distribution switches.
text
! Example VLAN configuration on access switch
vlan 40
name COMPUTER_SCIENCE
exit
interface range fa0/1-20
switchport mode access
switchport access vlan 40
Trunk configuration between distribution and access switches:
text
interface gig0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,60,70,80,90,99
4.2 Inter-VLAN Routing
Multilayer switches at the distribution layer perform inter-VLAN routing via Switch Virtual Interfaces (SVIs). This avoids the router-on-a-stick bottleneck and provides high-speed routing within each building.
text
! On distribution multilayer switch
ip routing
interface vlan 40
ip address 192.168.0.129 255.255.255.128
no shutdown
exit
4.3 Routing Protocol — OSPF
OSPF (Open Shortest Path First) is deployed as the dynamic routing protocol connecting buildings. A multi-area OSPF design is used: Area 0 serves as the backbone across the core, while each building is assigned its own area. This limits topology change propagation to a single area, improving stability and scalability.
Area Scope
Area 0 Core backbone, server farm
Area 1 Building A (Admin/HR/Finance)
Area 2 Building B (CS/EE/Faculty)
Area 3 Building C (Library/Labs/Hostel)
text
! Example OSPF configuration on Building A distribution switch
router ospf 1
network 192.168.0.0 0.0.0.127 area 1
network 192.168.0.64 0.0.0.31 area 1
network 192.168.0.96 0.0.0.31 area 1
network 192.168.3.16 0.0.0.3 area 0
passive-interface vlan 10
The passive-interface command prevents OSPF hello packets from being sent on user VLANs where no routers exist.
4.4 DHCP Services
Each building's distribution switch hosts DHCP pools for its local VLANs, automating IP address assignment and reducing administrative overhead.
text
! DHCP pool for Computer Science VLAN
ip dhcp pool CS_POOL
network 192.168.0.128 255.255.255.128
default-router 192.168.0.129
dns-server 192.168.3.2
For remote buildings using a centralized DHCP server, ip helper-address would relay DHCP requests across subnets.