Network Security Design
Defense in depth
The security domain asks you to place controls at every layer: edge (firewall, IPS/IDS, DDoS protection), campus (802.1X/NAC, segmentation, DHCP snooping, dynamic ARP inspection, port security), wireless (WPA3-Enterprise, RADIUS), and data (encryption in transit and at rest). Know zero trust principles - verify explicitly, least privilege, assume breach - and how micro-segmentation limits lateral movement.
Identity and segmentation
Understand AAA (authentication, authorization, accounting), 802.1X with EAP methods, RADIUS versus TACACS+ (RADIUS encrypts only the password and is common for network access; TACACS+ encrypts the full payload and separates AAA, common for device admin), and role-based access mapped to VLANs or ACLs. Segmentation via VLANs, VRFs, and firewalls isolates guest, IoT, corporate, and management traffic.
Traps to watch
- Confusing authentication (who you are) with authorization (what you may do) and accounting (what you did).
- Assuming a firewall at the edge protects east-west traffic - internal segmentation needs internal policy enforcement.
- Forgetting management-plane security: out-of-band management, AAA on devices, and disabling unused services.
- Treating encryption as segmentation - they solve different problems.
Rule of thumb
Design security in zones with a default-deny posture between them, then permit by exception. Worked example: a guest network should reach the internet only - deny guest-to-corporate and guest-to-management at the enforcement point, authenticate guests via a captive portal, and rate-limit. If an answer permits guest-to-internal "for convenience," it is wrong.