Campus Network Segmentation Decision
A university has a flat /24 network (254 usable addresses) serving 400 devices: administrative PCs, a student Wi-Fi network, an IP camera system, a library public-access lab, and a small data centre with a student records server. Symptoms: the network intermittently slows to a crawl; the IT office suspects broadcast storms from the public lab; the records server was recently reachable from the student Wi-Fi; and cameras are using default passwords. The university has one Layer-2 switch stack and one router with four free ports. There is no VLAN configuration experience on staff, and the semester starts in three weeks. Management wants both better security and better performance but has approved no new hardware.
1. Is VLAN segmentation the right response here? Justify with reference to the symptoms.
Read the worked answer
Yes, but with caveats. The flat /24 is already oversubscribed - 400 devices against 254 addresses means address exhaustion and heavy broadcast domains, which explains intermittent slowness independent of any storm. VLANs address three of the stated problems: they shrink broadcast domains (performance), they let ACLs block student Wi-Fi from the records server (security), and they isolate cameras so a compromised camera cannot reach administrative PCs. The existing Layer-2 stack and router ports are sufficient if the switch supports 802.1Q trunking and the router supports inter-VLAN routing on subinterfaces. The real constraint is staff skill, not hardware. With three weeks, the plan should be a limited pilot, not a full redesign.
2. Propose a segmentation plan that fits the hardware and the three-week window.
Read the worked answer
Use five VLANs: VLAN 10 administration, VLAN 20 student Wi-Fi, VLAN 30 cameras/IoT, VLAN 40 public lab, VLAN 50 servers. Assign /24 subnets from a private range, e.g. 10.10.10.0/24 through 10.10.50.0/24, giving each segment ample addresses. Configure the switch ports as access ports per VLAN and a single trunk to the router; configure router subinterfaces for inter-VLAN routing. Apply ACLs: student and lab VLANs may reach the internet and a print server only; cameras may reach only the NVR; administration may reach servers. Week one: configure and test in a lab corner with two switches and spare PCs. Week two: migrate the cameras and lab first (lowest political risk). Week three: migrate administration and servers during a maintenance window. Keep a rollback config saved.
3. What residual risks remain, and what should be done about the cameras specifically?
Read the worked answer
Segmentation limits lateral movement but does not fix weak credentials: a compromised camera inside VLAN 30 can still attack the NVR and other cameras. The default passwords must be changed immediately, firmware updated, and remote management disabled - these are one-hour tasks that should precede or accompany segmentation. Other residual risks: the router becomes a single point of failure for inter-VLAN traffic; ACLs are easy to misconfigure and must be tested from each segment; staff unfamiliar with VLANs may mis-tag ports and cause outages. Mitigations: document the configuration, keep a spare router config, test ACLs with a checklist, and schedule a post-implementation review. Longer term, the university should budget for a firewall and staff training.