Back to engineering
Secure branch connectivity
HQ–Branch Secure Network
A Packet Tracer HQ and branch lab with a DMZ, site-to-site VPN, dynamic routing, redundancy, and switch security.
I used this lab to bring several topics into one working network: secure site connectivity, resilient routing, controlled public services, and safer access switching.
View the repository
What I used
Tools and technologies
Cisco ASAOSPFHSRPIPsec VPNDMZNATACLRapid-PVST
What it covers
The main parts of the project
- Site-to-site IPsec connectivity between HQ and branch
- Public-service isolation through a dedicated DMZ
- DHCP snooping, DAI, port security, and STP protection
- Validation commands and connectivity tests documented alongside the design
Design notes
Why I made these choices.
Layered security
Firewall, ACL, switching, and management controls work together instead of relying on one perimeter.
Controlled exposure
Static NAT and policy boundaries expose only intended DMZ services.
Testable outcomes
VPN, routing, NAT, DHCP, and failover expectations are paired with validation steps.