This curriculum spans the technical and operational rigor of a multi-workshop infrastructure modernization program, addressing the full lifecycle of enterprise network setup from physical assessment and IP planning to cloud integration, comparable to the phased rollouts seen in large-scale internal network transformation initiatives.
Module 1: Network Infrastructure Assessment and Planning
- Conducting site surveys to evaluate existing cabling, switch locations, and physical connectivity constraints in multi-floor enterprise environments.
- Selecting between single-mode and multi-mode fiber based on distance requirements, bandwidth needs, and future expansion plans.
- Defining VLAN segmentation strategy by department, function, or security level while ensuring compliance with regulatory frameworks like HIPAA or GDPR.
- Calculating port density requirements for access switches based on device counts, PoE needs, and redundancy expectations.
- Integrating network planning with real estate and facilities teams to align rack placement, power distribution, and cooling infrastructure.
- Documenting network topology using standardized tools (e.g., Visio or Lucidchart) to support change management and incident response.
Module 2: IP Addressing and Subnet Design
- Allocating IPv4 subnets using variable-length subnet masking (VLSM) to minimize address waste across WAN, LAN, and DMZ segments.
- Reserving IP address ranges for future growth, guest access, IoT devices, and network management interfaces.
- Coordinating with regional offices to implement hierarchical IP addressing schemes that support summarization and efficient routing.
- Planning IPv6 adoption by defining dual-stack deployment timelines and ensuring hardware/software compatibility.
- Configuring DHCP scopes with appropriate lease durations, exclusions, and relay agents in routed environments.
- Managing DNS namespace delegation and integrating forward and reverse lookup zones with Active Directory or cloud directories.
Module 3: Core Network Device Configuration
- Standardizing switch configuration templates for access, distribution, and core layers using automation tools like Ansible or Python scripts.
- Enabling Layer 3 routing on distribution switches with proper OSPF or EIGRP settings, including area design and route summarization.
- Implementing port security features such as MAC address limiting, sticky learning, and violation actions on access switches.
- Configuring redundant first-hop gateway protocols (HSRP, VRRP, or GLBP) with priority settings and preemption to avoid outages.
- Applying Quality of Service (QoS) policies to prioritize voice, video, and critical application traffic across switch and router interfaces.
- Securing management interfaces by disabling unused services (e.g., Telnet, HTTP), enabling SSH with key-based authentication, and restricting access via ACLs.
Module 4: Wireless Network Deployment and Optimization
- Designing AP placement based on site survey data to ensure coverage overlap while minimizing co-channel interference in high-density areas.
- Selecting between on-premises and cloud-managed wireless controllers based on organizational control requirements and IT staffing levels.
- Configuring 802.1X authentication with RADIUS integration for WPA2/3-Enterprise, including certificate validation and fallback mechanisms.
- Segmenting wireless traffic using VLANs and SSID-to-VLAN mapping to separate corporate, guest, and IoT device access.
- Tuning RF parameters such as transmit power, channel width, and band steering to balance performance and capacity.
- Monitoring wireless performance with packet capture and spectrum analysis tools to troubleshoot interference from non-Wi-Fi devices.
Module 5: Network Security and Access Control
- Implementing stateful firewall rules between zones (e.g., internal, DMZ, external) with explicit allow/deny policies and logging enabled.
- Configuring access control lists (ACLs) on routers and Layer 3 switches to restrict traffic between subnets based on business requirements.
- Integrating Network Access Control (NAC) systems to enforce device compliance before granting network access.
- Deploying intrusion detection/prevention systems (IDS/IPS) inline or in monitoring mode with signature updates and alert thresholds.
- Establishing secure remote access through site-to-site and client-based IPsec or SSL VPNs with multi-factor authentication.
- Hardening network devices by disabling unused ports, enforcing password complexity, and enabling logging to a centralized SIEM system.
Module 6: Network Monitoring and Performance Management
- Deploying SNMPv3 across switches, routers, and firewalls with secure community strings and access control lists.
- Configuring NetFlow or IPFIX on core devices to collect traffic data for capacity planning and anomaly detection.
- Setting up monitoring thresholds for bandwidth utilization, error rates, and CPU/memory usage with automated alerting via email or ticketing systems.
- Integrating network devices with monitoring platforms (e.g., Nagios, SolarWinds, or Zabbix) using standardized templates and dashboards.
- Performing regular baseline assessments to identify deviations in traffic patterns that may indicate security incidents or misconfigurations.
- Using packet capture (PCAP) and protocol analyzers to diagnose latency, jitter, or packet loss issues in real-time applications.
Module 7: Change Management and Operational Governance
- Executing network changes during approved maintenance windows with rollback procedures documented and tested in advance.
- Using change advisory boards (CAB) to review high-impact changes such as core router upgrades or firewall rule modifications.
- Maintaining version-controlled repositories for device configurations using tools like Git or dedicated network configuration managers.
- Conducting post-implementation reviews to validate change outcomes and update documentation based on actual configurations.
- Enforcing segregation of duties by restricting configuration access based on role-based access control (RBAC) policies.
- Archiving configuration backups and logs in accordance with organizational retention policies and audit requirements.
Module 8: Hybrid and Cloud Network Integration
- Establishing secure connectivity between on-premises data centers and public cloud providers using Direct Connect or ExpressRoute.
- Designing hybrid routing architectures with dynamic protocols (e.g., BGP) to enable failover and load balancing across cloud and physical networks.
- Configuring virtual network peering and transit gateways to enable communication between multiple VPCs or VNets.
- Implementing consistent security policies across on-prem and cloud environments using centralized firewall management or cloud-native tools.
- Mapping on-prem IP address spaces to cloud subnets to prevent overlap and ensure seamless workload migration.
- Monitoring latency and throughput across cloud interconnects to validate SLA compliance and troubleshoot performance bottlenecks.