Segmenting an Enterprise-Pattern Network with Audit-First Change Management

Executive Summary & Context

Most small-office and lab networks operate as flat Layer 2 broadcast domains where user endpoints, IoT devices, hypervisor management interfaces, and administrative planes share fate. To model production-grade infrastructure administration, an Enterprise-Pattern Segmented Network was engineered to enforce strict inter-VLAN policy boundaries while operating under formal change management.

Every architectural modification follows an Audit → Remediate → Verify lifecycle documented in a living specification that preserves incident history (Symptom, Root Cause, Fix, Verification) rather than overwriting past states.

---

Architecture & Technical Execution

+-------------------------------------------------------------------+
|                     WAN / ISP Uplink + NUT UPS                    |
|                (Dynamic DNS + Out-of-Band Watchdogs)              |
+-------------------------------------------------------------------+
                                  |
                                  v
+-------------------------------------------------------------------+
|                   OPNsense Stateful Firewall                      |
|         Inter-VLAN Policy Engine + WireGuard (/24 Tunnel)         |
+-------------------------------------------------------------------+
         |                        |                        |
         | 802.1Q Trunk           | Dedicated /24          |
         v                        v                        v
+--------------------+   +--------------------+   +-----------------+
|  Aruba CX Managed  |   | WireGuard Admin    |   | Proxmox VE Host |
|  Core Switch (L2)  |   | Subnet (Out-of-VLAN|   | (VMs & LXCs)    |
+--------------------+   | Return Routing)    |   +-----------------+
   |       |       |     +--------------------+
   v       v       v
[USER]  [INFRA] [MGMT]   +--> Aruba Instant AP Mesh (Virtual Controller)

1. Multi-VLAN Segmentation & WireGuard Routing Design

• Segmented Security Zones: Traffic is partitioned across distinct 802.1Q VLANs separating general user traffic, infrastructure services, privileged management planes, and isolated work/testing environments.
• Dedicated /24 WireGuard Subnet: Remote administrative access into the management plane terminates on its own dedicated /24 tunnel subnet rather than carving a smaller CIDR block out of an existing VLAN. Carving a tunnel subnet inside an active LAN segment causes local hosts to ARP directly for tunnel peers instead of routing through the default gateway, breaking asymmetric return paths without proxy ARP workarounds.

2. Self-Audit Discovery: Inter-VLAN Rule-Order Verification

Rather than assuming firewall policy matched design intent, a formal rule-order audit was conducted:

• Finding: While the network specification stated that the privileged management zone was restricted exclusively to administrative endpoints, the live firewall rules only locked down web GUI and SSH ports—leaving no blanket inter-VLAN deny rule between general user segments and the management subnet.
• Remediation & Verification: Implemented and verified an explicit IPv4 inter-VLAN block rule positioned above the default allow rule.
• Transparent Open-Item Tracking: The same verification audit identified that the block rule was scoped to IPv4 while an allow-all IPv6 rule remained below it. Instead of concealing the discrepancy, it was logged as an open verification item in the network specification to validate whether management interfaces carry active IPv6 addressing and enforce dual-stack policy parity.

3. Sequenced LACP Cutover Planning

To aggregate links between the OPNsense firewall and the core Aruba switch without losing management access—and accounting for FreeBSD’s constraint that a network interface cannot simultaneously act as a VLAN parent and a lagg(4) member—a sequenced maintenance procedure was engineered:

1. Bring up the secondary physical link first with zero impact on production traffic.
2. Validate 802.3ad LACP negotiation on the new aggregate interface.
3. Re-point VLAN parent interfaces onto the lagg interface prior to adding the primary live NIC.
4. Execute the management interface cutover during a scheduled off-hours maintenance window with physical serial console out-of-band access and logged terminal sessions.

4. Power & Edge Telemetry

• UPS Monitoring: Network UPS Tools (NUT) runs on the firewall appliance, validated via a live mains-unplug test confirming automated alerting.
• WAN Watchdog: External IP transitions trigger push notifications alongside automated Dynamic DNS updates.

---

Measurable Impact & Results

• Verified Inter-VLAN Isolation: Explicit IPv4 deny rules enforced and verified between general user traffic and privileged management/infrastructure planes.
• Audit-Grade Documentation: Every network change and self-audit finding is tracked with explicit status markers (Resolved, Pending, Open) in a living engineering specification.
• Resilient Operations: Validated out-of-band power telemetry (NUT) and zero-downtime LACP migration planning across mixed FreeBSD/Aruba hardware.