An enterprise-grade lab I built, run, and learn on — every day.
The networking is production-style and runs my home for real. The security/SOC stack is a deliberate learning environment I stood up to study blue-team fundamentals — not professional experience. The achievement is building and operating real infrastructure, and learning on it honestly.
Default-deny between segments on the ASA, with explicit, logged exceptions. Wi-Fi segmented by SSID into matching VLANs.
- ›Dual-WAN PCC load balancing + failover (verified by simulating a WAN outage)
- ›NAT/masquerade · default-deny WAN input chain
- ›DNS forwarding to a filtering resolver over DNS-over-TLS
- ›Scheduled daily config backups · dynamic DNS
- ›SSH hardened, management restricted to the admin VLAN; Telnet/FTP/HTTP disabled
- ›End-to-end perimeter policy; inter-VLAN ACLs with explicit deny + logging
- ›No "permit ip any any" — least exposure by default
- ›NAT and per-VLAN sub-interfaces · basic threat detection
- ›Remote syslog to the SIEM · AAA · login banner · RSA 2048
- ›802.1Q VLAN trunking · STP with BPDU protection on edge ports
- ›Port security · LLDP · SNMP monitoring
- ›SSHv2-only management (Telnet/web disabled)
- ›Consistent NTP across every device
- ›Zabbix 7.0 LTS watching 14 hosts (~1,700 metrics) across the lab
- ›Agentless Proxmox + agents on Linux hosts + SNMP on ASA / MikroTik / Aruba
- ›Email alerting on high-severity events: host/link/service down, resource pressure
- ›Dashboards for dual-WAN ISP throughput and device health
Centralized syslog from the firewall, switch and router feeds the SIEM, with email alerting on high-severity events. This stack is how I practice — not production or professional experience.
Cabled to be maintained — not just to work.
Rack-mounted with structured cabling: a modular patch panel, labeled and color-coded runs, and PoE to the access points — built to stay readable a year from now, not just to work today.