Network Topology & Global Subnet Schema
This document details the physical and logical layout of the enterprise network, including VLAN assignments, CIDR ranges, gateway endpoints, and inter-device trunk links.
1. Global Addressing Architecture
The infrastructure uses an isolated multi-VLAN model routed via 802.1Q sub-interfaces on the pfSense perimeter gateway.
| VLAN ID | Subnet Name | CIDR Prefix | Gateway (pfSense) | Assigned Hosts & Management IPs | Purpose / Security Scope |
|---|---|---|---|---|---|
| 10 | MGMT | 10.10.60.0/24 | 10.10.60.1 | 10.10.60.2 (Cisco SG300-52) | Hardware & appliance management interfaces |
| 20 | LAN | 10.10.20.0/24 | 10.10.20.1 | Dynamic / Static User Endpoints | Internal enterprise employee workstations |
| 30 | LAB | 10.10.30.0/24 | 10.10.30.1 | 10.10.30.10 (Proxmox VE)10.10.30.11 (Ubuntu Syslog)10.10.30.30 (Synology NAS) | Server lab, central logging, and backups |
| 40 | GST | 10.10.40.0/24 | 10.10.40.1 | Guest Wireless / Untrusted Clients | Isolated Internet-only access |
| 50 | EXEC | 10.10.50.0/24 | 10.10.50.1 | Executive & Sensitive Devices | High-security administrative segment |
| — | WireGuard | 10.200.0.0/29 | 10.200.0.1 | Remote Engineer Workstations | Out-of-band administrative access |
2. Physical & Logical Trunk Architecture
Inter-VLAN routing is performed by pfSense over an 802.1Q router-on-a-stick trunk:
- Trunk Port: Port
Gi1on the Cisco SG300-52 connects directly to the internal LAN interface on pfSense. - Encapsulation: 802.1Q tagged frames for VLANs 10, 20, 30, 40, and 50.
- Switch Management: The Cisco switch web and SSH management interface is bound to VLAN 10 (
10.10.60.2).