Disclaimer: This is a fictional networking project created for educational purposes as part of my Cyber Security studies. It is not affiliated with, authorized by, or representative of any real-world company, including CyberNet Ltd. All configurations and scenarios are simulated.
This project demonstrates the design and implementation of a secure, scalable, and highly available enterprise network connecting a Dubai Headquarters (HQ) with a Karachi Branch.
The solution addresses real-world enterprise challenges such as single points of failure, lack of segmentation, insecure communication, and absence of centralized services, and provides a production-ready architecture using Huawei technologies.
- Company: CyberNet Ltd.
- HQ Location: Dubai, UAE
- Branch Location: Karachi, Pakistan
- Users: ~500 (HQ) + ~50 (Branch)
- Eliminate single points of failure
- Implement secure inter-site communication
- Improve network performance through segmentation
- Ensure high availability and fast failover
- Deploy enterprise-grade security architecture
- Three-tier architecture:
- Core Layer
- Distribution Layer
- Access Layer
- Collapsed architecture (cost-effective design)
- Site-to-Site IPSec VPN over WAN
- IPSec VPN (AES-256 encryption)
- Zone-based firewall policies (default deny)
- DMZ for public-facing services (Web, FTP, DNS)
- NAT Server (port forwarding)
- VRRP (Gateway redundancy, <3s failover)
- HRP (Firewall Active-Standby)
- Eth-Trunk (Link aggregation)
- MSTP (Loop prevention + load balancing)
- OSPF (Dynamic routing, Area 0)
- VLAN Segmentation (Sales, Accounts, Servers, DMZ)
- Inter-VLAN routing at distribution layer
Live Demo:
Branch client accessing HQ DMZ FTP server using private IP over IPSec VPN
[Add your video link here]
- < 3 seconds failover (VRRP, HRP)
- 70% reduction in broadcast traffic
- Secure encrypted communication (IPSec)
- 99.99% theoretical availability
- Successful enforcement of firewall security policies
- VLAN-based isolation for departments
- Separate DMZ network for public services
- Trust (Internal Network)
- DMZ (Public Servers)
- Untrust (Internet)
- Local (Firewall)
- Default: Deny All
- Only explicitly permitted traffic is allowed
| Layer | Mechanism | Failover Time |
|---|---|---|
| Access | Eth-Trunk | <1 sec |
| Distribution | VRRP + MSTP | <3–6 sec |
| Core | Dual Core + OSPF | Automatic |
| Firewall | HRP HA | <3 sec |
- Virtual IP shared between aggregation switches
- Priority-based master selection
- Area 0 backbone
- Automatic route propagation
- Default route advertised by firewall
- IKEv2
- AES-256 encryption
- SHA2-256 hashing
- DH Group 14
- Single ISP (lab environment constraint)
- No IDS/IPS implementation
- No IPv6 support
- No cloud integration (AWS/Azure)
- SD-WAN integration
- Cloud VPN (AWS / Azure)
- Network Access Control (NAC)
- SIEM / SOC integration
- Advanced threat protection (IPS/IDS)
This project was developed alongside the completion of:
Huawei HCIA-Datacom Certification
The complete detailed report (50+ pages) is available here:
/report/Project_Report.pdf
Muhammad Usman
Aspiring Network & Security Engineer
This project is intended for educational and portfolio purposes, demonstrating real-world enterprise network design and implementation concepts using Huawei eNSP.