Understand what exists
before touching anything.
The school has more than 500 users on more than 80 workstations. Before proposing a target design, I ran a full audit of the existing setup along four lines:
- Security: exposure, permissions, remote access, backup policy.
- Systems: servers, directory, services, workstation deployment.
- Network: physical and logical topology, addressing, WiFi.
- Organisation: usage, inventory, documentation, procedures.
This audit became the basis for the recommendations report and for the design of the target architecture.
Segment to protect.
The target design splits the network into 3 VLANs (admin, teaching and management) behind a pfSense firewall that controls traffic between zones. Services are virtualised on 3 Hyper-V hypervisors, with a layer of Docker containers managed through Portainer.
The right tool for each layer.
The project covers the whole chain, from the firewall to backups, with automated deployments to keep every workstation consistent.
# Overview of the deployed stack network: firewall: pfSense segmentation: VLAN 802.1Q # admin · teaching · management wifi: Cisco C9800 dns_filtering: AdGuard remote_access: client_to_site: OpenVPN # LDAP + MFA authentication site_to_site: IPsec / OPNsense virtualisation: hypervisors: 3 # Hyper-V containers: Docker + Portainer operations: monitoring: Prometheus + Grafana inventory: GLPI backups: Acronis → NAS deployment: GPO
What changed.
A segmented, monitored, backed-up and documented infrastructure, in production across the whole school.