===============================================================================
  NETWORK TOPOLOGY — GLOBEX CORPORATION
  Last updated: 2026-03-01  |  Classification: INTERNAL USE ONLY
  Network team contact: netops@globex.com
===============================================================================


                          INTERNET
                             |
                             |  ISP Link: 1 Gbps
                             |  Public IP Range: 203.0.113.0/28
                             |
                    +--------+--------+
                    |   FW-EDGE-01    |   Palo Alto PA-3260
                    |  (Edge Firewall)|   PAN-OS 11.1
                    +--------+--------+
                             |
              +--------------+--------------+
              |                             |
      +-------+-------+           +--------+--------+
      |   DMZ ZONE    |           |  VPN GATEWAY     |
      | VLAN 10       |           |  10.10.20.1/24   |
      | 10.10.10.0/24 |           |  GlobalProtect   |
      +-------+-------+           +------------------+
              |
     +--------+--------+--------+
     |        |        |        |
  +--+--+  +--+--+  +--+--+  +--+--+
  | WEB |  | MAIL|  | DNS |  | WAF |
  | 01  |  | 01  |  | 01  |  | 01  |
  +-----+  +-----+  +-----+  +-----+
  .11       .12       .13       .14
  nginx     Exchange  BIND9     ModSec
  1.25.4    2019 CU12 9.18.18   3.0.12

              |
              |  DMZ-to-Internal link
              |
    +---------+---------+
    |   FW-INTERNAL-01  |   Palo Alto PA-850
    |  (Internal FW)    |   PAN-OS 11.1
    +---------+---------+
              |
   +----------+----------+----------+
   |          |          |          |
   |          |          |          |
+--+---+ +---+----+ +---+----+ +---+----+
|CORP  | |SERVER  | |MGMT    | |DATABASE|
|LAN   | |VLAN    | |VLAN    | |ZONE    |
|VLAN20| |VLAN 30 | |VLAN 40 | |VLAN 50 |
+--+---+ +---+----+ +---+----+ +---+----+
   |          |          |          |
   |          |          |          |


==============================  VLAN DETAILS  ================================

VLAN 10 — DMZ (10.10.10.0/24)
  Purpose:       Public-facing services
  Hosts:
    10.10.10.11  DMZ-WEB01      nginx 1.25.4 reverse proxy + app server
    10.10.10.12  DMZ-MAIL01     Exchange 2019 CU12, inbound/outbound email
    10.10.10.13  DMZ-DNS01      BIND 9.18.18, authoritative external DNS
    10.10.10.14  DMZ-WAF01      ModSecurity 3.0.12, WAF for WEB01
  Security Controls:
    - IDS/IPS:   Suricata sensor (span port on FW-EDGE-01)
    - Logging:   All hosts forward to SIEM via rsyslog
    - AV:        ClamAV on MAIL01 for attachment scanning
    - Patching:  Monthly cycle, 72-hour SLA for critical CVEs

VLAN 20 — Corporate LAN (10.20.30.0/24)
  Purpose:       Employee workstations
  Hosts (partial list):
    10.20.30.10  SRV-FILE01     Windows Server 2022, department file shares
    10.20.30.15  SRV-PRINT01    Windows Server 2019 (*** SMBv1 ENABLED ***)
    10.20.30.40  WKS-JPARK      Windows 11 Pro, Help Desk
    10.20.30.45  WKS-MCHEN      Windows 11 Pro, Finance Analyst
    10.20.30.50  WKS-JMARTINEZ  Windows 11 Pro, IT Support
    10.20.30.55  WKS-TNGUYEN    Windows 11 Pro, Operations
    10.20.30.60  WKS-DKIM       Windows 11 Pro, Marketing
    10.20.30.65  WKS-RPATEL     Windows 11 Pro, Engineering
    10.20.30.70  WKS-LRODRIGUEZ Windows 11 Pro, Legal
  Security Controls:
    - EDR:       CrowdStrike Falcon on all endpoints
    - AV:        Microsoft Defender (managed via Intune)
    - Logging:   Sysmon + Windows Event Forwarding to SIEM
    - Patching:  WSUS, monthly cycle
    - NOTE:      SRV-PRINT01 has deferred patching (legacy driver dependency)

VLAN 30 — Server VLAN (10.20.40.0/24)
  Purpose:       Internal application and infrastructure servers
  Hosts:
    10.20.40.10  SRV-DC01       Windows Server 2022, Primary Domain Controller
    10.20.40.11  SRV-DC02       Windows Server 2022, Secondary Domain Controller
    10.20.40.20  SRV-APP01      Ubuntu 22.04, internal web applications
    10.20.40.30  SRV-SIEM01     Ubuntu 22.04, Splunk Enterprise 9.2
    10.20.40.35  SRV-BACKUP01   Windows Server 2022, Veeam Backup
  Security Controls:
    - EDR:       CrowdStrike Falcon on Windows, OSSEC on Linux
    - Logging:   All servers forward to SRV-SIEM01
    - Patching:  Monthly with 48-hour SLA for critical
    - Access:    RDP/SSH restricted to VLAN 40 (MGMT) only

VLAN 40 — Management VLAN (10.20.50.0/24)
  Purpose:       IT admin jump boxes, network management
  Hosts:
    10.20.50.10  JUMP-WIN01     Windows Server 2022, RDP jump box
    10.20.50.11  JUMP-LIN01     Ubuntu 22.04, SSH jump box
    10.20.50.20  NMS-01         LibreNMS, network monitoring
  Security Controls:
    - Access:    MFA required for all logins
    - Logging:   Session recording enabled
    - Network:   Only VLAN with access to server and database VLANs mgmt ports

VLAN 50 — Database Zone (10.20.60.0/24)
  Purpose:       Production databases
  Hosts:
    10.20.60.10  DB-SQL01       SQL Server 2022, primary business data
    10.20.60.11  DB-SQL02       SQL Server 2022, reporting replica
    10.20.60.20  DB-PG01        PostgreSQL 16, application database
  Security Controls:
    - Access:    Only SRV-APP01 and JUMP boxes can reach DB ports
    - Encryption: TLS 1.3 enforced for all DB connections
    - Logging:   Database audit logging enabled, forwarded to SIEM
    - Backups:   Daily to SRV-BACKUP01, encrypted at rest


============================  FIREWALL RULES  ================================

--- FW-EDGE-01 (Edge Firewall) — Simplified Rule Set ---

RULE  SRC               DST               PORT/PROTO   ACTION   LOG   NOTES
----  ----------------  ----------------  -----------  ------   ---   -----
E01   Any (Internet)    10.10.10.11       TCP/80,443   ALLOW    Yes   Web traffic to DMZ-WEB01 via WAF
E02   Any (Internet)    10.10.10.12       TCP/25,587   ALLOW    Yes   SMTP inbound to DMZ-MAIL01
E03   Any (Internet)    10.10.10.13       TCP/53,UDP/53 ALLOW   Yes   DNS queries to DMZ-DNS01
E04   VPN-Pool          10.20.30.0/24     TCP/3389     ALLOW    Yes   Remote Desktop for VPN users
E05   VPN-Pool          10.20.30.0/24     TCP/445      ALLOW    Yes   File share access for VPN users
E06   10.10.10.0/24     Any (Internet)    TCP/80,443   ALLOW    Yes   DMZ outbound HTTP/S (updates)
E07   10.10.10.0/24     Any (Internet)    TCP/25       ALLOW    Yes   SMTP outbound from MAIL01
E08   Any               Any               Any          DENY     Yes   Default deny all

--- FW-INTERNAL-01 (Internal Firewall) — Simplified Rule Set ---

RULE  SRC               DST               PORT/PROTO   ACTION   LOG   NOTES
----  ----------------  ----------------  -----------  ------   ---   -----
I01   10.10.10.12       10.20.40.10       TCP/389,636  ALLOW    Yes   MAIL01 -> DC01 LDAP for auth
I02   10.20.30.0/24     10.20.30.0/24     TCP/445      ALLOW    No    ** Intra-VLAN SMB (overly broad)
I03   10.20.30.0/24     10.20.30.0/24     TCP/3389     ALLOW    No    ** Intra-VLAN RDP (overly broad)
I04   10.20.30.0/24     10.20.40.10-11    TCP/389,636  ALLOW    Yes   Workstations -> DCs for AD
I05   10.20.30.0/24     10.20.40.20       TCP/8080     ALLOW    Yes   Workstations -> APP01 web app
I06   10.20.30.0/24     Any (Internet)    TCP/80,443   ALLOW    Yes   Workstations outbound web
I07   10.20.50.0/24     10.20.40.0/24     TCP/3389,22  ALLOW    Yes   MGMT -> Servers (RDP/SSH)
I08   10.20.50.0/24     10.20.60.0/24     TCP/1433,5432 ALLOW   Yes   MGMT -> Databases
I09   10.20.40.20       10.20.60.0/24     TCP/1433,5432 ALLOW   Yes   APP01 -> Databases
I10   10.20.30.0/24     10.20.40.0/24     Any          DENY     Yes   Block workstations -> servers (except above)
I11   10.20.30.0/24     10.20.60.0/24     Any          DENY     Yes   Block workstations -> databases
I12   Any               Any               Any          DENY     Yes   Default deny all

** SECURITY FINDINGS:
   - Rule I02: Allows unrestricted SMB between ALL hosts in VLAN 20. This
     enabled lateral movement from WKS-MCHEN to SRV-PRINT01 via EternalBlue.
     Recommendation: Restrict SMB to file server (SRV-FILE01) only.
   - Rule I03: Allows unrestricted RDP within VLAN 20. Workstation-to-
     workstation RDP is rarely needed. Recommendation: Remove or restrict
     to IT admin workstations only.
   - Rule I06: No outbound content filtering or SSL inspection. Allows
     C2 callbacks and data exfiltration over HTTPS.
     Recommendation: Enable SSL decryption, category-based URL filtering,
     and block uncategorized destinations from servers.
   - Rule E06: DMZ servers can reach any internet destination. SRV-FILE01
     used this path for exfiltration (though SRV-FILE01 is on VLAN 20,
     rule I06 applied). Recommendation: Restrict DMZ outbound to known
     update repositories only.
   - Missing Rule: No rule blocks servers (VLAN 30) from outbound internet.
     SRV-DC01 DNS tunneling exfiltration was not blocked.
     Recommendation: Servers should only reach internet via explicit proxy.


==========================  SECURITY CONTROLS SUMMARY  =======================

LAYER               CONTROL                    STATUS         GAPS
------------------  -------------------------  -------------  ----------------
Edge Perimeter      Palo Alto PA-3260          Operational    No SSL decrypt
DMZ                 Suricata IDS               Operational    Signature-only
DMZ                 WAF (ModSecurity)          Operational    OWASP CRS 4.0
Email Gateway       Exchange transport rules   Operational    No sandbox/detonation
VPN                 GlobalProtect + MFA        Operational    None known
Corp LAN            CrowdStrike Falcon EDR     Operational    SRV-PRINT01 outdated agent
Corp LAN            Sysmon + WEF               Operational    Not on DMZ hosts
Corp LAN            Microsoft Defender AV      Operational    Policy allows user disable
Internal FW         Palo Alto PA-850           Operational    Rules too broad (see above)
Servers             CrowdStrike / OSSEC        Operational    OSSEC alerting delayed
Database Zone       TLS + audit logging        Operational    No DLP on DB queries
SIEM                Splunk Enterprise          Operational    14-day hot retention only
Backup              Veeam                      Operational    No immutable backup copies
Vulnerability Mgmt  Tenable Nessus             Operational    Monthly scan only
Patch Management    WSUS                       Partial        SRV-PRINT01 deferred
DLP                 Forcepoint DLP             Partial        Covers email only, not endpoints

===============================================================================
  Student Task:
  1. Identify at least 5 security architecture weaknesses
  2. Propose firewall rule changes to prevent the observed attack
  3. Recommend network segmentation improvements
  4. Design monitoring improvements for each identified gap
===============================================================================
