Initializing Secure Network Architecture...
Multi-layered security model protecting UETM's internal and external communications across all network tiers.
Click on a security layer ring above to view its configuration details
Deep packet inspection, IPS/IDS, application-aware filtering at network perimeter
Encrypted tunnels for remote faculty access and inter-campus WAN communication
Port-level authentication with RADIUS ensuring only authorized devices connect
Centralized log aggregation, correlation, and real-time threat intelligence analysis
Microsegmentation isolating departments, labs, admin, and guest networks
EDR agents on all workstations with behavioral analysis and automated response
Simulate common attack vectors against the UETM network and observe how defense mechanisms respond in real-time.
Analysis of UETM's existing network layout weaknesses and the proposed improvements for a secure, scalable campus network.
All departments, labs, admin, and hostels share one broadcast domain. A single compromised device can reach every other device on the network.
Basic ACLs on the router provide no deep packet inspection, no IDS/IPS, no application-level filtering. Advanced threats pass through undetected.
No RADIUS/LDAP integration. Shared Wi-Fi passwords across departments. No individual accountability or device posture checking.
Exam data, grades, and administrative communications traverse the LAN in plaintext. Susceptible to MITM and packet sniffing attacks.
No centralized logging or security event correlation. Incidents go undetected for days or weeks. No forensic capability.
Server room access not restricted with biometric/card. Network switches in unlocked wiring closets accessible to students.
Deploy 35+ VLANs isolating each department, lab cluster, admin wing, hostels, and guest networks. Inter-VLAN routing controlled via L3 ACLs on the core switch with strict deny-all-except policies.
Install Cisco Firepower 2100 or Palo Alto PA-400 at the HEC PERN edge. Enable deep packet inspection, intrusion prevention (IPS), SSL decryption, and geo-IP blocking for known threat countries.
Implement FreeRADIUS or Cisco ISE with Active Directory backend. Every device authenticates before receiving network access. Guest portal with captive login for visitors.
Deploy TLS 1.3 for all internal web apps (LMS, exam portals). Implement IPSec tunnels for inter-building backbone links. Encrypt DNS with DoH/DoT to prevent snooping.
Deploy Wazuh + ELK Stack for centralized log collection from all network devices. Set up correlation rules for brute-force, lateral movement, and data exfiltration detection.
Move toward never-trust, always-verify model. Continuous authentication, micro-segmentation at application layer, and context-aware access policies for sensitive resources.