NTI المنوفيه

Secure Network Infrastructure Design with High Availability Firewalls

This project demonstrates the design and implementation of a secure enterprise network architecture using dual firewalls configured in a High Availability (Hot Standby) setup to ensure network reliability and continuous service availability.

The network is divided into three main security zones to enhance security and traffic control:

1. Trust Zone (Internal Network)

This zone represents the internal company network where employee devices are located. It includes client machines such as PC1 operating in the 10.3.0.0/24 subnet. The default gateway is configured using VRRP to provide gateway redundancy.

2. DMZ Zone (Demilitarized Zone)

The DMZ hosts public-facing services such as servers that need to be accessible from external networks while remaining isolated from the internal network. In this design, Server1 operates in the 10.10.0.0/24 subnet and is protected by the firewall layer to prevent direct access to the internal network.

3. Untrust Zone (External Network / Internet)

This zone represents the external network or internet. A simulated external client (PC2) exists in the 1.1.1.0/24 subnet to test external connectivity and access policies.

To ensure network resilience, two firewalls are deployed:

FW1 – Active Firewall

FW2 – Standby Firewall

If the active firewall fails, the standby firewall automatically takes over, ensuring uninterrupted network operation.

The network design also implements multiple security and networking technologies including:

VRRP (Virtual Router Redundancy Protocol) for gateway redundancy

Network Address Translation (NAT) for internal-to-external communication

Security Policies to control traffic between zones

User Management for authentication and access control

SSL VPN for secure remote access

IPSec VPN for secure site-to-site connectivity

Traffic policies are configured to allow internal users to access the internet and DMZ services, while preventing unauthorized external access to the internal network, ensuring a secure and segmented network architecture.

This design focuses on network segmentation, high availability, and enterprise-level security implementation.