Lab build · 5-device Cisco topology, 2026
Five controls, one network, proven before and after
Defense in depth only means something if each layer is actually verified rather than assumed. Every control in this build has a before-and-after test: a ping that fails after the firewall goes up, an SA counter that moves once the VPN carries real traffic, an alert that fires in the IDS log at the exact timestamp a test packet was sent, a port that shuts itself down the moment a second MAC address shows up where it shouldn’t.
The honeypot section includes a result most portfolios would leave out: a fingerprinting tool identified it as a decoy with 95.45% confidence. That’s reported directly rather than smoothed over, because knowing the limits of a control is part of deploying it responsibly, not a reason to hide the number.
Approach
Control 1
Zone-based firewall first
Three zones on the edge router with stateful policy between them, proven by pinging every zone pair before and after the policy was applied rather than just describing the rule set.
Control 2
Encrypt the WAN link
A site-to-site IPSec VPN (IKEv1, AES-256, Perfect Forward Secrecy) between the two LAN routers, verified by watching the IPSec SA counters move from zero to real encrypted packet counts once matching traffic crossed the link.
Control 3
Add detection behind the firewall
A Suricata IDS reading a full SPAN-mirrored copy of traffic inside the trusted zone, including one custom signature written and confirmed firing in both the plaintext alert log and structured JSON output.
Control 4
Add deception, then harden Layer 2
A Cowrie SSH honeypot isolated in its own zone with no path to production hosts, plus DHCP snooping, port security, and BPDU/Root Guard on the switching fabric underneath everything else.
5
Independently proven controls
0
Shared path between the honeypot and production hosts
95.45%
Honeypot detection confidence, reported honestly rather than hidden