The problem
Production is the wrong place to experiment. Changing firewall policy, VLAN design or Group Policy affects people who are working, so I wanted somewhere to build the same patterns end to end, break them on purpose, and see what the logs actually show.
The approach
- Segmented the network into Management, Server, User and Guest VLANs, with inter-VLAN traffic only allowed through firewall policy.
- Built a Windows Server domain with DNS, DHCP, domain join, centralised authentication and basic Group Policy.
- Configured the FortiGate VM as the gateway: NAT, policy-based access, web and application control, logging, and SSL VPN for remote access.
- Scanned the Windows and Linux hosts with Greenbone OpenVAS, reviewed the findings, applied fixes and re-scanned to confirm them.
- Centralised endpoint and firewall events in Wazuh to watch failed logins, suspicious processes and security alerts.
- Validated the setup by simulating repeated authentication failures and checking that the alerts, events and response workflow behaved as expected.
The result
Four isolated VLANs with controlled east-west traffic, central authentication through Active Directory, remote access over SSL VPN, a repeatable scan → fix → re-scan workflow, and one place to see security events. The lab is where I try changes before they ever reach a production network.