The challenge
The enterprise network relied on VLANs and static ACLs. Access needed to follow the user and device rather than the switch port, and partner traffic had to be cleanly separated from internal services.
What I did
- Designed a layered access–distribution–core topology with redundancy built in.
- Rolled out Cisco DNA Center with SD-Access, integrated with Cisco ISE and wireless LAN controllers for user-based access control, device profiling and secure mobility.
- Implemented VRF-based segmentation and MP-BGP multicast routing for partner and internal networks.
- Designed hierarchical IPv4 and IPv6 addressing for data centers and cloud regions.
- Wrote LLDs, MOPs and rollback plans for every change, and trained junior engineers.
Outcome
- Identity-based access and profiling instead of port-based VLANs.
- Partner and internal traffic separated by design.
- A scalable, conflict-free addressing plan ready for IPv6.