NetSecLab — Network Security Controls Simulator

NETSECLAB

00:00:00 NSP-2 · VLAN/VPN Security Controls Guided Mode

🌐 WAN Uplink

│

🔥 Perimeter FW

│

🔀 Core Switch L3

├──

🏢 VLAN 10 — Corp

├──

💻 VLAN 20 — Mgmt

├──

📡 VLAN 30 — Guest

└──

🛡️ VPN Gateway

⚠ INCIDENT BRIEF — ACME FINANCIAL SERVICES INC.

You are the Network Security Specialist. A recent audit uncovered uncontrolled lateral movement across network segments. Configure 10 security controls to remediate.

📂 Control Categories

Controls are organized by who/what manages them:

Managerial Operational Technical Physical

Managerial: Policies, risk assessments, governance
Operational: People/process — training, procedures
Technical: Software/hardware — firewalls, encryption
Physical: Locks, guards, badge access

⚙ Functional Types

Controls are also classified by what they do:

Preventive Detective Corrective Deterrent Directive Compensating

Preventive: Stops an attack before it happens
Detective: Identifies/alerts when attack occurs
Corrective: Reduces impact after the fact
Deterrent: Discourages attackers
Directive: Specifies required behavior
Compensating: Alternative when primary unavailable

🏗 VLAN Quick Ref

VLAN 10 — Corporate LAN (192.168.10.0/24)
VLAN 20 — Management (10.0.20.0/24)
VLAN 30 — Guest/DMZ (172.16.30.0/24)

Trunk ports carry multiple VLANs using 802.1Q tagging. Access ports carry a single VLAN. The native VLAN must be explicitly set to prevent VLAN hopping.

🔐 VPN Quick Ref

IKEv2/IPSec — Site-to-Site or Remote Access
AES-256-GCM — Recommended cipher suite
SHA-256 — Integrity hashing
DH Group 14+ — Key exchange
Split Tunneling — Route only corp traffic through VPN; disable for high-security environments
Perfect Forward Secrecy — New session keys each tunnel

📊 Step Evaluations

VLAN Segmentation–

Native VLAN Hardening–

ACL Policy–

VPN Protocol–

Cipher Suite–

Auth Method–

IDS/IPS Placement–

Log Destination–

Ctrl Category–

Ctrl Function–