Mapping a flat network and planning a safe VLAN cutover

I audited a flat network, mapped the switching and device relationships, and built a low-risk VLAN cutover plan that accounted for console access, trunks, DHCP, gateways, firewall policy, and internet continuity.

Context

The environment used Juniper and Meraki switching with selected devices that needed isolation. Related work also involved Sophos routing, NAT, DNS forwarding, VPN paths, public services, and private management access.

My role

I performed discovery, mapped the network evidence, identified prerequisites, and planned the cutover and validation sequence.

Result

The project produced a defensible segmentation plan with the dependencies and recovery access identified before the live switching and firewall changes.

The problem

Why the work needed more than one tool

In a flat network, the topology in the controller or old notes may not match where devices actually connect. A VLAN change can remove management access, DHCP, gateway reachability, or internet service if trunks and firewall paths are not prepared together.

What could go wrong

Losing remote management during the cutover
Assigning VLANs to the wrong ports or uplinks
Creating DHCP or gateway gaps
Changing the switch before the firewall can route and enforce policy
Publishing management interfaces directly to the internet as a shortcut

What I did

The working sequence

Mapped switch ports, VLAN membership, MAC addresses, and uplinks
Identified selected devices and the traffic they still needed after isolation
Documented requirements for on-site console access and recovery
Planned trunk, access-port, DHCP, gateway, and firewall changes as one sequence
Used Sophos logs, DNS tools, port tests, and scoped temporary rules to diagnose traffic paths
Used Tailscale and SSH tunnels for private management paths instead of direct publication
Validated Cloudflare, DNS, NAT, and firewall interactions for published services

How I validated it

Evidence before completion

Compared MAC evidence with switch-port and uplink state
Confirmed console access and rollback prerequisites before disruptive steps
Checked DHCP, gateway, DNS, and intended internet reachability in the planned sequence
Used firewall logs and endpoint tests to prove the path rather than only the rule configuration
Kept sensitive management interfaces private through Tailscale or loopback-bound access

What this demonstrates

The skill behind the tools

This project demonstrates that I approach segmentation as a service-continuity and management-recovery problem, not only a VLAN configuration exercise.

Production details are intentionally anonymized. I do not publish organization names, internal addresses, credentials, private topology, or sensitive recovery information.

Platforms and tools

Juniper Meraki Sophos XGS VLANs DHCP Routing DNAT/SNAT Cloudflare Tailscale SSH

Continue through the project inventory

All projects Experience