This project simulates a highly secure, resilient, and highly available network infrastructure for a major retail branch connecting to a centralized Data Center (simulating the Shoprite Brackenfell DC).
Retail networks require absolute stability for Point-of-Sale (POS) systems, strict segmentation to meet PCI-DSS compliance, and centralized management. This lab demonstrates practical competence in achieving these business-critical objectives using Cisco enterprise networking principles.
The topology consists of a localized Branch Network (Layer 2 Switching & Layer 3 Routing) traversing an ISP public network to reach the Corporate Data Center.
All network infrastructure must be secured against unauthorized access before routing begins. Passwords are encrypted, and SSH is enforced for remote VTY access.
To prevent the lateral movement of malware from Back Office PCs to the payment systems, the network is segmented using VLANs and an 802.1Q "Router-on-a-Stick" configuration.
A simulated ISP router was configured to handle public traffic. Default static routes were configured on the Branch and HQ edge routers to push all non-local traffic out to the internet.
.png)
All financial POS data traversing the public ISP must be encrypted. A Site-to-Site IPsec tunnel was built using AES-256 encryption and SHA hashing (Diffie-Hellman Group 5) to guarantee data integrity and confidentiality.
Because IPsec VPNs are policy-based, an extended ping was used to simulate POS traffic and wake the tunnel up. Once established, the POS PC successfully pulled its IP address centrally from the Brackenfell Data Center via DHCP.
To protect against physical breaches (e.g., an attacker unplugging a till and connecting a rogue device), Port Security was enforced on the access switch, locking the port to the Till's specific MAC address.
