http://blog.marko-apfel.de/topics/network/Recent content in Network on Marko ApfelHugoen-USSun, 22 Dec 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/resulting-architecture-and-lessons-learned/Sun, 22 Dec 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/resulting-architecture-and-lessons-learned/Looking back at the finished segmented network: what worked, what caused confusion along the way, and the operational checklist that keeps it maintainable going forward.http://blog.marko-apfel.de/posts/troubleshooting-vlan-connectivity/Tue, 10 Dec 2024 18:00:00 +0100http://blog.marko-apfel.de/posts/troubleshooting-vlan-connectivity/A layer-by-layer checklist for isolating VLAN connectivity failures — from cabling and tagging up through routing, firewall policy, and NAT — instead of guessing at fixes.http://blog.marko-apfel.de/posts/dedicated-interfaces-for-management-and-vlans/Tue, 10 Dec 2024 08:00:00 +0100http://blog.marko-apfel.de/posts/dedicated-interfaces-for-management-and-vlans/The single decision that paid off most in this project: keeping the WebAdmin path physically separate from the trunk being reconfigured, backed by a tested recovery procedure.http://blog.marko-apfel.de/posts/separating-iot-and-smart-home-devices/Mon, 09 Dec 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/separating-iot-and-smart-home-devices/Putting IoT devices in their own VLAN is only step one — this part works through placing MQTT and HomeMatic services deliberately, writing a flow matrix, and handling broken multicast discovery across VLAN boundaries.http://blog.marko-apfel.de/posts/inter-vlan-routing-and-firewall-rules/Sun, 08 Dec 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/inter-vlan-routing-and-firewall-rules/Connected routes tell Sophos XG where a network is, not whether traffic may go there — a look at building specific, named, flow-based firewall rules instead of broad LAN-to-LAN allows.http://blog.marko-apfel.de/posts/building-a-dedicated-management-network/Sun, 01 Dec 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/building-a-dedicated-management-network/Why a management network should hold only management planes rather than every device that feels important, and how firewall rules and local service ACLs govern access to it differently.http://blog.marko-apfel.de/posts/connecting-a-managed-switch/Thu, 28 Nov 2024 12:00:00 +0100http://blog.marko-apfel.de/posts/connecting-a-managed-switch/Getting the switch-to-firewall trunk right: access versus trunk ports, tagged versus native VLANs across Cisco and HP terminology, and a repeatable test procedure for adding each new VLAN safely.http://blog.marko-apfel.de/posts/configuring-vlan-interfaces/Sun, 13 Oct 2024 12:00:00 +0200http://blog.marko-apfel.de/posts/configuring-vlan-interfaces/A walkthrough of creating VLAN interfaces, zones, and network objects on Sophos XG, plus a one-VLAN-at-a-time validation loop that keeps troubleshooting manageable.http://blog.marko-apfel.de/posts/planning-vlans-and-ip-subnets/Sun, 06 Oct 2024 12:00:00 +0200http://blog.marko-apfel.de/posts/planning-vlans-and-ip-subnets/How to turn a trust-boundary model into disjoint VLAN IDs and subnets, avoid the overlapping-network trap, and keep DHCP, DNS, and migration steps documented as you go.http://blog.marko-apfel.de/posts/designing-a-segmented-home-network/Sun, 29 Sep 2024 12:00:00 +0200http://blog.marko-apfel.de/posts/designing-a-segmented-home-network/Why a flat home network breaks down once IoT, media, and management devices share one broadcast domain, and how trust boundaries — not VLAN numbers — should drive the design.