University Network Security Architecture
A reference architecture demonstrating our engineering approach — not a record of a specific deployed customer. No client names, figures or outcomes are attached.
01 Problem
A campus network must serve staff, students, guests and lab/research segments simultaneously, each with a different trust level, while staying manageable by a small internal IT team.
02 Components
Routed core, segmented VLANs, perimeter firewall, NAC appliance/service, RADIUS server integrated with Active Directory, DHCP/DNS per segment, central log collector.
03 Traffic flow
Student and guest traffic isolated from administrative and research systems at the VLAN and firewall-policy level; inter-segment traffic passes through firewall inspection, not routed directly.
04 Security
NAC and RADIUS authenticate before granting network access; firewall policy enforced between segments; SIEM ingests logs from firewall, RADIUS, AD and core switches.
05 Failure scenarios
Core switch failure: redundant core design prevents single point of failure. RADIUS server failure: fallback authentication policy prevents a full lockout. Firewall failure: fail-closed policy on critical segments, fail-open considered only where safety requires it.
06 Recovery
Directory services, DNS/DHCP configuration and locally hosted academic systems backed up with Object Lock immutability; restore tested on a scheduled cadence.
07 Technology options
NAC and RADIUS can integrate with most existing directory services; firewall vendor is not fixed to a single platform.
08 Trade-offs
More granular segmentation increases security but also increases management overhead for a typically small campus IT team — segmentation boundaries should match what the team can realistically maintain.