BG
BHUWAN GAUTAM NETWORKS // INFRA // (VHUWON)
ENGINEERING REPOSITORY

Projects & Topologies

A catalogue of validated implementations, configurations, and technical labs.

INTERACTIVE ARCHITECT // ALL PLATFORMS LIVE SIMULATOR READY

Create Your Own Project & Topology

Design, generate, and simulate enterprise network architectures across Cisco IOS-XE, Juniper Junos OS, MikroTik RouterOS, Linux Server, Docker Cloud-Native, or Python Automation. Select your parameters below for instant validated configuration code and in-page CLI execution.

CISCO // CAMPUS
Quick Presets:
STEP 01

Choose Platform & Operating System

STEP 02

Choose Architecture & Deployment Goal

STEP 03

Security & Policy Customization

STEP 04

Node Parameters & Addressing Scope

edge-core-01.ios SYNTAX VERIFIED
Role: Campus Core Switch
Interfaces: VLAN 10, 20 / Po1
Protocols: HSRPv2, LACP, PVST+
Security: Strict ACLs
LIVE SIMULATOR // ENVIRONMENT: RUNNING
QUICK VERIFICATION:
[SYSTEM READY] Universal Project Simulator Initialized.
Click "▶ Run Live Simulation" above or type commands below with Tab autocomplete and '?' context-sensitive help.
EDGE-CORE-01#
CASE STUDY // REAL-WORLD AUDIT & REDESIGN ZERO-TRUST HIERARCHY

Enterprise Network Transformation: Flat vs. Segmented Architecture

A comprehensive engineering redesign for a multi-building enterprise campus. Comparing the vulnerabilities of an unmanaged flat network topology against a high-security, 3-tier zero-trust architecture separating Wireless, LAN Network Points, CCTV Surveillance, and IP Telephony (VoIP).

WIRELESS • DATA LAN • CCTV • IP TELEPHONY
LEGACY UNMANAGED

Flat Layer 2 Unsegmented Topology

HIGH RISK: ZERO ISOLATION • SERIAL 100M CHOKE POINTS
🌐 WAN1 📡 WAN2 🔀 Gateway Router Single Subnet / Flat DHCP 1 Gbps Flat 🏢 Network Switch (Layer 2) ⚠️ Shared Broadcast Domain 📶 Network Switch Layer 2 Switch Access Point Routers ❌ Public Wi-Fi Unisolated 💻 Network Points (Workstations LAN) Desk RJ45 Ports 📹 PoE Switch PoE Switch (1) 📹 PoE Switch (2) ⚠️ 100M Daisy Chain CCTV Cameras ❌ Direct Internet Exposure 🏬 Remote Facility Switch (1) Bridged → Local Network Points 🏬 Remote Facility Switch (2) Bridged → Network Points + AP UNMANAGED FLAT NETWORK RISKS Single collision domain • 100M daisy-chain video bottleneck • Zero security separation between Wi-Fi, LAN & CCTV

1. Shared Broadcast & Collision Domain

All endpoints across all buildings shared a single flat subnet. Every ARP request, network broadcast, and device discovery flooded all switchports, creating network-wide packet storms.

2. Lateral Threat Spread & Sniffing

Because there was zero VLAN segmentation, any visitor connected to an access point or any infected workstation could directly scan and sniff internal administrative traffic and surveillance streams using simple packet sniffers.

3. 100M Daisy-Chained PoE Bottleneck

PoE switches powering CCTV cameras were linked together via a serial 100 Mbps uplink. During simultaneous multi-camera high-definition recording, this link became a major choke point, causing severe dropped video frames.

4. CCTV Surveillance Exposed to the Internet

CCTV cameras and the NVR shared default internet access with employee computers. Without an isolated firewall zone, camera firmware was exposed to potential remote exploitation or unauthorized viewing.

5. Zero Voice Prioritization (QoS)

Staff trying to run softphones or IP telephone calls suffered from severe voice distortion and call drops because voice packets competed with heavy file downloads without any Quality of Service tagging.

6. Cascading Switch Failure Points

Cascading unmanaged desktop switches across multiple buildings created daisy-chained loops and single points of failure. If an intermediary switch lost power, entire buildings lost connection.

ENGINEERED RESTRUCTURE // ZERO-TRUST

Hierarchical 3-Tier Segmented Architecture

OPTIMIZED: FULL 802.1Q ISOLATION • VOICE QOS • CCTV ENCLAVE
🌐 WAN1 (Primary ISP) [Active • SFP Optical] 📡 WAN2 (Secondary ISP) [Auto-Failover / Backup] 🛡️ GATEWAY ROUTER (DUAL-WAN) (Dual-WAN Failover • NAT • DHCP • QoS) 802.1Q Core Trunk ⚡ MANAGED CORE SWITCH (Core Backbone & Central Distribution Layer) 💻 Managed Edge Switch VLAN 20: Data LAN 🔌 Network Points Workstation PCs • LAN Shared Local Printers ✓ Isolated from CCTV/Voice 📞 PoE Switch VLAN 50: Voice (QoS) ☎️ Desktop IP Phones & IP PBX Server DSCP Expedited Forwarding ✓ Zero Call Drops / Latency 📹 PoE Switch VLAN 60: CCTV Enclave 📹 IP CCTV Cameras & Central NVR Storage 30-Day Video Retention 🔒 0% Internet Exposure 📶 PoE Switch Wireless AP Distribution 📶 Wi-Fi Access Points VLAN 30 (Staff 802.1X) VLAN 40 (Guest Isolated) ✓ Layer 2 Client Isolation 🛡️ ZERO-TRUST ADVANTAGE: INDEPENDENT BROADCAST & COLLISION DOMAINS Dedicated star topology • Full QoS hardware prioritization for IP Phones • CCTV completely shielded from outside world

TABLE 1.0 Logical Network Segmentation Matrix (802.1Q VLANs & Access Control)

VLAN ID & Name Subnet (CIDR) Usable Hosts Gateway Security Posture Access Control List (ACL) Rules
VLAN 10: MGMT 10.60.10.0/24 254 10.60.10.1 High Security Permit IT Subnet only. Deny all inter-VLAN. Deny Internet inbound.
VLAN 20: STAFF 10.60.20.0/23 510 10.60.20.1 Medium Security Permit Internet. Permit local shared printers. Deny access to VLAN 60 (CCTV).
VLAN 30: STAFF-WIFI 10.60.30.0/23 510 10.60.30.1 Medium Security Bridged to Staff Data. Permit Internet. Enforce 802.1X Enterprise authentication.
VLAN 40: GUEST 10.60.40.0/22 1022 10.60.40.1 Isolated (Zero Trust) Permit Internet ONLY. Enforce Layer 2 Client Isolation. Deny all internal enterprise subnets.
VLAN 50: VOICE 10.60.50.0/24 254 10.60.50.1 High Priority (QoS) Permit PBX server registration. Enforce strict DSCP Expedited Forwarding (EF). Deny general data.
VLAN 60: CCTV 10.60.60.0/24 254 10.60.60.1 Maximum Security Permit NVR communication only. Deny Internet access completely to eliminate hacking risks.

ADVANTAGES Measurable Technical Advantages Achieved After Separation

1. Zero-Trust Security & Malware Containment

Broadcast domains are strictly confined to individual subnets. If an infected device enters Guest Wi-Fi, lateral malware spread across the enterprise is stopped dead at switch hardware ASICs.

2. CCTV Total Isolation (0% Internet Exposure)

By enforcing an explicit deny internet firewall policy on VLAN 60, IP cameras and the NVR are completely isolated from the outside world. Cameras cannot leak video or be recruited into botnets.

3. Deterministic Voice QoS (Zero Dropped Calls)

Voice traffic on VLAN 50 receives DSCP Expedited Forwarding (EF) with strict priority queueing. Phone conversations between all desk extensions and reception remain crystal-clear even during peak link utilization.

4. Elimination of Daisy-Chain Choke Points

Replaced serial 100M daisy-chained PoE switches with dedicated Gigabit star downlinks from the Managed Core Switch. Eliminates bottlenecks and provides full line-rate throughput for all cameras.

5. High-Speed L2-Isolated Guest Wi-Fi

Guest users on VLAN 40 receive isolated internet connectivity with Layer 2 Client Isolation enabled. Visitors cannot browse local network shares or communicate with other connected devices.

6. Structured Network Points Standard

Dedicated Cat6 terminations for PC data and IP telephony provide organized cable distribution with easy maintenance and clean port auditing.

⚡ Create Custom Project ↑
UNIVERSAL ARCHITECT LIVE SIMULATION
2026 STUDIO

Universal Project Architect & Live CLI Simulator

Interactive multi-vendor design studio. Build custom configurations across Cisco IOS-XE, Juniper Junos OS, MikroTik RouterOS v7, Linux Server, Docker Cloud-Native, or Python Automation. Choose your topology, security policies, redundancy modes, and addressing schemes with instant syntax generation and in-page live CLI simulation.

Cisco IOS Juniper Junos MikroTik RouterOS Linux Gateway Docker Compose Python Netmiko Live CLI
NETWORKING 2025

Enterprise Multi-Area OSPF Simulation

Constructed a multi-area OSPF topology in Cisco Packet Tracer with dual Area Border Routers (ABRs), inter-VLAN trunking, and ACL packet filters.

OSPFv2 Cisco CLI VLAN Trunking ACLs
SYSTEMS 2025

Hardened Nginx Gateway & Anycast DNS

Architected a secure Linux web gateway featuring HTTP/2, custom security headers, TLS certificate automation, and ClouDNS Anycast integration.

Nginx Ubuntu ClouDNS TLS 1.3
CLOUD & CONTAINERS 2026

Isolated Microservice Docker Topologies

Configured isolated container environments with custom Dockerfiles, bridge networks, and persistent host volumes for reliable application isolation.

Docker Bridge Networks Volumes
AUTOMATION 2026

Automated DNS & Health Probe Pipeline

Bash-driven health probe mechanism that verifies nameserver resolution latencies, SSL expiry thresholds, and server status codes on automated schedules.

Bash Cron cURL DNS Audit
WEB & CLOUD 2026

Serverless Digital Platform on Edge CDN

Constructed this very multi-page static web architecture using zero external CSS/JS dependencies, complete responsive accessibility, and custom domain SSL.

HTML5 CSS3 GitHub Pages Custom Domain
NETWORKING 2025

Hierarchical IPv4/IPv6 VLSM Engine

Architectural blueprint for allocating IP space across primary headquarters and remote regional branches while conserving address blocks.

VLSM IPv4 / IPv6 CIDR IPAM
Lab Details GitHub
NETWORKING 2026

Enterprise Campus LAN: HSRP Redundancy & LACP

Constructed a high-availability dual-core campus network. Configured HSRPv2 with interface tracking for sub-second gateway failover, bundled multi-link trunks with LACP, and tuned Rapid-PVST+ root bridges.

Cisco IOS HSRPv2 LACP (802.3ad) Rapid-PVST+ SVIs BPDU Guard
NETWORKING 2026

Route-Based IPsec VTI VPN with Dynamic BGP

Architected an encrypted WAN tunnel between HQ and Branch. Configured route-based IPsec Virtual Tunnel Interfaces with hardened IKEv2 (AES-GCM-256), dynamic eBGP peering for automated route redistribution, and TCP MSS clamping.

Cisco IOS IPsec VTI IKEv2 eBGP Crypto Policy MSS Clamping
CARRIER & FTTH 2026

Carrier GPON/EPON OLT Deployment & FTTH Provisioning

Configured and deployed production Huawei SmartAX MA5608T & ZTE C320 OLT chassis. Defined Type 1–5 Dynamic Bandwidth Allocation (DBA) profiles, mapped GEM ports to T-CONTs, implemented Service VLAN tagging (SVLAN 802.1ad QinQ), and automated ONT auto-discovery and optical link budget verification (-8 to -27 dBm).

Huawei MA5608T ZTE C320 GPON / EPON DBA Profiles T-CONT / GEM QinQ (802.1ad) ONT Provisioning
METRO SWITCHING 2026

Metro Ethernet L2/L3 Switching Fabric (Cisco & Juniper EX)

Engineered high-density aggregation and distribution switching topology using Cisco Catalyst 3850/9300 and Juniper EX3400/4300. Deployed Multiple Spanning Tree (MSTP IEEE 802.1s), multi-chassis LACP (802.3ad) port-channels, DHCP Snooping with Option 82 circuit insertion, Dynamic ARP Inspection (DAI), and storm control thresholds.

Cisco Catalyst Juniper EX MSTP (802.1s) LACP Port-Channel DHCP Snooping Option 82 DAI & Storm Control
JUNIPER CORE 2026

Juniper Junos Multi-Homed BGP Edge & RE Protection Filters

Architected Internet border peering on Juniper MX204 / SRX345 running Junos OS. Configured dual-upstream eBGP with BGP community tagging for traffic engineering (Local-Pref & AS-Path prepending), graceful restart, route dampening, and hardened stateless loopback firewall filters (lo0.0) protecting the Routing Engine against control-plane DDoS.

Juniper Junos MX204 / SRX345 eBGP Transit BGP Communities Routing Policies RE Filter (lo0.0) Commit Confirmed
FIREWALL & CGNAT 2026

Next-Gen Firewall (Fortinet FortiGate & pfSense HA) with CGNAT

Constructed carrier perimeter security and large-scale translation gateway using Fortinet FortiGate-100F and pfSense Plus HA. Deployed Zone-Based firewalls, Deterministic Carrier-Grade NAT (RFC 6598 100.64.0.0/10) with 2,000-port blocks per subscriber, active-passive CARP state sync, and hardware-accelerated IPsec IKEv2 site-to-site VPN tunnels.

Fortinet FortiGate pfSense HA CGNAT (RFC 6598) CARP Failover IPsec IKEv2 Zone Security QoS Traffic Shaping
SD-WAN & MULTI-BRANCH 2026

Enterprise Multi-Site SD-WAN (Corporate, Municipalities & Schools)

Architected and deployed an enterprise-wide SD-WAN hub-and-spoke overlay interconnecting corporate headquarters, school branches, and municipal government ward offices. Configured active-active dual-ISP uplinks with continuous SLA health probes (packet loss, jitter, latency), automated sub-second IPsec failover, and quality-of-service (QoS) traffic prioritization for VoIP, ERP, and e-Governance transactions.

Fortinet Secure SD-WAN IPsec IKEv2 Overlay Dynamic SLA Probing Corporate Headquarters Municipal Ward Interconnect Schools & Campuses BGP Overlay QoS Traffic Steering
CAMPUS & MUNICIPAL ISOLATION 2026

Campus LAN Micro-Segmentation & Network Isolation

Engineered zero-trust internal network segregation across multi-floor corporate business houses, schools/colleges, and municipal administrative buildings. Deployed VRF-Lite routing boundaries, Private VLANs (community and isolated ports) to eliminate lateral malware spread in student/employee labs, 802.1X NAC, isolated captive-portal guest Wi-Fi, and quarantined CCTV surveillance zones with stateful inter-VLAN firewall inspection.

VRF-Lite Private VLANs (PVLAN) 802.1X NAC Cisco Catalyst Juniper EX Schools & Universities Corporate Security CCTV Enclave Zero-Trust Inter-VLAN
NETWORKING 2026

MikroTik Dual-WAN PCC Balancing & PCQ QoS

Engineered an edge gateway running MikroTik RouterOS with redundant ISPs. Implemented Per-Connection Classifier (PCC) load balancing, multi-hop recursive public DNS ping failover, and Per-Connection Queue (PCQ) bandwidth shaping.

RouterOS Dual-WAN PCC Recursive Failover PCQ QoS Mangle Winbox
SOFTWARE & MOBILE PLATFORMS RELOCATED

Looking for GAM.AI, GAMA, or Native Mobile Applications?

All active software engineering applications, including GAM.AI Edge Intelligence (v1.6.3), GAMA Cybernetic Audio (v2.3.1), and IELTS by GAMA (v1.5.3) with their complete release archive histories and download binaries have been consolidated into our dedicated Developments Hub.

Go to Developments Hub →