Skip to main content

Network Architecture

Source: Marc Mercer (SRE Lead) — sre-iac repository + Bryan Lee (Engineering Director), Rev 2.0, 2026-03-22

For full VLAN/IP detail see VLAN & IP Allocation. For device-level port cabling see Port Mappings.

Current Reality [ACTIVE — 2026-03-22]​

This section describes what is actually running today — not the designed target state.

The network is currently a flat, unmanaged Layer 2 domain. No VLANs, no segmentation, no firewall. The design described in the rest of this document is the target state being worked toward.

CURRENT STATE — Flat /20, No VLANs

    Internet (ISP — Clackamas County, OR)
          |  65.182.226.97 (uplink)
    [Cisco Router — 10.10.96.1]
       |                    |
       |                    | 192.168.125.1 (bridged — NO firewall)
  10.10.96.0/20 (flat)   [Homestead — 192.168.125.0/24]
       |
  3× Juniper EX2200 (operating as unmanaged L2 switches, no VLANs)
       |
  All devices on flat 10.10.96.0/20:
    pmx-01 (10.10.96.5), dc-01 (10.10.96.11), dc-02 (10.10.96.12)
    rp-01 (10.10.96.22), gitlab-01 (10.10.96.41), qnap-01 (10.10.96.31)
    K8s nodes (10.10.97.x and 10.10.98.x), MetalLB VIP (10.10.98.40)
    iLO ports (10.10.96.235, 10.10.96.236, 10.10.96.237)
ItemCurrent RealityRisk
SegmentationNone — flat /20All devices reachable from all other devices
Homestead isolationNone — Cisco bridges lab and homeHome network has full access to lab infrastructure
Storage isolationNone — Ceph ports (when deployed) would be on flat networkN/A until Ceph deployed
OOB isolationNone — iLO ports on same flat segmentiLO accessible from any device on the /20
FirewallCisco router provides internet NAT only — no zone-based policyNo intra-lab firewall
VLANsNone configured—

Immediate priority: Deploy the Juniper SRX320 (config ready at sre-iac/network/interim/srx320-01.conf) to replace the Cisco bridge. This establishes the homestead firewall boundary and enables VLAN segmentation on the EX2200 switches.

Design Principles​

The network architecture follows six governing rules that apply to both the interim (Juniper) and target (Omada) hardware phases. VLAN IDs and IP allocations are identical across both phases — only the underlying physical equipment changes.

  1. VLAN ID equals second octet — VLAN 200 maps to 10.20.0.0/16, VLAN 300 maps to 10.30.0.0/16, and so on. This convention eliminates guesswork when troubleshooting.
  2. Each functional network owns a /16 — Day-1 deployment uses a /24 within each /16. Expansion never requires renumbering.
  3. Spaced VLAN numbering — IDs at 100-unit intervals (100, 200, 300, 400, 500, 600) leave room for sub-VLANs within each functional range.
  4. Three physical switch planes — Network, Storage, and OOB. Each carries only the VLANs relevant to its function.
  5. Storage is never routed — VLANs 300 and 400 have no path to any router or the internet. They exist only on the isolated storage switch.
  6. Management is never routed — VLAN 100 has no path to any router or the internet. It is reachable only from the physical workstation via a tagged VLAN interface.

VLAN Allocation Summary​

VLANPurposeAllocated RangeDay-1 SubnetSwitch PlaneRouted via Edge?
100Management / OOB192.168.168.0/23192.168.168.0/24 + 192.168.169.0/24OOBNo — completely isolated
200OpenStack Control Plane10.20.0.0/1610.20.0.0/24NetworkInternal only (TRUST zone)
300Ceph Public10.30.0.0/1610.30.0.0/24StorageNo — isolated storage fabric
400Ceph Cluster10.40.0.0/1610.40.0.0/24StorageNo — isolated storage fabric
500Provider Network10.50.0.0/1610.50.0.0/24NetworkYes — VM external connectivity
600DMZ10.60.0.0/1610.60.0.0/24NetworkYes — controlled (DMZ zone)
610DMZ HA Sync10.61.0.0/1610.61.0.0/29NetworkNo — point-to-point only
1000-1099Tenant Networks10.100.0.0/16/20 blocks (Neutron managed)NetworkVia Neutron virtual router
—Homestead (Lee)192.168.125.0/24192.168.125.0/24Dedicated portInternet only (HOMESTEAD zone)

Security Zones​

The edge firewall enforces zone-based security policy:

ZoneVLANsPolicy
UNTRUSTWAN /32Inbound: only to DMZ (TCP 80/443). Outbound: SNAT for all zones.
DMZ600Inbound from UNTRUST (HTTP/S only). Outbound to TRUST (proxied to VLAN 500). No access to storage, management, or tenant networks.
TRUST200, 500, 1000-1099Outbound to internet via SNAT. Inbound from DMZ (proxied). Inter-VLAN routing between 200/500/1000+ as needed.
HOMESTEAD192.168.125.0/24Internet only. No routing to TRUST, DMZ, or any other zone.
MGMT100Management traffic only. No routing to TRUST, DMZ, HOMESTEAD, or internet.
STORAGE300, 400Not on the edge firewall at all. Completely isolated on the storage switch.

Physical Topology — Interim (Juniper) [PENDING DEPLOYMENT]​

Same hardware as current state, but with SRX320 deployed and EX2200 switches VLAN-configured. This is the next step — configs are ready to deploy in sre-iac/network/interim/.

DeviceHostnameModelRole
Edge Firewallsrx320-01Juniper SRX320WAN, inter-VLAN routing, security zones
Network Switchex2200t-01Juniper EX2200-24TNetwork plane (VLANs 200, 500, 600, 610, 1000+)
Storage Switchex2200t-02Juniper EX2200-24TStorage plane (VLANs 300, 400) — no router uplink
OOB Switchex2200p-01Juniper EX2200-24PManagement plane (VLAN 100) — isolated
                         WAN (ISP/FTTH)
                              |
                        [srx320-01]
                         /    |    \
                        /     |     \
              HOMESTEAD    LACP ae0   irb.100
              (ge-0/0/5)     |         |
                        [ex2200t-01]---[ex2200p-01]
                         (Network)    (OOB Mgmt)
                              |             |
                              |        iLO x4, UPS x4
                              |
                        [ex2200t-02]
                         (Storage)
                         (isolated)

All four servers connect to both the network switch (bond-net: eno1+eno2) and storage switch (bond-stor: eno3+eno4) via LACP bonds.

Physical Topology — Target (OPNsense HA Edge + Omada Switches + Juniper OOB)​

No TP-Link ER Router in this design

OPNsense on 2× Beelink EQ12 Pro replaces the TP-Link ER router entirely. OPNsense provides WAN, firewall, IDS/IPS, VPN, CARP HA, and inter-VLAN routing — all free, no licenses. Omada SDN manages only the switch fabric. See Network Edge Security for full detail.

DeviceHostnameModelRole
Firewall Primaryopnsense-01Beelink EQ12 Pro + OPNsense CEWAN edge, IDS/IPS, VPN, CARP primary, HAProxy
Firewall Standbyopnsense-02Beelink EQ12 Pro + OPNsense CECARP standby — auto-failover in <2 seconds
10G Network Switchsx3008-01TP-Link TL-SX3008FNetwork plane (10G SFP+ server uplinks + OPNsense LAN)
10G Storage Switchsx3008-02TP-Link TL-SX3008FStorage plane (10G SFP+) — no WAN/router uplink, isolated
1G Network Switchsg3428-01TP-Link TL-SG3428Network plane 1G access (VMs, workstations)
1G Storage Switchsg3428-02TP-Link TL-SG3428Storage plane 1G fallback — isolated
OOB Switchex2200p-01Juniper EX2200-24PManagement plane (VLAN 100) — repurposed from interim
Homestead Switchsg3452-01TP-Link TL-SG3452Residential network (isolated from lab)
SDN Controlleroc200-01TP-Link OC200Omada SDN controller — manages all TP-Link switches
  Fiber WAN A          Fiber WAN B
       │                    │
       └──────────┬──────────┘
                  │
    ┌─────────────▼─────────────┐
    │  opnsense-01  (PRIMARY)   │ BeeLink EQ12 Pro #1
    │  CARP MASTER              │ 10.10.96.51
    └──────────────┬────────────┘
                   │ CARP sync link (direct Cat6)
    ┌──────────────▼────────────┐
    │  opnsense-02  (STANDBY)   │ BeeLink EQ12 Pro #2
    │  CARP BACKUP              │ 10.10.96.52
    └──────────────┬────────────┘
                   │ CARP VIP: 10.10.96.1 (gateway for all VLANs)
                   │
        ┌──────────▼──────────────────────────┐
        │         sx3008-01 (Network 10G)     │
        │         + sg3428-01 (Network 1G)    │
        └──────────┬──────────────────────────┘
                   │ (isolated — no WAN path)
        ┌──────────▼──────────────────────────┐
        │         sx3008-02 (Storage 10G)     │
        │         + sg3428-02 (Storage 1G)    │
        └──────────────────────────────────────┘

        All servers: 2× 10G SFP+ (bond-net → sx3008-01, bond-stor → sx3008-02)
        OOB: ex2200p-01 (VLAN 100, iLO × 4, UPS × 4)
        Homestead: sg3452-01 (isolated VLAN, no lab access)

In the target configuration, each server has dual paths per plane:

  • Network: 10G SFP+ to sx3008-01 + 2× 1G LACP to sg3428-01
  • Storage: 10G SFP+ to sx3008-02 + 2× 1G LACP to sg3428-02

Server NIC Allocation​

Servers 1-3 (m35g9-stk01 / stk02 / stk03) — OpenStack + Ceph​

NICBondDestinationVLANsPurpose
eno1bond-netNetwork switch200, 500, 600, 610, 1000-1099Control plane, provider, DMZ, tenant
eno2bond-netNetwork switch(same)LACP pair with eno1
eno3bond-storStorage switch300, 400Ceph public + cluster
eno4bond-storStorage switch(same)LACP pair with eno3
iLO—OOB switch100Out-of-band management

Server 4 (m35g9-pmx01) — GPU / Proxmox​

NICBondDestinationVLANsPurpose
eno1bond-netNetwork switch200, 500, 600, 610, 1000-1099Control plane, provider, DMZ, tenant
eno2bond-netNetwork switch(same)LACP pair with eno1
eno3bond-storStorage switch300, 400Ceph client access (no local OSDs)
eno4bond-storStorage switch(same)LACP pair with eno3
iLO—OOB switch100Out-of-band management

DMZ Architecture​

OPNsense HA Pair​

The DMZ is fronted by an OPNsense high-availability pair providing reverse proxy, load balancing, SSL termination, WAF, and rate limiting. HA mechanism: CARP for virtual IP failover, pfsync for firewall state synchronization.

Interim: OPNsense runs as a VM pair on the OpenStack cluster with two interfaces each (VLAN 600 DMZ-facing, VLAN 500 provider-facing). CARP/pfsync traffic on VLAN 610.

Target: OPNsense runs on 2× Beelink SER7 bare-metal appliances, direct-attach 2.5G to ER7412-M2. Cross-connected SER7-to-SER7 for HA sync. No switch in the DMZ path.

Inbound Traffic Flow​

Internet → WAN → Edge Router (IDS/IDP) → DMZ (VLAN 600)
  → OPNsense HA (SSL termination, WAF, rate limit)
  → Provider Network (VLAN 500) → Backend VMs

Homestead Isolation​

Bryan's residential network (192.168.125.0/24) is physically and logically separate from all Anshin infrastructure:

  • Dedicated physical port on the edge firewall — not trunked with any infrastructure VLAN
  • HOMESTEAD zone — internet access only, no routing to TRUST, DMZ, MGMT, or STORAGE
  • Access to Anshin services via WireGuard tunnel only (keypair authenticated, per-device)
  • Management VLAN (100) not exposed over WireGuard — requires physical workstation

Addressing Quick Reference​

VLANNetworkGatewayUsable Range (day-1 /24)
100192.168.168.0/23— (no gateway).1-.254 per /24
20010.20.0.0/2410.20.0.110.20.0.2-10.20.0.254
30010.30.0.0/24— (no gateway)10.30.0.1-10.30.0.254
40010.40.0.0/24— (no gateway)10.40.0.1-10.40.0.254
50010.50.0.0/2410.50.0.110.50.0.2-10.50.0.254
60010.60.0.0/2410.60.0.110.60.0.2-10.60.0.254
61010.61.0.0/29— (no gateway)10.61.0.1-10.61.0.6
1000+10.100.0.0/16per-subnetNeutron managed
—192.168.125.0/24192.168.125.1Homestead DHCP

Gateways exist only on routed VLANs (200, 500, 600, Homestead). Storage and management VLANs have no gateway — they are isolated L2 domains.

Document Control​

RevDateAuthorDescription
1.02026-02-24Marc MercerInitial release