# Network Fundamentals

## The Three Core Devices

### Router

A router moves packets between *different* networks. Your home has one network. The internet is another. The router sits at the boundary and decides where traffic goes.

- It has a public IP (from your ISP) and a private IP (your LAN side)
- It runs NAT (Network Address Translation) so all your devices share one public IP
- It makes routing decisions: "this packet is for 10.0.0.x, keep it local" vs "this packet is for 8.8.8.8, send it out the WAN"
- Consumer "routers" are actually router + switch + AP + firewall in one box, which is why the terms get confusing

In your build, the Cisco ISR or the ASA handles this role.

### Firewall

A firewall controls *what* traffic is allowed to pass. It sits inline (between your network and the internet) and inspects every packet against a ruleset.

- Stateful inspection: tracks connections. If you opened a connection to google.com, it allows the response back in. If something from outside tries to initiate a connection to you, it gets dropped.
- Rules are ordered: first match wins. You define what's allowed, everything else is denied (default deny).
- Modern firewalls (like the ASA with FirePOWER) also do deep packet inspection (DPI), which means they look inside the packet payload, not just the headers. This is how IDS/IPS works -- it can detect malware signatures, exploit attempts, C2 traffic.
- A firewall without IPS is a locked door. A firewall with IPS is a locked door with a guard who checks bags.

The Cisco ASA 5506/5508-X is your firewall. It also does routing, so in a home/small setup it fills both roles.

### Switch

A switch moves frames between devices on the *same* network. It operates at Layer 2 (MAC addresses).

- Every device on your LAN plugs into the switch (or connects to an AP that plugs into the switch)
- It learns which MAC address is on which port and only sends traffic where it needs to go (unlike a hub, which blasts everything everywhere)
- A *managed* switch lets you create VLANs, which is the key to network segmentation

The Cisco SG350 or WS-2960X is your switch.

## VLANs

A VLAN (Virtual LAN) splits one physical switch into multiple logical networks. Devices on VLAN 1 cannot talk to devices on VLAN 20 unless the firewall explicitly allows it.

This is why VLANs matter for security:

- Your trusted machines (VLAN 1) can reach everything
- Family devices (VLAN 20) can reach the internet but not your servers
- IoT garbage (VLAN 30) is completely isolated -- a compromised smart TV can't pivot to your network

VLANs travel between devices over *trunk ports*, which carry tagged traffic (each frame is stamped with its VLAN ID). *Access ports* are untagged and belong to a single VLAN -- this is what end devices plug into.

## Access Point (AP)

A wireless access point is just a switch port that happens to be wireless. Enterprise APs support multiple SSIDs, each mapped to a different VLAN. One radio broadcasts three networks:

- `YOTAM` on VLAN 1 (trusted)
- `YOTAM-family` on VLAN 20 (filtered)
- `YOTAM-iot` on VLAN 30 (isolated)

The AP itself plugs into a trunk port on the switch. It tags the wireless traffic with the right VLAN ID before it hits the wire.

Consumer APs have no concept of VLANs. Enterprise APs (Cisco Aironet, Ruckus, Ubiquiti) do.

## How They Work Together

```
INTERNET
    |
    v
[MODEM] (bridge mode -- just converts ISP signal to ethernet)
    |
    v
[FIREWALL/ROUTER]  (ASA 5506-X)
    |  - NAT: translates private IPs to public
    |  - Firewall rules: blocks unauthorized inbound
    |  - IPS (FirePOWER): inspects traffic for threats
    |  - DHCP: assigns IPs to each VLAN
    |  - Routes between VLANs (inter-VLAN routing)
    |
    v  (trunk link carrying all VLANs)
[MANAGED SWITCH]  (SG350 / 2960X)
    |  - Splits trunk into access ports per VLAN
    |  - Port 1-3: VLAN 1 (your wired devices)
    |  - Port 4: trunk to AP
    |  - Port 5-6: VLAN 20 (family wired, if any)
    |  - Port 7: VLAN 30 (IoT wired, if any)
    |  - Port 8: mirror port (optional, for IDS tap)
    |
    v  (trunk link)
[ACCESS POINT]  (Aironet 2802i)
    |  - SSID "YOTAM"        -> VLAN 1
    |  - SSID "YOTAM-family" -> VLAN 20
    |  - SSID "YOTAM-iot"    -> VLAN 30
    |
    v
[DEVICES]
    - Your laptop, desktop, STARGATE  -> VLAN 1
    - Family phones, tablets           -> VLAN 20
    - Smart TV, Alexa, whatever        -> VLAN 30
```

## The Packet's Journey

When your mom opens Instagram on VLAN 20:

1. Her phone sends a DNS query to AdGuard Home (which you set as the DHCP-assigned DNS for VLAN 20)
2. AdGuard filters it -- if it's an ad/tracker domain, it returns 0.0.0.0 and the request dies here
3. If allowed, the DNS response comes back with Instagram's IP
4. Her phone sends a TCP SYN to that IP. The packet is tagged VLAN 20 by the AP
5. The switch forwards the tagged frame up the trunk to the firewall
6. The firewall checks: "VLAN 20 to internet? Allowed." It NATs the source IP and sends it out the WAN
7. FirePOWER inspects the packet payload for anything malicious
8. Instagram responds. The firewall's state table matches it to the existing connection, allows it back
9. The packet comes back down the trunk, switch sends it to the AP, AP sends it to her phone

If her phone tries to reach 10.0.0.142 (STARGATE), step 6 changes: "VLAN 20 to VLAN 1? Denied." Packet dropped.

## IDS vs IPS

- **IDS** (Intrusion Detection System): watches traffic passively, alerts you when it sees something bad. A security camera.
- **IPS** (Intrusion Prevention System): sits inline and actively blocks bad traffic. A bouncer.

FirePOWER on the ASA runs in IPS mode by default. It uses Snort rules (maintained by Cisco Talos) to detect exploit attempts, malware downloads, C2 beacons, port scans, and more. When it sees a match, it drops the packet before it reaches your network.

## DNS Filtering (AdGuard Home)

You already run this on STARGATE. It is the first line of defense and catches the most common threats:

- Malware domains
- Phishing domains
- Ad networks (which are a common malware vector)
- Tracking domains
- Cryptomining scripts

Set AdGuard as the DNS server for all VLANs via DHCP on the firewall. On VLAN 30 (IoT), also add a firewall rule that blocks all DNS except to AdGuard -- many IoT devices hardcode 8.8.8.8 to bypass local DNS.

## Firewall Rule Philosophy

Default deny. You write rules for what you *allow*, everything else is dropped.

```
VLAN 1 (trusted)  -> ANY           : ALLOW
VLAN 20 (family)  -> INTERNET      : ALLOW
VLAN 20 (family)  -> VLAN 1        : DENY
VLAN 20 (family)  -> VLAN 30       : DENY
VLAN 30 (iot)     -> INTERNET:443  : ALLOW (HTTPS only)
VLAN 30 (iot)     -> INTERNET:53   : DENY  (force local DNS)
VLAN 30 (iot)     -> ANY LAN       : DENY
ANY               -> ANY           : DENY  (implicit)
```

## Summary

| Device | Layer | Job | Security role |
|--------|-------|-----|---------------|
| Modem | L1 | Signal conversion | None (bridge mode) |
| Firewall | L3-L7 | Traffic filtering, NAT, routing | Perimeter defense, IPS |
| Switch | L2 | Frame forwarding, VLANs | Network segmentation |
| AP | L1-L2 | Wireless to wired bridge | VLAN assignment per SSID |
| DNS filter | L7 | Domain resolution | Block malicious/ad domains |

The firewall is your perimeter. VLANs are your interior walls. DNS filtering is your front desk. IPS is your guard. Everything else is just making sure these four things work together correctly.