# Purchase Order

Priority order. Each phase is usable on its own -- you don't need everything to start being more secure.

## Phase 1: Perimeter ($40-80)

**Buy: Cisco ASA 5506-X**

This is the single highest-impact purchase. Right now your ISP router is your only defense and it's garbage. The ASA replaces it as your gateway and gives you:

- Stateful firewall (default deny)
- NAT
- FirePOWER IPS (Snort + Talos rules)
- VPN termination
- Basic routing

You can run your entire network through the ASA alone using its built-in 8-port switch. No managed switch needed yet. Plug STARGATE, moirai, and your current AP directly into the ASA's LAN ports.

Even without VLANs, you immediately get a real firewall + IPS between you and the internet.

Search: "Cisco ASA 5506-X" on eBay, $40-80. Get one with FirePOWER license if possible (most have it). Comes with power supply. That's all you need.

**Time to deploy: one afternoon.**

## Phase 2: Segmentation ($30-50)

**Buy: Cisco SG350-10 or WS-C2960X-24PS-L**

Now you add VLANs. This is what isolates family and IoT devices from your trusted network.

- SG350-10: $30-40, 10 ports, web GUI + CLI, easy VLAN config
- WS-C2960X-24PS-L: $40-60, 24 ports, PoE (powers the AP later), full IOS

Plug it into the ASA's trunk port. Configure VLANs 1/20/30. Move your wired devices to the right access ports.

At this point family devices are still on your current AP with no segmentation -- but your wired infrastructure is segmented.

**Time to deploy: one evening.**

## Phase 3: Wireless Segmentation ($25-50)

**Buy: Cisco Aironet 2802i or 3802i**

This completes the build. The Aironet replaces your consumer AP and broadcasts separate SSIDs per VLAN.

- Flash to Mobility Express firmware (standalone, no WLC needed)
- Configure three SSIDs mapped to three VLANs
- Plug into a trunk port on the switch

Now everything is segmented -- wired and wireless. Family gets internet-only access, IoT is fully jailed.

If your switch has PoE (2960X), the AP powers over ethernet. If not, grab a Cisco AIR-PWRINJ6 PoE injector for ~$10.

**Time to deploy: one evening (firmware flash takes the longest).**

## Phase 4: Stretch (when budget allows)

| Priority | Item | Why | Price |
|----------|------|-----|-------|
| 1 | Console cable (USB to RJ45) | Configure ASA/switch via CLI | $8 |
| 2 | APC SMT750 UPS (used) | Network stays up during power blips | $40-60 |
| 3 | Second Aironet AP | Coverage for dead zones | $25 |
| 4 | Dualcomm ETAP-2003 tap | Passive traffic mirror to STARGATE for Zeek | $40 |
| 5 | Second OptiPlex Micro | Dedicated IDS sensor (Security Onion) | $50 |

## Summary

```
Phase 1:  $40-80    ASA firewall      = real perimeter defense TODAY
Phase 2:  $30-50    managed switch    = network segmentation
Phase 3:  $25-50    enterprise AP     = wireless segmentation
Phase 4:  $40-180   hardening extras  = monitoring, redundancy
--------------------------------------------------------------
Total:    $135-360
```

Phase 1 alone puts you miles ahead of where you are now. Do that first, even if you can't buy anything else for a month.