#Purchase Order

Priority order. Each phase is usable on its own -- you don't need everything to start being more secure.

#Phase 1: Perimeter ($40-80)

Buy: Cisco ASA 5506-X

This is the single highest-impact purchase. Right now your ISP router is your only defense and it's garbage. The ASA replaces it as your gateway and gives you:

• Stateful firewall (default deny)
• NAT
• FirePOWER IPS (Snort + Talos rules)
• VPN termination
• Basic routing

You can run your entire network through the ASA alone using its built-in 8-port switch. No managed switch needed yet. Plug STARGATE, moirai, and your current AP directly into the ASA's LAN ports.

Even without VLANs, you immediately get a real firewall + IPS between you and the internet.

Search: "Cisco ASA 5506-X" on eBay, $40-80. Get one with FirePOWER license if possible (most have it). Comes with power supply. That's all you need.

Time to deploy: one afternoon.

#Phase 2: Segmentation ($30-50)

Buy: Cisco SG350-10 or WS-C2960X-24PS-L

Now you add VLANs. This is what isolates family and IoT devices from your trusted network.

• SG350-10: $30-40, 10 ports, web GUI + CLI, easy VLAN config
• WS-C2960X-24PS-L: $40-60, 24 ports, PoE (powers the AP later), full IOS

Plug it into the ASA's trunk port. Configure VLANs 1/20/30. Move your wired devices to the right access ports.

At this point family devices are still on your current AP with no segmentation -- but your wired infrastructure is segmented.

Time to deploy: one evening.

#Phase 3: Wireless Segmentation ($25-50)

Buy: Cisco Aironet 2802i or 3802i

This completes the build. The Aironet replaces your consumer AP and broadcasts separate SSIDs per VLAN.

• Flash to Mobility Express firmware (standalone, no WLC needed)
• Configure three SSIDs mapped to three VLANs
• Plug into a trunk port on the switch

Now everything is segmented -- wired and wireless. Family gets internet-only access, IoT is fully jailed.

If your switch has PoE (2960X), the AP powers over ethernet. If not, grab a Cisco AIR-PWRINJ6 PoE injector for ~$10.

Time to deploy: one evening (firmware flash takes the longest).

#Phase 4: Stretch (when budget allows)

#Summary

Phase 1:  $40-80    ASA firewall      = real perimeter defense TODAY
Phase 2:  $30-50    managed switch    = network segmentation
Phase 3:  $25-50    enterprise AP     = wireless segmentation
Phase 4:  $40-180   hardening extras  = monitoring, redundancy
--------------------------------------------------------------
Total:    $135-360

Phase 1 alone puts you miles ahead of where you are now. Do that first, even if you can't buy anything else for a month.