1. Project Objective

Design and implement a secure Next-Generation Firewall solution with advanced features for an enterprise network that includes:

• Multi-branch connectivity via MPLS & SD-WAN.
• Centralized authentication & identity management.
• Secure segmentation of users, guests, and servers.
• High availability for business continuity.
• Advanced threat detection and prevention.

2. Network Topology Overview

The network consists of:

• Headquarters (HQ): Core firewalls (HA pair), LAN users, and guest access.
• Branch Offices (Spoke-1 & Spoke-2): Connected via AD-VPN SD-WAN and MPLS IPSec tunnels.
• DMZ Zone: Servers hosting Web, RDP, Active Directory (LDAP/FSSO), and RADIUS.
• Guest Network: Captive Portal-based Wi-Fi for visitors.
• WAN Zone: Internet access for remote connectivity and threat intelligence updates.

3. Zone Design

• LAN Zone: Internal users with access to corporate resources.
• Guest Zone: Restricted Internet-only access via Captive Portal.
• DMZ Zone: Hosting enterprise services securely (LDAP, RDP, Web Server, Radius).
• VPN Zone: Secure site-to-site and remote tunnels.