74 lines
2 KiB
Markdown
74 lines
2 KiB
Markdown
# VLAN 20 — Trusted Devices
|
||
Subnet: **192.168.120.0/24**
|
||
|
||
Last Updated: 2026-05-21
|
||
|
||
---
|
||
|
||
## 🧩 What This Network Is
|
||
VLAN 20 is the **primary trusted user network** for day‑to‑day administrative and productivity devices.
|
||
It is designed for laptops, desktops, phones, and tablets used by authorized users who require reliable access to internal systems.
|
||
|
||
This VLAN provides a **secure but flexible environment**, allowing trusted devices to access internal services while remaining isolated from lower‑trust networks such as IoT, Guest, and Lab.
|
||
|
||
It is the main operational network for users who need consistent access to internal tools, servers, and management interfaces.
|
||
|
||
---
|
||
|
||
## 📡 Access Types
|
||
- LAN / Cable
|
||
- WiFi
|
||
|
||
---
|
||
|
||
## 🌐 Subnet
|
||
- **192.168.120.0/24**
|
||
|
||
---
|
||
|
||
## 🖥️ Expected Devices
|
||
- Linux desktops
|
||
- Trusted laptops
|
||
- Mobile devices
|
||
- Administrative systems
|
||
|
||
---
|
||
|
||
## 🔒 Security Rules for VLAN 20
|
||
|
||
### **Outbound (VLAN 20 → Others)**
|
||
- VLAN 20 can initiate connections to **all internal VLANs except itself**:
|
||
- VLAN 1 — Infrastructure
|
||
- VLAN 10 — Management
|
||
- VLAN 30 — IoT
|
||
- VLAN 40 — Guest
|
||
- VLAN 50 — Lab
|
||
|
||
### **Inbound (Others → VLAN 20)**
|
||
- **Blocked:**
|
||
- VLAN 30 (IoT) → VLAN 20
|
||
- VLAN 50 (Lab/Servers) → VLAN 20
|
||
- **Allowed:**
|
||
- VLAN 1 (Infrastructure) → VLAN 20
|
||
- **Undefined (depends on default policy):**
|
||
- VLAN 40 (Guest) → VLAN 20
|
||
|
||
### **Net Effect**
|
||
- Trusted devices can reach every other VLAN.
|
||
- IoT and Lab cannot initiate into VLAN 20.
|
||
- Management (VLAN 1) can reach VLAN 20.
|
||
- Guest access depends on global default rules.
|
||
|
||
---
|
||
|
||
## 🧠 Summary for AI Systems
|
||
- VLAN 20 = **high‑trust user network** with broad outbound access.
|
||
- Can initiate connections to all other VLANs.
|
||
- Blocked from IoT and Lab inbound.
|
||
- Reachable from VLAN 1; Guest behavior depends on default policy.
|
||
- Acts as a **trusted control network** with strong protection from lower‑trust zones.
|
||
|
||
---
|
||
|
||
# ✔️ End of File
|
||
|