A site-to-site VPN, tested offline before it went live
Connected two sites with an IPsec tunnel on a Cisco router, built and tested offline before it went live.
Azure foundations for Dynamics 365 migrations
The Azure infrastructure behind Dynamics 365 migrations at Thinkmax, a fresh foundation built per client.
Dropped calls, found in the firewall logs
The network side of a municipal VoIP rollout: a dedicated voice VLAN, WatchGuard rules, and a fault found in the logs.
Hiding my services behind a port knock planned
How I took RDP and SSH off the internet and hid them behind a knock of invalid TCP flags, and used it as my real remote access.
guide
Phase 3: fix the leaks
guide
Phase 5: traffic shaping
Teaching networking by building it
A three-lab progression I built on my own evenings so students learned networking by building it.
projects
The NetState Lab Network planned
A firewall between a LAN and a DMZ, on one PC. Five phases: see what crosses the wire, a legacy port knock, fix the leaks, modern remote access, traffic shaping.
containers
The NetState Lab Network (Docker Compose) planned
The whole lab in one Compose file: the network (a firewall, two clients and a server) by default, and the AI agents from agent-lab and agent-workflow when you ask for them.
documents
The NetState Lab Network: design and runbook planned
The lab's topology, firewall policy, knock design and how to run every exercise, with the elevated permissions it needs and why.
scripts
The NetState Lab Network: routing check
Five pass/fail checks that prove traffic between the LAN and the DMZ crosses the firewall, and only the firewall.
When an expired certificate took the VPN down
A site-to-site VPN dropped with nothing misconfigured; the certificate behind it had quietly expired.
Working with the site's IT, not passing the puck
When a Xerox fault turns out to be the network, out of scope, I work with the site's IT instead of passing the puck.