System Hub | Secure By Design

Read the network as text

The same air-gapped design as the 3D model: 8 VLANs, 22 systems (one is a pool of 50 Windows PCs; SBD-ROOTCA01 stays offline), 7 traffic processes, and 60 NIST SP 800-53 Revision 5 controls.

Systems 22

SBD-DC01

AD DS + DNS · VLAN 10 · Domain controllers · 10.0.10.10 · Virtual machine on SBD-HV01 · rack R02 · server room

Find services, authenticate identities, and answer directory requests.

DNS TCP / UDP 53
Kerberos KDC TCP / UDP 88 · Password changes use TCP / UDP 464.
Directory access LDAP TCP / UDP 389 · LDAPS TCP 636 · UDP 389 carries the domain controller locator ping. Client and protection settings determine the binding.
Global catalog TCP 3268 · TLS TCP 3269
Group Policy and SYSVOL SMB · TCP 445
RPC services TCP 135 · dynamic TCP 49152–65535 · NetLogon, LSA, and SAM use the dynamic range after the endpoint mapper.
Domain time W32Time · UDP 123 · Members follow the domain time hierarchy.
AD Web Services TCP 9389 · Used by Active Directory PowerShell and Administrative Center from the Tier 0 administration host (rule A01), not user workstations.

AC-2 Account Management
IA-2 Identification and Authentication (Organizational Users)
AC-6 Least Privilege
AU-8 Time Stamps
SC-45 System Time Synchronization

SBD-DC02

AD DS + DNS · VLAN 10 · Domain controllers · 10.0.10.11 · Virtual machine on SBD-HV02 · rack R02 · server room

Provide another AD DS and DNS service point.

DNS TCP / UDP 53
Kerberos KDC TCP / UDP 88 · Password changes use TCP / UDP 464.
Directory access LDAP TCP / UDP 389 · LDAPS TCP 636 · UDP 389 carries the domain controller locator ping. Client and protection settings determine the binding.
Global catalog TCP 3268 · TLS TCP 3269
Group Policy and SYSVOL SMB · TCP 445
RPC services TCP 135 · dynamic TCP 49152–65535 · NetLogon, LSA, and SAM use the dynamic range after the endpoint mapper.
Domain time W32Time · UDP 123 · Members follow the domain time hierarchy.
AD Web Services TCP 9389 · Used by Active Directory PowerShell and Administrative Center from the Tier 0 administration host (rule A01), not user workstations.

AC-2 Account Management
IA-2 Identification and Authentication (Organizational Users)
CP-9 System Backup

SBD-DHCP01

DHCP server + NPS (802.1X) · VLAN 20 · Identity & services · 10.0.20.10 · Virtual machine on SBD-HV04 · rack R03 · server room

Provide client lease settings for the approved address space, and admit devices to VLAN 80 ports with 802.1X.

DHCPv4 UDP 67 server / 68 client · The core relays VLAN 80 broadcasts here (F04); the pool is 10.0.80.100–199.
RADIUS (NPS role) UDP 1812 authentication · 1813 accounting · Only the VLAN 80 access switch is a RADIUS client.
802.1X EAP-TLS Machine certificates · No password-based EAP methods.

CM-6 Configuration Settings
AC-6 Least Privilege
AU-12 Audit Record Generation
IA-3 Device Identification and Authentication

SBD-SYSLOG01

Log message server · VLAN 20 · Identity & services · 10.0.20.20 · Virtual machine on SBD-HV04 · rack R03 · server room

Receive and route the chosen log messages.

Syslog over TLS TCP 6514 · Configure the collector listener and trusted senders.
Router deny log UDP 514 (F24) · The core router reports the traffic it denies; existing network configuration.
Splunk forwarder TCP 9997 with TLS (F10) · Queues events while Splunk is down and replays them afterwards.
Audit archive SMB 3 · TCP 445 with encryption (F11) · Write-only archival account to SBD-AUDIT01.

AU-12 Audit Record Generation
AU-9 Protection of Audit Information
SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection

SBD-WSUS01

Windows update service · VLAN 20 · Identity & services · 10.0.20.30 · Virtual machine on SBD-HV04 · rack R03 · server room

Distribute approved Windows updates inside the air gap.

Update metadata HTTPS 8531
Signed update payloads HTTP 8530 · WSUS uses separate metadata and payload connections.

SI-2 Flaw Remediation
CM-6 Configuration Settings

SBD-SUBCA01

Issuing certificate authority · VLAN 30 · PKI infrastructure · 10.0.30.20 · Virtual machine on SBD-HV03 · rack R02 · server room

Issue certificates under the approved subordinate CA policy.

Certificate enrollment RPC TCP 135 · dynamic TCP 49152–65535 (F23) · Domain members request and autoenroll for the templates their groups are permitted, defined in course 1.6.
CRL / AIA publication Published to pki.sbd.test on SBD-PKI-MGMT01 · HTTP 80 (F18) · The CA writes its CRLs and certificate to the publication site; clients never fetch them from the CA.

SC-12 Cryptographic Key Establishment and Management
SC-17 Public Key Infrastructure Certificates
AC-6 Least Privilege

SBD-PKI-MGMT01

Certificate template administration · VLAN 30 · PKI infrastructure · 10.0.30.30 · Virtual machine on SBD-HV03 · rack R02 · server room

Certificate templates are directory objects. This host provides the administrative tools to manage them.

Certificate template administration Listeners to define

SC-17 Public Key Infrastructure Certificates
IA-5 Authenticator Management
AC-6 Least Privilege

SBD-FS01

File share server · VLAN 40 · Servers & data · 10.0.40.10 · Virtual machine on SBD-HV05 · rack R03 · server room

Serve shared files while enforcing resource permissions.

SMB TCP 445 · Reference service port; share and encryption policies are unspecified.

AC-3 Access Enforcement
AC-6 Least Privilege
SC-28(1) Protection of Information at Rest | Cryptographic Protection

SBD-SQL01

SQL server · VLAN 40 · Servers & data · 10.0.40.20 · Virtual machine on SBD-HV05 · rack R03 · server room

Host the application databases for SBD-APPS01, the only registered SQL consumer.

SQL Database Engine TCP 1433 with TLS · Default instance. Only SBD-APPS01 connects (F22); SBD-WEB01 is denied (F14).

AC-3 Access Enforcement
AC-6 Least Privilege
SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection
SC-28(1) Protection of Information at Rest | Cryptographic Protection

SBD-APPS01

License server + application API · VLAN 40 · Servers & data · 10.0.40.30 · Virtual machine on SBD-HV05 · rack R03 · server room

Answer licensing requests from approved clients and application API calls from SBD-WEB01; the only registered SQL consumer.

License manager Registered vendor port (F12) · Recorded per application in the register.
Application API HTTPS · TCP 443 (F21) · Called by SBD-WEB01 only.
Database client TCP 1433 with TLS to SBD-SQL01 (F22) · The only registered SQL consumer.

AC-3 Access Enforcement
AC-6 Least Privilege
CM-6 Configuration Settings

SBD-WEB01

Internal Apache web server · Linux, domain-joined · VLAN 40 · Servers & data · 10.0.40.40 · Virtual machine on SBD-HV05 · rack R03 · server room

Serve approved internal web applications over HTTPS.

HTTPS TCP 443 · Server certificate issued by the internal issuing CA.
Application API client HTTPS · TCP 443 to SBD-APPS01 (F21) · Its only back-end dependency; it has no database connection.

AC-3 Access Enforcement
CM-6 Configuration Settings
SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection

SBD-SPLUNK01

Splunk SIEM · VLAN 50 · Security & monitoring · 10.0.50.10 · Virtual machine on SBD-HV06 · rack R04 · server room

Linux, domain-joined. Single server instance, sized for a small network; no cluster or standby. Index and investigate the security events that are actually collected.

Splunk ingestion Forwarder · TCP 9997 with TLS (F10) · Forwarded Windows events and router syslog from SBD-SYSLOG01.

AU-6 Audit Record Review, Analysis, and Reporting
SI-4 System Monitoring

SBD-NESSUS01

Tenable / Nessus · VLAN 50 · Security & monitoring · 10.0.50.20 · Virtual machine on SBD-HV06 · rack R04 · server room

Linux, domain-joined. Single Tenable/Nessus server instance, sized for a small network; no cluster or standby. Assess authorized targets for known vulnerabilities.

Credentialed scanning SMB 445 and WMI to Windows · SSH 22 to Linux · Rule F15: scheduled scans of the approved target list; the DC scan credential is Tier 0.

RA-5 Vulnerability Monitoring and Scanning
AC-6 Least Privilege

SBD-EPO01

Trellix ePO + DLP · VLAN 50 · Security & monitoring · 10.0.50.30 · Virtual machine on SBD-HV06 · rack R04 · server room

Single Trellix ePO/DLP server instance, sized for a small network; no cluster or standby. Manage the chosen endpoint protection and DLP policies.

Agent check-ins Agent-server secure port · TCP 443 (F16) · Agents on every Windows system start the connection; with peer-to-peer and RelayServer off, endpoints open no listener for the server.

AC-4 Information Flow Enforcement
SI-3 Malicious Code Protection
SI-4 System Monitoring

SBD-AUDIT01

Audit log repository · Windows, domain-joined · VLAN 50 · Security & monitoring · 10.0.50.40 · Virtual machine on SBD-HV06 · rack R04 · server room

Windows, domain-joined. Retain security records under the approved retention policy.

Audit archive SMB 3 · TCP 445 with encryption · Write-only archival account from the collector (F11); hashes cataloged on arrival.

AU-9 Protection of Audit Information
AU-11 Audit Record Retention

AdminJumpBox01

Tier 0 administration only · VLAN 60 · Tiered administration · 10.0.60.10 · Administration room · dedicated admin seat

Provide dedicated Tier 0 administration: identity, PKI, and every system that can control them.

Remote management RDP 3389 · WinRM 5985–5986 · AD Web Services 9389 to the DCs · SSH 22 to Linux · HTTPS consoles · Rule A01: Tier 0 targets only, with MFA and named accounts.

AC-6 Least Privilege
IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
SC-7(15) Boundary Protection | Networked Privileged Accesses

SBD-ADMIN-SRV01

Server administration only · VLAN 60 · Tiered administration · 10.0.60.20 · Administration room · dedicated admin seat

Privileged workstation for approved member-server targets. Separate operator roles further restrict security tools and protected audit storage. It hosts one virtual machine, SBD-ADMIN-PC01, the Tier 2 seat: Tier 1 accounts work only on the host, Tier 2 accounts only in the virtual machine.

Server administration only Listeners to define

AC-5 Separation of Duties
AC-6 Least Privilege
IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
AU-12 Audit Record Generation

SBD-ADMIN-PC01

Endpoint administration only · VLAN 60 · Tiered administration · 10.0.60.30 · Administration room · virtual machine on the SBD-ADMIN-SRV01 seat

Privileged workstation for the 50 client endpoints, running as a virtual machine on the SBD-ADMIN-SRV01 seat with its own name and address. No AD, CA, or server administrative sessions, and no higher-tier sign-ins.

Endpoint administration only Listeners to define

AC-5 Separation of Duties
AC-6 Least Privilege
IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
AU-12 Audit Record Generation

SBD-MGMT01

Management tools server · VLAN 70 · Management tools · 10.0.70.10 · Virtual machine on SBD-HV07 · rack R04 · server room

Management tools. Define administrative accounts, permitted targets, and protocols.

Management tools server Listeners to define

CM-2 Baseline Configuration
CM-3 Configuration Change Control
CM-8 System Component Inventory
AC-6 Least Privilege

SBD-REPO01

Linux repository server · VLAN 70 · Management tools · 10.0.70.20 · Virtual machine on SBD-HV07 · rack R04 · server room

Serve the approved Linux package collection.

Package repository HTTP · TCP 80 (F19) · GPG-signed packages and metadata for the domain-joined Linux servers.
Log forwarding TLS 6514 · Syslog over TLS to the collector (F07).

SI-2 Flaw Remediation
AC-6 Least Privilege
CM-6 Configuration Settings

50 Windows PCs

User workstations × 50 · VLAN 80 · User workstations · 10.0.80.100–199 · Office · user desks

Represent 50 Windows user endpoints.

Addressing DHCP client
Identity and resource clients DNS / Kerberos / SMB
Update client Internal WSUS

CM-6 Configuration Settings
AC-6 Least Privilege
SI-2 Flaw Remediation
SI-3 Malicious Code Protection

SBD-ROOTCA01

Offline root CA · workgroup · Offline · not domain-joined · No network address (offline) · Offline vault · secure cabinet

Protect the trust anchor and perform authorized offline ceremonies.

Live network listeners None represented · Offline and non-domain-joined.
Subordinate signing / root CRL Offline ceremony

SC-12 Cryptographic Key Establishment and Management
SC-17 Public Key Infrastructure Certificates
CP-9 System Backup

Building and hosting 5 rooms · 7 hosts

Server room

Badge access · logged entry

Administration

Tiered admin seats

Office

50 user workstations

Media room

Controlled import and export

Offline vault

No network cabling

SBD-HV01

Hypervisor host · rack R02

SBD-DC01

SBD-HV02

Hypervisor host · rack R02

SBD-DC02

SBD-HV03

Hypervisor host · rack R02

SBD-SUBCA01, SBD-PKI-MGMT01

SBD-HV04

Hypervisor host · rack R03

SBD-DHCP01, SBD-SYSLOG01, SBD-WSUS01

SBD-HV05

Hypervisor host · rack R03

SBD-FS01, SBD-SQL01, SBD-APPS01, SBD-WEB01

SBD-HV06

Hypervisor host · rack R04

SBD-SPLUNK01, SBD-NESSUS01, SBD-EPO01, SBD-AUDIT01

SBD-HV07

Hypervisor host · rack R04

SBD-MGMT01, SBD-REPO01

Network segments 8 VLANs

VLAN 10 · Domain controllers

10.0.10.0/24 · SBD-DC01, SBD-DC02

Restrict directory administration; allow only documented identity and DNS dependencies.

AC-2 Account Management
AC-6 Least Privilege
IA-2 Identification and Authentication (Organizational Users)
SC-7 Boundary Protection
CP-9 System Backup
SC-22 Architecture and Provisioning for Name/Address Resolution Service
SC-23 Session Authenticity

VLAN 20 · Identity & services

10.0.20.0/24 · SBD-DHCP01, SBD-SYSLOG01, SBD-WSUS01

Define DHCP relay and approved update and collection routes. No internet upstream.

CM-6 Configuration Settings
CM-8 System Component Inventory
SI-2 Flaw Remediation
AU-12 Audit Record Generation

VLAN 30 · PKI infrastructure

10.0.30.0/24 · SBD-SUBCA01, SBD-PKI-MGMT01

Only the issuing services join this segment. The offline root has no switch connection.

SC-12 Cryptographic Key Establishment and Management
SC-17 Public Key Infrastructure Certificates
IA-5 Authenticator Management
AC-6 Least Privilege

VLAN 40 · Servers & data

10.0.40.0/24 · SBD-FS01, SBD-SQL01, SBD-APPS01, SBD-WEB01

Authorize each client-to-service path. The fleet reaches SBD-WEB01 (F13), SBD-WEB01 calls the application API on SBD-APPS01 (F21), and only SBD-APPS01 reaches SBD-SQL01 (F22); web-to-SQL is denied (F14). Licensing uses each application’s registered vendor port (F12). All four servers share this VLAN, so host firewalls enforce these rows.

AC-3 Access Enforcement
AC-6 Least Privilege
SC-8(1) Transmission Confidentiality and Integrity | Cryptographic Protection
SC-28(1) Protection of Information at Rest | Cryptographic Protection
CP-9 System Backup

VLAN 50 · Security & monitoring

10.0.50.0/24 · SBD-SPLUNK01, SBD-NESSUS01, SBD-EPO01, SBD-AUDIT01

Scope scanners and agents explicitly. Protect audit records and separate security administration.

AU-6 Audit Record Review, Analysis, and Reporting
AU-9 Protection of Audit Information
AU-11 Audit Record Retention
RA-5 Vulnerability Monitoring and Scanning
SI-3 Malicious Code Protection
SI-4 System Monitoring
SI-4(4) Inbound and Outbound Communications Traffic

VLAN 60 · Tiered administration

10.0.60.0/24 · AdminJumpBox01, SBD-ADMIN-SRV01, SBD-ADMIN-PC01

Separate identity/PKI, server, and endpoint administrative hosts and accounts: two physical seats, with the endpoint seat a virtual machine on the server seat. Host rules deny cross-tier management; sharing this VLAN does not grant access.

AC-2 Account Management
AC-6 Least Privilege
IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
AU-12 Audit Record Generation
SC-7(15) Boundary Protection | Networked Privileged Accesses

VLAN 70 · Management tools

10.0.70.0/24 · SBD-MGMT01, SBD-REPO01

Constrain publishers and management identities. Validate packages brought in on approved media.

CM-2 Baseline Configuration
CM-3 Configuration Change Control
CM-6 Configuration Settings
CM-8 System Component Inventory
SI-2 Flaw Remediation
CP-10 System Recovery and Reconstitution

VLAN 80 · User workstations

10.0.80.0/24 · 50 Windows PCs

Dedicated client segment. Block peer SMB/RDP and direct administrative access; allow documented identity and resource dependencies only.

AC-3 Access Enforcement
AC-6 Least Privilege
CM-6 Configuration Settings
CM-7 Least Functionality
SC-7 Boundary Protection
IA-2(2) Multi-factor Authentication to Non-privileged Accounts
IA-3 Device Identification and Authentication

Follow the traffic 7 processes

01 · Sign in: A workstation finds its identity.

Addressing, name resolution, and domain authentication.

Obtain a network address 50 Windows PCs → SBD-DHCP01 · DHCP · UDP 67 / 68
A new client requests an address and receives lease settings. The exchange includes discovery, offer, request, and acknowledgement.
Locate directory services 50 Windows PCs → SBD-DC01 · DNS · TCP / UDP 53
The workstation asks internal DNS to locate domain services. DNS records connect service names to reachable hosts.
Authenticate to the domain 50 Windows PCs → SBD-DC01 · Kerberos · TCP / UDP 88
The client proves its identity to the domain controller’s Key Distribution Center and obtains a ticket-granting ticket.
Read directory information 50 Windows PCs → SBD-DC01 · LDAP · TCP 389 / LDAPS · TCP 636
The workstation reads its computer and policy objects from Active Directory, then fetches Group Policy from SYSVOL over SMB. Rule F03 permits the full directory profile for domain members.

02 · Open a file: From a name to an authorized file.

Follow a domain client to its file share.

Resolve the file server 50 Windows PCs → SBD-DC01 · DNS · TCP / UDP 53
The client resolves the file server’s name before opening a connection. The diagram uses SBD-FS01 as the named destination.
Request a service ticket 50 Windows PCs → SBD-DC01 · Kerberos · TCP / UDP 88
The workstation uses its ticket-granting ticket to request a ticket for the file service. It then presents that service ticket to the server.
Open the approved share 50 Windows PCs → SBD-FS01 · SMB · TCP 445
The client requests a file over SMB. The server applies the relevant share and filesystem permissions before allowing access.

03 · Get updates: Bring updates inside. Distribute with care.

A disconnected update workflow, with no internet edge.

Import approved update material Authorized operator → SBD-WSUS01 · MANUAL TRANSFER · NO NETWORK SESSION
An authorized operator brings approved update material across the air gap using controlled media and an established import process.
Check update metadata 50 Windows PCs → SBD-WSUS01 · HTTPS · TCP 8531
The client contacts the internal WSUS service for update metadata using the TLS-enabled configuration.
Retrieve signed update content 50 Windows PCs → SBD-WSUS01 · HTTP · TCP 8530
WSUS uses its HTTP connection for update payloads, with signatures protecting payload authenticity. TLS is used for metadata rather than every WSUS path.

04 · Follow a log: Turn an event into useful evidence.

From Windows and Linux sources to collection, analysis, and retention.

Forward a domain controller event SBD-DC01 → SBD-SYSLOG01 · EVENT FORWARDING · WinRM TCP 5985
SBD-DC01 pushes the subscribed security events to the collector. The collector never reaches into the source: the subscription is source-initiated, set by Group Policy.
Deliver a source event SBD-REPO01 → SBD-SYSLOG01 · SYSLOG OVER TLS · TCP 6514
A configured Linux source can initiate a protected syslog session to the collector. The connection uses TLS transport.
Ingest for investigation SBD-SYSLOG01 → SBD-SPLUNK01 · SPLUNK FORWARDER · TCP 9997 + TLS
The forwarder on the collector sends the Windows events and syslog intake to Splunk for indexing, searches, and alerts.
Retain an audit copy SBD-SYSLOG01 → SBD-AUDIT01 · ARCHIVE · SMB 3 · TCP 445
On schedule, the collector writes dated archive files to the repository share on SBD-AUDIT01. Each archive is hashed and cataloged on arrival.

05 · License check: A licensing service has its own contract.

Follow the client request to its licensing service.

Request a license 50 Windows PCs → SBD-APPS01 · VENDOR LICENSING · REGISTERED PORT
An approved client contacts the licensing service to check or obtain its entitlement. Protocol, direction, persistence, and offline behavior depend on the product.

06 · Offline trust: The root stays outside the live network.

A controlled offline certificate ceremony.

Prepare the signing material Authorized operator → SBD-SUBCA01 · OFFLINE CEREMONY · NO LIVE PATH
Prepare the subordinate CA’s signing request and the records required for the ceremony. Protect the request and validate the intended certificate policy.
Use the offline root Authorized operator → SBD-ROOTCA01 · OFFLINE ROOT · NO NETWORK SESSION
Authorized operators use the protected root key in a controlled ceremony. The root CA remains non-domain-joined and disconnected.
Return publication artifacts Authorized operator → SBD-SUBCA01 · CONTROLLED TRANSFER · NO LIVE PATH
Return approved certificate and revocation artifacts through the documented offline transfer process. Define the issuing CA’s enrollment and publication design separately.

07 · Use a web app: A browser trusts the internal web service.

Name resolution, certificate trust, revocation, and an encrypted session.

Resolve the web server 50 Windows PCs → SBD-DC01 · DNS · TCP / UDP 53
The browser resolves the web service’s internal name before connecting. DNS returns SBD-WEB01’s address on VLAN 40.
Verify the server certificate 50 Windows PCs → SBD-WEB01 · HTTPS · TCP 443
The browser opens a TLS session. SBD-WEB01 presents a certificate from the internal issuing CA, and the client checks the name, validity dates, and chain to the trusted offline root.
Check revocation 50 Windows PCs → SBD-PKI-MGMT01 · CRL / AIA · HTTP TCP 80
The client follows the CRL distribution point in the certificate to pki.sbd.test on SBD-PKI-MGMT01 and downloads the issuing CA’s current revocation list.
Request the application 50 Windows PCs → SBD-WEB01 · HTTPS · TCP 443
Inside the encrypted session, the browser sends HTTP requests and receives the application’s responses. The application decides what the signed-in user may see.

What if… 5 scenarios

DC01 is down: One domain controller fails.

The client turns to SBD-DC02 for DNS and authentication.

Query SBD-DC01 50 Windows PCs → SBD-DC01 · DNS · TCP / UDP 53
The workstation sends its DNS query to its first configured DNS server. SBD-DC01 is offline, so no reply comes back.
Retry with SBD-DC02 50 Windows PCs → SBD-DC02 · DNS · TCP / UDP 53
The client retries with its next configured DNS server. SBD-DC02 also provides DNS for the domain and answers.
Authenticate with SBD-DC02 50 Windows PCs → SBD-DC02 · Kerberos · TCP / UDP 88
DNS service records list both domain controllers, and the client’s domain controller locator finds SBD-DC02 responding. SBD-DC02’s Key Distribution Center issues the ticket-granting ticket.

Certificate expired: The browser refuses an expired certificate.

Trust checks fail before any application data is sent.

Resolve the web server 50 Windows PCs → SBD-DC01 · DNS · TCP / UDP 53
The browser resolves the web service’s internal name, exactly as on a normal day.
Present an expired certificate 50 Windows PCs → SBD-WEB01 · HTTPS · TCP 443
SBD-WEB01 presents a certificate whose validity period has ended. The browser checks the dates, stops the connection, and shows a certificate error.

A PC tries SQL: Default deny stops a direct database connection.

No exception exists for workstation-to-SQL traffic.

Connect straight to SBD-SQL01 50 Windows PCs → SBD-SQL01 · SQL · TCP 1433
A workstation tries to reach the database server directly. The core finds no matching exception, so default deny drops the session.

PC-to-PC remote desktop: Host firewalls stop lateral movement.

One workstation tries remote desktop to another.

Open remote desktop to another PC 50 Windows PCs → 50 Windows PCs · RDP · TCP / UDP 3389
A workstation tries a remote desktop session to a peer on the same VLAN. The destination’s host firewall refuses it.

Attack drill: An intruder tests every boundary.

Six moves an intruder might try, from one compromised PC to a stolen admin session. Each is checked against the rules.

A compromised PC tries the database 50 Windows PCs → SBD-SQL01 · SQL · TCP 1433
Malware on one workstation reaches straight for SBD-SQL01. No exception exists for workstation-to-SQL traffic, so the core drops the attempt.
Acceptance test: Client-to-SQL, client-to-management, and peer SMB/RDP fail.
It looks for the security tools 50 Windows PCs → SBD-SPLUNK01 · MANAGEMENT · Splunk Web · TCP 8000
Taking over a security tool would blind the defenders. The PC tries Splunk’s web interface. No rule lets user workstations reach security-tool management, so default deny drops it.
Acceptance test: A compromised client cannot reach security-tool management interfaces.
It tries a neighbor’s file shares 50 Windows PCs → 50 Windows PCs · SMB · TCP 445
Next, the PC tries the shares on another workstation in VLAN 80. The traffic never crosses the core, so the neighbor’s host firewall refuses it.
Acceptance test: Client-to-SQL, client-to-management, and peer SMB/RDP fail.
It tries remote desktop to a neighbor 50 Windows PCs → 50 Windows PCs · RDP · TCP / UDP 3389
The PC tries a remote desktop session to a peer. The destination’s host firewall refuses it.
Acceptance test: Client-to-SQL, client-to-management, and peer SMB/RDP fail.
A compromised web server reaches for the database SBD-WEB01 → SBD-SQL01 · SQL · TCP 1433
If SBD-WEB01 were taken over, SBD-SQL01 would be the next target. They share VLAN 40, so the core never sees this traffic. SBD-SQL01’s host firewall refuses it.
Acceptance test: The web server cannot reach SQL directly; only SBD-APPS01, the registered consumer, connects.
A stolen admin session aims at a domain controller SBD-ADMIN-PC01 → SBD-DC01 · MANAGEMENT · REMOTE ADMINISTRATION
With an endpoint administrator’s stolen session on SBD-ADMIN-PC01, the attacker aims at SBD-DC01. That seat, a virtual machine on SBD-ADMIN-SRV01, manages user endpoints only. No rule lets it manage a domain controller, so default deny drops it.
Acceptance test: An endpoint administrator cannot manage a DC, issuing CA, or member server.

Protocol reference 20 entries

Service	Transport	Interpretation
DNS	TCP / UDP 53	Name and service discovery; resolver order must be configured.
DHCPv4	UDP 67 / 68	Server / client exchange. Relay requirements depend on subnet design.
Kerberos	TCP / UDP 88	KDC authentication and ticket requests.
Kerberos password change	TCP / UDP 464	Password changes and resets.
Directory access	TCP / UDP 389 · TCP 636	LDAP / LDAPS. UDP 389 carries the domain controller locator ping; validate binding and protections.
Global catalog	TCP 3268 / 3269	Forest-wide directory searches; 3269 uses TLS.
Group Policy and SYSVOL	TCP 445	Domain members read policies and scripts from domain controller shares over SMB; Group Policy also uses LDAP and RPC.
RPC services	TCP 135 · TCP 49152–65535	Endpoint mapper, then the dynamic range for NetLogon, LSA, and SAM.
Domain time	UDP 123	W32Time. Domain members follow the domain time hierarchy.
AD Web Services	TCP 9389	Active Directory PowerShell and Administrative Center. Needed from the Tier 0 administration host, not user workstations.
SMB	TCP 445	Client request to the file service.
WSUS metadata	HTTPS 8531	TLS metadata connection.
WSUS content	HTTP 8530	Signed payloads use the separate content connection.
Syslog over TLS	TCP 6514	Configured sender initiates to the TLS receiver.
HTTPS	TCP 443	Internal web applications and the application API over TLS; server certificates come from the internal issuing CA.
SQL Server	TCP 1433 (default instance)	Default instance, with TLS. SBD-APPS01 is the only approved consumer; named instances may use dynamic or configured ports.
Licensing	Registered vendor port	Each application’s licensing port is recorded in the register per application (F12).
Splunk forwarding	TCP 9997 with TLS	The collector forwards events to SBD-SPLUNK01 (F10).
Trellix ePO agents	TCP 443	The agent-server secure port: agents start each check-in with SBD-EPO01 (F16).
Offline root CA	No live port	Manual ceremony and controlled transfer only.