Home labs & practical projects
Design and review network access for a small office
A project to do with your own tools, with guidance on what to create and capture.
What you could create
Plan separate access for staff, contractors, guests and shared devices. Show how identity, device health and business need influence your decisions.
| Group | Access allowed | Access blocked | Reason |
|---|---|---|---|
| Staff | Required internal services | Unapproved resources | Business role |
| Contractors | Specific applications | Administrative services | Defined support need |
| Guests | Internet only | Internal networks | No internal need |
| Shared devices | Defined services | Sensitive data | Device function |
What you'll need
Diagramming tool
Any tool you already use.
Spreadsheet or document
Record access decisions, assumptions and proposed checks.
Reference material
Use current Cisco documentation to check assumptions.
Suggested milestones
- 1
Sketch the environment
Show staff, contractor, guest and shared-device groups, key services and trust boundaries.
- 2
Define the access
Record what each group needs, what should be blocked and why.
- 3
Explore exceptions
Consider an unknown device, a non-compliant laptop and an unavailable identity service.
- 4
Review your decisions
Write a permitted and blocked check for each group. If you build it, record observed results.
One example to adapt
| Group | Access allowed (proposed) | Access blocked (proposed) | Proposed check |
|---|---|---|---|
| Guest device | Internet access only | Staff file service | Confirm the guest cannot reach the staff share |
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Cisco ISE 3.5: policy sets, authentication and authorisation. Check the version for your tools.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Sketch a fictional office with a staff file service, an internal application, internet access and shared phones or printers. Start with four device groups and write down which services each actually needs. Treat the design as a proposal until you have implemented and tested it. A managed device is not permission to access everything. When planning identity-service outages, distinguish existing sessions from new ones.
What a good result looks like
- Unknown endpoints do not silently inherit trusted access.
- The policy explains whether and why access fails open or closed.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.