[{"content":"Welcome to my personal digital space. I am an Electrical-Electronics Engineer focused on building and securing modern network infrastructures.\n🔒 Network Security 🏗️ Routing \u0026 Switching 🛡️ Firewall Architectures ☁️ Cloud Infrastructure 🤖 Network Automation This website serves as my digital engineering notebook, where I document my hands-on laboratory simulations, technical deep-dives, and journey through advanced networking technologies. Here, you will mostly find my notes on Routing \u0026amp; Switching, Network Security (Firewall Architectures), and Cloud Infrastructure / Automation.\nLatest Technical Articles \u0026amp; Lab Notes # ","date":"6 May 2026","externalUrl":null,"permalink":"/","section":"Algan Ayzit","summary":"","title":"Algan Ayzit","type":"page"},{"content":" When we talk about network security, we often jump straight into firewalls, encryption algorithms, or massive access control lists (ACLs). But at the very core of every secure network lies a fundamental triad that forms the backbone of infrastructure security: AAA (Authentication, Authorization, and Accounting).\nBut what exactly is AAA? Before getting lost in technical jargon, let’s look at this not as a dry engineering document, but through a real-world scenario we all know: checking into a high-security hotel.\n🔑 The Hotel Analogy and Its Technical Backdrop # 1. Authentication: \u0026ldquo;Who are you?\u0026rdquo; # You walk up to the hotel front desk. Before the receptionist hands you any room key, what do they ask for first? Your ID or passport. The goal here is to verify that the person standing in front of them is actually the one who made the reservation.\nBehind the Scenes: This is the username and password prompt when an engineer tries to SSH into a router or switch. The network asks: Are these credentials valid? Is this person actually who they claim to be? In small networks, these credentials live directly on the device\u0026rsquo;s local database. However, in enterprise environments, AAA forwards this request to a centralized server like Cisco ISE or Aruba ClearPass. 2. Authorization: \u0026ldquo;What are you allowed to do?\u0026rdquo; # Your ID is verified, and the receptionist hands you a digital keycard. However, this card doesn\u0026rsquo;t open every door in the building. You can access your room or the gym, but if you swipe it at the penthouse suite or the main server room, the door won\u0026rsquo;t budge.\nBehind the Scenes: Successfully logging into a device doesn\u0026rsquo;t mean you have the right to change everything. In the Cisco ecosystem, there are default privilege levels ranging from 0 to 15. Thanks to AAA, we can implement Role-Based Access Control (RBAC). A junior intern might only be authorized to run monitoring commands (show), while a senior engineer dynamically receives full configuration (config t) privileges. 3. Accounting: \u0026ldquo;What did you actually do?\u0026rdquo; # It\u0026rsquo;s time to check out. The front desk hands you a detailed itemized receipt: what was taken from the minibar at 9 PM, which movie was watched at midnight\u0026hellip; The hotel management logged your every move for security and auditing.\nBehind the Scenes: In network engineering, this is the ultimate digital paper trail. When a session opens, a Start packet is sent to the central AAA server, followed by a Stop packet when it closes. If a core switch suddenly crashes, logs are audited to pinpoint exactly who ran the reload command and when. It’s not about playing the blame game; it’s about network auditing and visibility. ⚔️ The Protocol Wars: TACACS+ vs. RADIUS # Now that we understand the concept, let’s talk production. In the real world, we connect our network devices to a centralized security server using two main protocols. Choosing between them depends entirely on what we are trying to protect.\nFeature TACACS+ (The Device Manager) RADIUS (The Gatekeeper) Primary Use Device Administration (Router/Switch Management) Network Access Security (VPN users, 802.1X Wi-Fi) Encryption Encrypts the entire packet Encrypts only the password field Layer Type Uses TCP (Port 49) - Reliable connection Uses UDP (Port 1812/1813) - Faster, lightweight Architecture Separates AAA components completely Combines Authentication \u0026amp; Authorization Command Control Per-command authorization (Crucial for CLI) No granular CLI command control Why I Prefer TACACS+ for Infrastructure Management # When managing enterprise routers and switches, TACACS+ is my clear winner. Encrypting the entire packet prevents our topology and command details from being sniffed over the wire. More importantly, because it separates Authorization from Authentication, every single time an engineer presses \u0026ldquo;Enter\u0026rdquo; on a CLI command, we can query the server in real-time: \u0026ldquo;Is this user allowed to run this specific command right now?\u0026rdquo; RADIUS simply cannot provide this level of granular control efficiently.\n🚀 AAA in the Modern Era: Connecting with Zero Trust # In traditional designs, AAA was mostly used to audit engineers accessing internal devices. However, in today\u0026rsquo;s Zero Trust architectures, the perimeter is gone. The philosophy of \u0026ldquo;I am inside the company network, therefore I am safe\u0026rdquo; is officially dead.\nConsider another critical implementation: Site-to-Site IPsec VPN architectures. While secure encrypted tunnels prevent data from being intercepted in transit, how do we ensure the person initiating that tunnel from the other end is truly authorized?\nThis is where AAA shines in modern environments:\nWhen a remote or branch user requests access across the VPN, the gateway intercepts the request. Credentials are instantly passed to the central AAA server via RADIUS. The server checks context: Does the device have the right corporate certificate? Is the antivirus updated? (Context-Aware Authentication). If everything checks out, the user is granted access (Authorization) to only the minimal network segment required for their job. Ultimately, AAA is no longer just an old-school tool for managing routers; it is an indispensable security discipline sitting at the very heart of modern cybersecurity, VPN infrastructures, and Identity \u0026amp; Access Management (IAM) systems.\n","date":"6 May 2026","externalUrl":null,"permalink":"/labnotes/aaa-framework/","section":"Lab Notes","summary":"","title":"Demystifying AAA Framework: Identity \u0026 Access Management in Enterprise Networks","type":"labnotes"},{"content":"","date":"6 May 2026","externalUrl":null,"permalink":"/labnotes/","section":"Lab Notes","summary":"","title":"Lab Notes","type":"labnotes"},{"content":" Project Overview # This project demonstrates the implementation of a centralized monitoring system for a multi-site network infrastructure using Syslog and SNMP protocols, along with the application of cybersecurity hardening best practices on Cisco IOS devices.\nThe primary objective of the project is to maximize visibility across an enterprise network infrastructure, analyze all critical network events from a single point, and secure management lines against unauthorized access attempts.\n🛠️ Technical Infrastructure # Syslog: Forwards all critical system events, such as interface statuses, configuration changes, and security alerts, to a central server in real-time. SNMP v2c (Simple Network Management Protocol): Enables remote querying of device inventory, hardware resources, and system descriptions via MIB Browser. Precise Event Tracking (Timestamps): Adds millisecond-precision timestamps to log records to ensure accurate forensic analysis in the event of a cyber incident. Security Hardening: A security layer implemented to prevent unauthorized access attempts and detect brute-force attacks on infrastructure devices. 📊 Addressing and Topology Table # Device Interface IP Address Description Core_Router Gig0/0 192.168.10.1/24 Headquarters Gateway Branch_Router Gig0/0 10.0.0.2/30 Remote Site Interface Management_Server Fast0/1 192.168.10.100/24 Syslog \u0026amp; SNMP Service Server 🔬 Verification and Proof of Concept # The configuration outputs and verification steps implemented to prove that the systems are running stably and security policies are active are detailed below:\nCentralized Logging and Precise Timestamp Configuration Cisco IOS commands used to forward log data from network devices to the central server and verify time analysis:\nCore_Router# configure terminal Core_Router(config)# logging 192.168.10.100 Core_Router(config)# service timestamps log datetime msec Core_Router(config)# line console 0 Core_Router(config-line)# logging synchronous Expected Status: When an interface goes down (shutdown), the millisecond (msec) timestamped log message should immediately appear on the server\u0026rsquo;s Syslog screen.\nSNMP v2c Query and Access Configuration Presenting device information to the monitoring server as Read-Only (RO) and defining corporate metadata:\nCore_Router(config)# snmp-server community GuvenliToplulukSifresi RO Core_Router(config)# snmp-server contact Algan Ayzit Core_Router(config)# snmp-server location Merkez Veri Merkezi Verification: When the \u0026lsquo;MIB Browser\u0026rsquo; tool on the Management_Server is executed and the \u0026lsquo;GuvenliToplulukSifresi\u0026rsquo; is entered, the system inventory is successfully retrieved.\nDevice Management Line Security Hardening Disabling the insecure Telnet protocol, activating SSH v2, and logging login attempts to monitor brute-force attacks:\nCore_Router(config)# hostname Core_Router Core_Router(config)# ip domain-name alganayzit.local Core_Router(config)# crypto key generate rsa (Modulus: 1024) Core_Router(config)# ip ssh version 2 Core_Router(config)# line vty 0 4 Core_Router(config-line)# transport input ssh Core_Router(config-line)# login local Core_Router(config-line)# exit Core_Router(config)# login on-failure log Core_Router(config)# login on-success log Core_Router(config)# enable secret EncriptedSecretPassword123 Result Control: In the event of a failed SSH login attempt to the device, a login authentication failure alert (LOGIN-4-AUTH_FAIL) is generated instantly on the Syslog screen.\nView Repository (GitHub) ","date":"12 March 2026","externalUrl":null,"permalink":"/projects/network-monitoring/","section":"Projects","summary":"","title":"Centralized Network Monitoring \u0026 Security Hardening","type":"projects"},{"content":"Here you can find the enterprise network designs, security implementations, and cloud projects I have built.\n","date":"12 March 2026","externalUrl":null,"permalink":"/projects/","section":"Projects","summary":"","title":"Projects","type":"projects"},{"content":" Project Overview # This project demonstrates the design and configuration of a secure Site-to-Site IPsec VPN tunnel between two corporate networks (HQ and Branch) over an untrusted Public ISP infrastructure using Cisco IOS.\nThe objective of this project is to provide a secure communication channel between two geographically separated LANs. By implementing an IPsec tunnel, we ensure that internal traffic remains encrypted and invisible to the Internet Service Provider (ISP).\n🛠️ Technical Stack # IPsec (Internet Protocol Security): Ensures data confidentiality, integrity, and authentication. IKE Phase 1 (ISAKMP): Negotiates security associations and establishes a secure management plane. IKE Phase 2 (IPsec SA): Defines how the actual data is encrypted and transferred. AES-256 \u0026amp; SHA: Advanced encryption and hashing standards used for maximum security. Cisco IOS Security Features: Leveraging the securityk9 technology package. 📊 Addressing Table # Device Interface IP Address Description HQ-Router Gig0/0 1.1.1.1/30 Public Facing (Internet) HQ-Router Gig0/1 192.168.10.1/24 HQ LAN Gateway ISP-Router Gig0/0 1.1.1.2/30 HQ Service Termination ISP-Router Gig0/1 2.2.2.2/30 Branch Service Termination BR-Router Gig0/0 2.2.2.1/30 Public Facing (Internet) BR-Router Gig0/1 192.168.20.1/24 Branch LAN Gateway 🔬 Verification \u0026amp; Proof of Concept # To demonstrate that the tunnel is operational and traffic is being encrypted, the following verification steps were performed: ======================================================================== 1. Phase 1 State (ISAKMP SA) ======================================================================== The command \u0026#39;show crypto isakmp sa\u0026#39; confirms that the management tunnel is established. HQ# show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 1.1.1.1 2.2.2.1 QM_IDLE 1001 ACTIVE Expected State: QM_IDLE (Indicates a successful, authenticated session). ======================================================================== 2. Phase 2 Data Flow (IPsec SA) ======================================================================== The command \u0026#39;show crypto ipsec sa\u0026#39; provides proof of encryption. By monitoring the packet counters, we can confirm the data is flowing through the secure tunnel. HQ# show crypto ipsec sa interface: GigabitEthernet0/0 Crypto map tag: MYMAP, local addr 1.1.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0) #pkts encaps: 45, #pkts encrypt: 45, #pkts digest: 45 #pkts decaps: 45, #pkts decrypt: 45, #pkts verify: 45 Key Counters to Monitor: - #pkts encaps: Number of packets encrypted and sent through the tunnel. - #pkts decaps: Number of packets received and decrypted from the tunnel. ======================================================================== 3. ICMP Connectivity Test ======================================================================== A ping was initiated from HQ-PC (192.168.10.x) to Branch-PC (192.168.20.x) to test end-to-end connectivity across the secure path. HQ-PC\u0026gt; ping 192.168.20.10 Pinging 192.168.20.10 with 32 bytes of data: Reply from 192.168.20.10: bytes=32 time=12ms TTL=126 Reply from 192.168.20.10: bytes=32 time=10ms TTL=126 Ping statistics for 192.168.20.10: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss) Result: Success (0% loss after initial tunnel negotiation). Verification: Continuous pinging results in an increase of the encapsulation/decapsulation counters mentioned in Phase 2. ","date":"23 January 2026","externalUrl":null,"permalink":"/projects/ipsec-vpn/","section":"Projects","summary":"","title":"Site-to-Site IPsec VPN Design \u0026 Implementation","type":"projects"},{"content":" Project Overview # This project focuses on simulating a multi-tier enterprise network architecture designed to meet corporate standards for scalability, redundancy, and structural security. It models a modern campus network with distinct core, distribution, and access layers, ensuring that logical boundaries align with engineering best practices.\nCore Architecture \u0026amp; Technical Approach # 1. High Availability \u0026amp; Redundancy (HSRP) # To prevent single points of failure at the default gateway level, Hot Standby Router Protocol (HSRP) is implemented at the distribution layer.\nObjective: It provides automated default gateway redundancy for critical VLANs, ensuring uninterrupted traffic flow if a primary layer-3 switch or router goes offline. 2. Dynamic Routing \u0026amp; Scalability (OSPF) # Network-wide reachability is established using Single-Area OSPF (Open Shortest Path First).\nObjective: This approach ensures fast convergence, efficient path selection, and simplifies network expansion. OSPF areas and link costs are tuned to optimize bandwidth utilization across backbone links. 3. Segmentation \u0026amp; Security (VLANs \u0026amp; ACLs) # Broadcast domains are strictly confined using local VLANs mapped to specific corporate functions (e.g., Management, IT, Operations, Guest).\nObjective: Inter-VLAN routing is strictly controlled via Access Control Lists (ACLs) to enforce a least-privilege access model, filtering unauthorized traffic before it reaches sensitive network segments. 4. Border Security \u0026amp; Internet Edge (NAT) # To facilitate secure internet egress while conserving public IP space, Network Address Translation (NAT) — specifically Port Address Translation (PAT) — is configured at the enterprise edge.\nObjective: It hides internal IP schemas from the public internet, translating private addresses into reusable public endpoints, thereby establishing a basic layer of boundary defense. 5. Enterprise Mobility \u0026amp; Guest Access (Wi-Fi) # Wireless connectivity is integrated into the campus network design, separating corporate internal traffic from guest traffic.\nObjective: Secure authentication mechanisms are simulated to ensure that wireless endpoints are dynamically funneled into their respective VLANs, preventing unauthorized access to core resources. Technical Stack # Cisco IOS OSPF v2 HSRP VLAN Trunking (802.1Q) Extended ACLs Dynamic NAT / PAT Wireless LAN (WLAN) ","date":"18 January 2026","externalUrl":null,"permalink":"/projects/enterprise-network/","section":"Projects","summary":"","title":"Enterprise Network Design \u0026 Simulation","type":"projects"},{"content":" About Me # I am an Electrical-Electronics Engineer with a deep-rooted passion for network infrastructure and information technology. Although my academic background is in electrical engineering, my fascination with networking and IT developed independently during my university years.\nDriven by this self-motivated interest, I focused on mastering routing, switching, and network security, which culminated in earning my Cisco Certified Network Associate (CCNA) certification.\nCurrently based in Germany, I am actively expanding my skill set into cloud technologies (Docker, Kubernetes, AWS) and cybersecurity. I believe that my hybrid background in both electrical engineering and network automation allows me to bring a unique, well-rounded engineering perspective to modern infrastructure challenges.\nCore Interests # Enterprise Network Design \u0026amp; Implementation Network Security \u0026amp; Firewall Architectures Cloud Infrastructure \u0026amp; Automation ","externalUrl":null,"permalink":"/about/","section":"Algan Ayzit","summary":"","title":"","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"}]