Infrastructure Security Lab — 2025

Secure WiFi Deployment
Enterprise EVE-NG Lab

Designed and deployed a secure enterprise WiFi infrastructure using EVE-NG. The lab simulates a corporate network with MikroTik RouterOS, Windows Server NPS for RADIUS authentication, WPA2-Enterprise with 802.1X, VLAN segmentation, DHCP services, and Layer 2 security controls. A complete hands-on implementation of enterprise wireless architecture from the ground up.

IEEE 802.1X NIST SP 800-153 WPA3-Enterprise

Network Topology Download Report GitHub Repo Back to Network & Infrastructure

Overview

Project Details

Objective

Build and validate a production-like enterprise WiFi architecture in a virtualized lab environment. The goal was to implement industry-standard wireless security controls — WPA2-Enterprise with 802.1X authentication, RADIUS-based access control via NPS, VLAN segmentation for traffic isolation, and DHCP services — all integrated into a single functional topology that can serve as a reference architecture for real-world deployments.

Environment

Hypervisor: EVE-NG Community Router/Firewall: MikroTik RouterOS RADIUS Server: Windows Server — NPS Switching: Layer 2 managed switch Wireless: WPA2-Enterprise SSID Clients: Windows 10, Linux

Topology

Network Architecture

Enterprise wireless topology designed for VLAN segmentation, centralized authentication, and secure client isolation.

┌─────────────────────┐

│ Windows Server NPS │

│ (RADIUS + DHCP) │

│ 192.168.10.10 │

└──────────┬──────────┘

│

┌──────────────────────┐

│ MikroTik RouterOS │

│ (Gateway + DHCP │

│ Relay + Firewall) │

│ 192.168.1.1 │

└──────────┬───────────┘

│

┌──────────────────────┐

│ Layer 2 Switch │

│ (VLAN Trunking) │

└──────┬──────┬───────┘

│ │

┌────────┐ ┌────────┐

│ AP-1 │ │ AP-2 │

│SSID:Co-│ │SSID:Co-│

│rp-wifi │ │rp-wifi │

└────┬───┘ └────┬───┘

│ │

┌────┴────┐ ┌───┴────┐

│Client-1 │ │Client-2│

│Win 10 │ │Linux │

│VLAN 10 │ │VLAN 10 │

└─────────┘ └────────┘

VLAN Segmentation

VLAN 10 — Corporate (10.10.10.0/24)
VLAN 20 — Guest (10.10.20.0/24)
VLAN 30 — Management (10.10.30.0/24)
VLAN 99 — Native/Unused

Authentication Flow

1. Client associates to SSID corp-wifi
2. AP forwards credentials to MikroTik
3. MikroTik relays via RADIUS to NPS
4. NPS validates against AD/Local DB
5. Access-Accept → client gets VLAN 10 IP

Key Security Controls

✓ WPA2-Enterprise with 802.1X
✓ RADIUS authentication via NPS
✓ VLAN segmentation + ACLs
✓ DHCP relay on MikroTik
✓ Layer 2 port security
✓ Management plane restricted

Configuration

Implementation Details

Key configuration excerpts from the network devices and RADIUS server.

MikroTik RouterOS — DHCP Relay & RADIUS

# VLAN interfaces
/interface vlan
add interface=ether2 name=vlan10 vlan-id=10
add interface=ether2 name=vlan20 vlan-id=20
add interface=ether2 name=vlan30 vlan-id=30

# DHCP relay for each VLAN
/ip dhcp-relay
add dhcp-server=192.168.10.10 interface=vlan10
add dhcp-server=192.168.10.10 interface=vlan20

# RADIUS client config
/radius
add address=192.168.10.10 secret=radiusSecret
service=wireless

Wireless — WPA2-Enterprise SSID

# Secure SSID with 802.1X
/interface wireless
set wlan1 mode=ap-bridge \
   ssid="corp-wifi" \
   security-profile="enterprise-secure"

# WPA2-Enterprise with 802.1X
/interface wireless security-profiles
add name="enterprise-secure" \
   mode="802.1X" \
   authentication-types="wpa2-eap" \
   radius-mac-authentication=no

Windows NPS — RADIUS Policies

# NPS Connection Request Policy
Policy Name: Wireless-Access
Type of NAS: Unspecified

# Conditions (match all):
- NAS IPv4: 192.168.10.1
- NAS Port Type: Wireless-802.11
- Called Station ID: *corp-wifi*

# Authentication Methods:
- PEAP (Protected EAP)
- MS-CHAPv2 (password-based)

# Standard RADIUS Attributes:
- Service-Type: Framed (2)
- Filter-Id: VLAN-10-ACL

SVI Configuration — Layer 2 Switch

! VLAN database
vlan 10
name CORPORATE
vlan 20
name GUEST
vlan 30
name MGMT

! Trunk to MikroTik
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30

! Access ports for APs
interface gigabitEthernet 0/2
switchport mode access
switchport access vlan 10
spanning-tree portfast

Testing

Validation Results

Verification of the deployed architecture through functional testing and security validation.

RADIUS Authentication PASS

Windows NPS successfully authenticated wireless clients using PEAP/MS-CHAPv2. RADIUS Access-Accept messages returned with correct VLAN assignment. Failed auth attempts logged with reason codes in NPS event viewer.

VLAN Segmentation PASS

Clients on VLAN 10 (corporate) and VLAN 20 (guest) received correct IP ranges via DHCP relay. Inter-VLAN routing controlled by MikroTik firewall rules. Guest VLAN isolated from corporate resources.

DHCP Relay PASS

MikroTik DHCP relay forwarded client discovery messages to the Windows DHCP server across VLANs. Lease obtained within 2 seconds. DHCP options (gateway, DNS) correctly applied per VLAN scope.

Client Connectivity PASS

Windows 10 and Linux clients successfully associated to corp-wifi, authenticated via 802.1X, received IP addresses, and communicated with network resources. Ping tests across VLANs validated routing policy.

References

Security Assessment Report — Full WiFi hardening assessment including network architecture review, configuration audit, and penetration testing results.
Configuration Baseline — Hardened configuration baseline for Cisco wireless infrastructure mapped to CIS benchmarks and NIST guidelines.

Full deliverables available in the project repository.

Secure WiFi Deployment Enterprise EVE-NG Lab