Our project experience in numbers
Selected projects in data centre, networking and IT security
From planning and migration through to live operations, with continuous technical responsibility.
Energy supply
Two data centres built and the existing network migrated
For an energy supply company, two interconnected data centres were built and the existing network was moved to the new environment in a planned maintenance window.
Starting point
The customer needed two new data centre environments and a connection between them. The changeover of the existing network could not be planned in isolation from later operations: new build, traffic flows, migration and commissioning had to fit together.
Approach
Both environments were built, the interconnection established and the transfer of the existing network prepared. The changeover ran in a planned maintenance window; every technical step was agreed directly with the customer. Commissioning and operational support followed the cutover.
Outcome
Both data centres run interconnected, the old network has been migrated to the new environment and the infrastructure is in operation. Build, migration and operations remained under continuous technical responsibility throughout the project.
In use: data centre networking, interconnection of two environments, migration in a maintenance window and operational support.
More on the services behind it: Network Infrastructure, IT Migration and Managed IT Operations.
Social care
20 sites: network and security under continuous support
A distributed environment with 20 sites on Cisco Meraki, with Cisco Firepower, Cisco ISE in high availability, Cisco SSE, Microsoft Entra ID and Intune. Network, security and identity sit under one technical support arrangement.
Starting point
In environments like this, faults and changes often sit at the transitions: device and identity, cable or Wi-Fi, site network, firewall, cloud service. What was needed was support that assesses this chain without gaps in responsibility.
Approach
Questions about access or reachability are examined along the whole chain, from the endpoint via Meraki and ISE to routing, Firepower and the services involved, instead of checking single components in isolation.
Outcome
The dependencies across the 20 sites are brought together under one support arrangement. Fault analysis and changes span endpoint, Wi-Fi, ISE, firewall, SSE and identity service, without any topic falling between responsibilities.
Examples from operations
- ISE migration to version 3.4. Old nodes deregistered, Smart Licensing compliance restored and the two-node deployment finalised.
- Dropped RADIUS packets. A packet capture showed that, with RADIUS fallback enabled, the Meraki access points send Status-Server packets per RFC 5997, which ISE does not support. Fallback was first disabled at a few sites, observed, then rolled out in a controlled way. Failover to the second node was preserved.
- An access point reached ISE via the wrong path. The suspicion lay with the site’s network assignment, not with ISE; the customer took over the check there. Cases like this are narrowed down before effort flows into the wrong component.
- VPN authentication. Runbook for moving Cisco Secure Client from RADIUS and ISE to SAML with Entra ID and MFA.
In use: Cisco Meraki, Cisco ISE 3.4 HA, Cisco Firepower, Cisco SSE, Cisco Secure Client, Entra ID, Intune, RADIUS, SAML and packet capture.
More on the services behind it: Managed IT Operations, IT Security and IT Migration.
Banking
Two sites connected with a layered firewall architecture
A redundant network and security infrastructure across two sites: designed, built, documented and handed over to operations.
Starting point
The architecture had to combine site connectivity, resilience and the separation of communication zones. Edge protection, internal security control, local networking and dynamic routing had to work together in one traceable overall design.
Approach
Sophos XGS firewalls as the edge solution at each site in active/standby mode, behind them a Cisco firewall cluster of the FPR series for segmentation and security control, connected via Cisco switching. Layer 2 and layer 3 networking with Catalyst switches, OSPF, site-to-site VPN, IPS and firewall rules on both tiers. VLAN planning, IP addressing, physical connections and topology were recorded in the documentation.
Outcome
An infrastructure across two sites with redundant edge components and separate security tiers. Routing, rules and physical connections are documented for operations; updates and changes were subsequently handled by the same team.
In use: Sophos XGS active/standby, Cisco Secure Firewall FPR cluster, Catalyst 1000 and 9200, OSPF, Layer 2/3, site-to-site VPN, IPS and VLAN design.
More on the services behind it: IT Security and Network Infrastructure.
How we make decisions in network and security projects
Not the fastest option, but the robust one, shown with examples from fault analysis, rollout and migration.
A customer wanted to introduce FMC high availability to fix SSL VPN drops. The recommendation in the project: separate the root cause analysis from the HA decision, because FMC HA provides neither load balancing nor a different VPN path.
For RADIUS drops in a Meraki environment, the cause was proven with a packet capture and the fix first rolled out and observed at a few sites instead of activating it everywhere at once.
When moving a guest Wi-Fi from ISE Central Web Auth to Local WebAuth on the Catalyst 9800, the old ISE configuration was kept as a rollback path; the switch-over happened only after the functional test.
Further projects by service area
An excerpt from further projects by our team. Choose a service area and open the details when needed.
- Manufacturing
Cisco ISE 3.4 introduced with Entra ID integration
Wired network access through Cisco ISE that distinguishes classic AD devices, hybrid devices and Entra-ID-only devices.
Approach and outcome
ApproachFirst a wired NAC proof of concept validating EAP-TLS and MAB. Then the live implementation: integration with Active Directory and Entra ID via the REST ID store, EAP-TLS with certificates from the customer’s own CA and an authorisation policy with three device tracks based on AD and Entra groups. After the PoC, the customer decided not to integrate Intune.
OutcomeA NAC policy that distinguishes three device categories, plus three documents: the PoC report, a preparation guide for the coordination meetings and an implementation guide with 15 chapters.
In use: Cisco ISE 3.4, 802.1X, EAP-TLS, MAB, active Directory, Entra ID (REST ID Store) and customer PKI.
- Consumer goods
ISE split upgrade from 3.2 to 3.4 and a new Policy Service Node abroad
A two-node Cisco ISE environment was upgraded to 3.4 and extended with a Policy Service Node at a site abroad.
Approach and outcome
ApproachSplit upgrade of both nodes through all phases: Upgrade Readiness Tool run, repository errors fixed, roles reassigned and indexes rebuilt after the upgrade. In parallel, planning of the new PSN for wireless NAC at the site abroad: VM sizing corrected and the x86-64-v2 CPU requirement of ISE 3.4 taken into account.
OutcomeBoth nodes run on 3.4. The extension is planned so that VM size and CPU architecture match the requirements of ISE 3.4 before the customer provides resources.
In use: Cisco ISE 3.2 and 3.4, split upgrade, upgrade Readiness Tool, policy Service Node and VM sizing.
- Social care and healthcare
Failed ISE node rebuilt in Microsoft Azure
The second ISE node, a virtual machine in Microsoft Azure, had failed after a certificate expired.
Approach and outcome
ApproachThe complete life cycle in one pass: Azure VM redeployed, certificates created with the EKU attributes required by ISE, joined to two AD domains, Smart Licensing renewed, the monitoring role (MnT) swapped and finally the health of the whole deployment verified.
OutcomeThe deployment runs on two nodes again. Procedure and certificate requirements are documented for the customer.
In use: Cisco ISE 3.3, Microsoft Azure, certificates and EKU, active Directory and smart Licensing.
- Manufacturing
Guest Wi-Fi moved from ISE to Catalyst 9800 Local WebAuth
Guest access with a consent portal was to be moved from Cisco ISE to the wireless LAN controller.
Approach and outcome
ApproachGuest consent moved from Central Web Authentication in ISE to Local WebAuth on the Catalyst 9800. The previous ISE guest configuration was kept as a rollback path and RADIUS accounting continued for the time being. The switch-over happened only after a successful functional test.
OutcomeGuest Wi-Fi runs with local consent on the controller, without depending on the ISE guest portal and with a way back should behaviour in operation differ from the test.
In use: Cisco Catalyst 9800, local WebAuth, Cisco ISE Central Web Auth and RADIUS accounting.
- Public sector and administration
Cisco ISE introduced from workshop to operational support
Controlled authentication for LAN and Wi-Fi, starting with a customer workshop on access requirements.
Approach and outcome
ApproachThe workshop captured the requirements for LAN and Wi-Fi access. The ISE environment was then rebuilt with 802.1X, certificate authentication and MAB. After go-live, the work covered isolating authentication issues, version updates and troubleshooting on Cisco ASA and Fortinet firewalls in the same environment.
OutcomeNetwork authentication runs via ISE with 802.1X, certificates and MAB. The customer received the access procedures agreed in the workshop and then one contact for incidents and updates.
In use: Cisco ISE, LAN and Wi-Fi, 802.1X, certificates, MAB, Cisco ASA and Fortinet.
- Media
Segmentation planned and the overall project led
An organically grown network was to be analysed and turned into a concept for separated network zones with matching firewall rules.
Approach and outcome
ApproachOverall project management, coordinating the inventory analysis and the technical planning. A segmentation concept and recommendations for the firewall rule base were derived from the existing network. Analysing the current environment was the first step, not the finished target picture.
OutcomeAn agreed technical basis for implementing segmentation: which zones are separated and which connections remain permitted.
In use: network analysis, segmentation concept, firewall rule base and project management.
- Pharmacies
Sophos SG210 migrated to XGS4300 and remote access transferred
An existing Sophos SG210 system was replaced by an XGS4300 environment; site and remote access had to be carried over in the platform change.
Approach and outcome
ApproachAnalysis of the existing environment, planning of the change and on-site consulting. On the XGS4300, an active/standby cluster, new RED connections to the other sites, SSL VPN, IPsec and IPS were set up. The web server configuration was included and the changeover carried out in a maintenance window.
OutcomeThe firewall environment runs as an active/standby cluster on XGS4300. Remote access, RED site connections, IPS and web server configuration were taken over in the maintenance window.
In use: Sophos SG210 and XGS4300, Active/standby, RED, SSL VPN, IPsec and IPS.
- Automotive
Firewall replacement with SD-WAN for two sites
Migration from Sophos SG210 to XGS2100 and the connection of two sites via SD-WAN in one project.
Approach and outcome
ApproachPlanning and installation of the XGS2100 environment, takeover of the existing configuration from the SG platform and setup of the active/standby cluster. The two sites were connected via Sophos SD-WAN; backup and restore, firmware work and a Visio drawing of the topology were part of the work.
OutcomeActive/standby cluster and SD-WAN connection are in operation. The migrated configuration, backup and restore and the topology documentation make the setup traceable for operations.
In use: Sophos XGS2100, SD-WAN, Active/standby, configuration migration and backup and restore.
- Service providers and telecommunications
Sophos and Cisco integrated in one customer environment
Sophos XGS firewalls, a Cisco FPR1120 firewall and Cisco switches were to be implemented and supported together: migration, operations and the rebuild of an infrastructure.
Approach and outcome
ApproachSophos XGS cluster in active/standby mode, the Cisco FPR1120 as gateway and the Cisco switches configured. The security scope covered SSL VPN, IPsec with certificates, IPS and the firewall rule base; the rebuild added analysis of the existing environment, cabling with storage and servers and a functional test.
OutcomeCluster, gateway and switching run as the customer wanted. VPN, IPS and rules are documented, and the customer has one contact for updates and incidents who knows both vendor worlds.
In use: Sophos XGS, Cisco Secure Firewall FPR1120, Cisco switching, SSL VPN, IPsec with certificates and IPS.
- E-commerce
Cisco LAN and Wi-Fi renewed
Work on switching, routing, Wi-Fi and firewall components, including a new wireless environment.
Approach and outcome
ApproachBuild and configuration of Cisco switches, routers, wireless LAN controllers, access points and firewalls. In addition the new wireless environment, updates and upgrades, incident handling and work with Cisco DNA Center.
OutcomeThe network components are built and configured, the new wireless environment is in place. Updates, upgrades and fault analysis continued to be handled by the same team afterwards.
In use: Cisco switching, routing, wireless LAN controllers, Cisco DNA Center and firewalls.
- Several industries
Primary responsibility for a customer network in operation
Operational support for a customer’s entire network, covering firewalls, routers and switches in the data centre and client network, remained in one pair of hands over an extended period.
Approach and outcome
ApproachIncidents, problems and changes including network on-call duty. For this and further customers from healthcare, energy, manufacturing and the service provider sector: layer 2 and layer 3 infrastructure with VLANs, STP, EtherChannel and HSRP; dynamic routing with OSPF, EIGRP and BGP; IPsec VPNs between branches and data centre; firewalls from Cisco, Sophos, Check Point and OPNsense; access control with ACLs and AAA via TACACS+ and RADIUS. Several branch and campus networks were redesigned during this time.
OutcomeThe customer had a fixed technical owner for its network, including outside business hours.
In use: firewalls and routers, DC and client switching, OSPF, EIGRP, BGP, IPsec, TACACS+ and RADIUS and PRTG, Wireshark, SolarWinds.
- Energy supply
Fortinet firewall and FortiManager configured
Technical configuration of a FortiGate firewall with central management via FortiManager.
Approach and outcome
ApproachConfiguration of the FortiGate and connection to FortiManager. In another environment, Fortinet endpoint protection and the related patch management were added.
OutcomeA firewall with central management via FortiManager.
In use: FortiGate, FortiManager, Fortinet Endpoint Protection and patch management.
- Several assignments
Palo Alto firewalls in separate projects
Several independent customer projects with Palo Alto firewalls.
Approach and outcome
ApproachNew installation, migration and troubleshooting in several customer environments. Scope and periods of the individual assignments are available on request.
OutcomePractice with Palo Alto Networks across installation, migration and fault analysis.
In use: Palo Alto Networks, new installation, migration and troubleshooting.
- Manufacturing
Firepower and routing between sites supported
Existing Cisco FTD firewalls and inter-site communication of a manufacturing customer.
Approach and outcome
ApproachAdministration of the firewalls, handling of technical incidents and configuration of OSPF for routing between the sites.
OutcomeFirewall administration and OSPF routing between the sites from a single source.
In use: Cisco Secure Firewall FTD, OSPF, site interconnection and troubleshooting.
- Hospitals and healthcare
Cisco SAN switching configured during a migration
Replacement of the existing SAN switch infrastructure in a hospital environment with Cisco MDS 9000.
Approach and outcome
ApproachContribution to the technical migration and configuration of the MDS 9000 switches, managed via Cisco DCNM.
OutcomeContribution to the replacement with Cisco MDS 9000, including configuration of the new switches.
In use: Cisco MDS 9000, Cisco DCNM, SAN migration and storage connectivity.
- Food
Dell LAN and Aruba Wi-Fi implemented
Layer 2 and layer 3 switching on Dell switches and the build of a new wireless environment with HPE Aruba.
Approach and outcome
ApproachConfiguration of the switches, handling of network issues and setup of the Wi-Fi.
OutcomeSwitching and Wi-Fi were in the hands of one contact.
In use: Dell switching, HPE Aruba Wi-Fi, Layer 2/3 and troubleshooting.
Technical building blocks for NIS2 and ISO/IEC 27001
For key risk management measures under Section 30 (2) BSIG, our projects provide proven technical building blocks. Whether an organisation falls under NIS2 is for its legal advisers to assess, not for us.
Risk analysis and security concepts
Inventory analysis of organically grown networks, segmentation concept, recommendations for the firewall rule base
Implemented in: Segmentation planned and the overall project led · Two sites connected with a layered firewall architecture
Handling of security incidents
Incident, problem and change processes, on-call duty, fault analysis by packet capture down to the root cause
Implemented in: Primary responsibility for a customer network in operation · 20 sites: network and security under continuous support
Business continuity, backup, recovery
Active/standby clusters, ISE in high availability, backup and restore of firewall configurations, rebuild of a failed ISE node
Implemented in: 20 sites: network and security under continuous support · Two sites connected with a layered firewall architecture · Failed ISE node rebuilt in Microsoft Azure · Firewall replacement with SD-WAN for two sites
Security in acquisition, development and maintenance, vulnerability management
Firmware and version updates, ISE patches and upgrades with readiness checks, patch management for firewalls and switches
Implemented in: ISE split upgrade from 3.2 to 3.4 and a new Policy Service Node abroad · Cisco ISE introduced from workshop to operational support · Firewall replacement with SD-WAN for two sites
Cryptography and encryption
IPsec and SSL VPN, EAP-TLS with the customer’s own PKI, certificate life cycle with CSR and EKU requirements
Implemented in: Cisco ISE 3.4 introduced with Entra ID integration · Failed ISE node rebuilt in Microsoft Azure · Sophos SG210 migrated to XGS4300 and remote access transferred
Human resources security, access control, asset management
802.1X, MAB and guest portals, authorisation by AD and Entra groups, TACACS+ for device administration, network segmentation
Implemented in: 20 sites: network and security under continuous support · Cisco ISE 3.4 introduced with Entra ID integration · Guest Wi-Fi moved from ISE to Catalyst 9800 Local WebAuth · Cisco ISE introduced from workshop to operational support · Segmentation planned and the overall project led · Primary responsibility for a customer network in operation
Multi-factor authentication, secured communication
SAML with Entra ID and MFA for VPN access (runbook), Cisco SSE for secured access to applications, Cisco Duo
Implemented in: 20 sites: network and security under continuous support
Experience from energy supply, healthcare, banking, public administration, telecommunications and food.
These sectors are directly affected by NIS2.
ISO/IEC 27001: The same building blocks contribute to Annex A controls such as access control, network security, segregation of networks, cryptography and backup.
Whether a control is met is for the auditor to decide.
Technologies for networking and IT security
What we use to plan, implement and operate: across vendors and matched to your environment.
Vendors in our projectsSelect a vendor to highlight its technologies
- Network access and identity
- Cisco ISE 802.1X EAP-TLS MAB Guest portals TACACS+ RADIUS PKI and certificates Microsoft Entra ID SAML and MFA Active Directory Intune Cisco Duo
- Firewall and perimeter
- Cisco Secure Firewall (FTD, FMC) Cisco ASA Sophos Firewall Fortinet FortiGate Palo Alto Networks Check Point IPS/IDS SSL and IPsec VPN Rule base design
- Routing and switching
- Cisco Catalyst OSPF BGP VLAN design HSRP EtherChannel Site interconnection HPE Aruba
- Wi-Fi
- Cisco Catalyst 9800 Cisco Meraki Local WebAuth HPE Aruba Ubiquiti UniFi
- SD-WAN, SSE and remote access
- Cisco Meraki SD-WAN Cisco Secure Access (SSE) Cisco Umbrella Cisco Secure Client Site-to-site and remote access VPN Microsoft Azure
- Data centre
- Data centre networks Cisco MDS (SAN) VMware vSphere Hyper-V DNS and DHCP in high availability
- Operations and analysis
- Packet capture with Wireshark PRTG SolarWinds Cisco Secure Network Analytics Incident, problem and change Operations manuals
Questions about our project experience
Are these customer references of Taveor Systems?
No. The projects come from our team's previous positions at IT service providers and system integrators. They show which environments our team has already planned, implemented and operated, and therefore what experience you can draw on at Taveor Systems.
Are these all of your team’s projects?
No. This page shows a selection. Many other projects are confidential or similar to the ones shown. In an initial conversation, we are happy to tell you which experience fits your environment.
Why are no customer names given?
Network and security projects are confidential. We therefore only give industry, task, approach and technologies, and keep details general wherever the customer could otherwise be identified. The same confidentiality applies to your project.
Which vendors does Taveor Systems work with?
There is project experience with Cisco, Sophos, Fortinet, Palo Alto Networks, Microsoft, HPE Aruba, Check Point and VMware. We work across vendors and recommend what fits your environment.
How do we start a project together?
With a no-obligation initial consultation. We clarify starting point, goal and scope and propose a clearly defined first step, such as an inventory, a proof of concept or a concept.