Welcome to Orange and Peel

Company background

Orange and Peel began in 2008 when longtime friends Nora Orange and Peter Peel rented a small warehouse outside Grove. Their original business supplied fresh citrus and specialty ingredients to independent restaurants, bakeries, and neighborhood markets. Nora managed relationships with growers while Peter built a reputation for getting difficult orders delivered on time.

The company grew through personal service rather than sophisticated technology. Orders initially arrived by phone, inventory lived in spreadsheets, and the warehouse team could identify most customers by name. That approach worked well while everyone operated from one building.

By 2015, Orange and Peel had expanded beyond wholesale produce. The company began making bottled juices, dried fruit, preserves, and citrus-based flavoring products. Production remained at Grove, but new distribution sites were opened to shorten delivery times and support regional customers.

Today, Orange and Peel employs approximately 180 people across four locations. The company is still privately owned and takes pride in being friendly, practical, and quick to adapt. Unfortunately, its network has adapted a little too quickly.

The sites

Grove — Headquarters

Grove is the original location and remains the center of the company. It contains:

• Executive and administrative offices
• The main warehouse and production floor
• Finance and customer-service teams
• Central IT services
• Network monitoring and management systems
• Central voice and security services

Most company-wide technology is operated from Grove. If Grove becomes unavailable, the branches can continue some local work, but many business services are affected.

Zest — Sales and customer experience

Zest was the first branch office. It supports regional sales, product demonstrations, and customer training. Its employees rely heavily on voice, video meetings, and access to corporate applications hosted at Grove.

Zest frequently hosts customers and therefore needs dependable guest access that remains separated from corporate systems.

Juice — Distribution and logistics

Juice is a busy distribution site with warehouse workstations, shipping stations, phones, handheld devices, and network-connected operational equipment. The site operates early and late shifts, so outages outside normal office hours can still interrupt the business.

The site is especially sensitive to poor documentation because visiting technicians may be asked to troubleshoot equipment without help from the person who installed it.

Pulp — Product development and quality testing

Pulp is the newest site. It contains offices, test kitchens, small production equipment, security devices, and temporary workspaces for visiting employees. The site changes frequently as equipment and projects move in and out.

Pulp needs a network that can accommodate change without sacrificing segmentation or supportability.

How the network reached its current state

Each location was originally opened under time pressure. Switches were purchased when needed, local vendors made one-off changes, and documentation varied from site to site. Some settings are sensible, some are outdated, and some exist because “that was the only way it worked at the time.”

As the company grew, several recurring problems appeared:

• Device names and interface descriptions were inconsistent.
• Management addressing was not applied uniformly.
• Unused ports were not always secured.
• Voice, guest, security, and corporate devices were sometimes mixed together.
• Configuration backups were incomplete or difficult to locate.
• Branch troubleshooting depended too heavily on individual memory.
• Firewall rules accumulated without clear documentation.
• Remote connectivity was built for immediate needs rather than a common design.

No major incident triggered the current project. Leadership instead recognized that the company had reached the point where informal practices created unacceptable operational and security risk.

The Citrus Refresh project

Orange and Peel has launched an internal modernization effort called Project Citrus Refresh. The project will standardize the network at all four sites while allowing the business to remain operational.

The project goals are to:

• Apply the approved switch standards consistently.
• Separate Corp, Voice, Netman, Guest, and optional Security traffic.
• Give every network device a predictable identity and management address.
• Introduce consistent firewall routing and security policy.
• Preserve local guest internet access without exposing internal systems.
• Connect the branches securely to Grove.
• Improve configuration backups, diagrams, and troubleshooting records.
• Make the environment supportable by any qualified technician.

Your role

You are the Tier 1 technical team assigned to Project Citrus Refresh. Each technician owns one site throughout the project

Your responsibility is broader than making the equipment work. Every configuration must follow the standard, every change must be verifiable, and every site must be left in a state that another technician can support.

Over the coming weeks, you will:

1. Standardize and configure the site switch.
2. Validate a peer's deployment and resolve Layer 2 incidents.
3. Introduce Layer 3 gateways and routing.
4. Enforce firewall segmentation and outbound-access requirements.
5. Connect the branches securely to Grove.

Project Citrus Refresh is successful when the network works as designed, prohibited traffic fails for the intended reason, and the team can explain the complete traffic path from an endpoint at a branch to a service at headquarters.

Week 1 Discussion Problem — A Switch for Every Site

The situation

Orange and Peel is beginning Project Citrus Refresh. The company has one headquarters at Grove and branch offices at Zest, Juice, and Pulp. Each location has received a spare switch that will eventually support employees, phones, guests, network management, and—in some locations—security equipment.

The switches were pulled from storage. Nobody is willing to guarantee what configuration is currently on them. Some may have old names, old VLANs, outdated management settings, or configuration left behind by a previous project.

Orange and Peel wants all four sites to follow the same switch standard. A technician visiting an unfamiliar site should be able to identify the switch, understand its port usage, manage it securely, and locate a usable backup without relying on the original installer.

At this stage, no firewall or router has been installed. The immediate goal is to create a safe, consistent Layer 2 foundation.

Business requirements

• Employee devices, phones, guests, network management, and optional security equipment have different business purposes.
• Guest devices must not share the same Layer 2 environment as company devices.
• Network-device management must be kept separate from normal user traffic.
• Phones must be supported without requiring a completely separate physical switch.
• Unused ports must not provide unapproved network access.
• Device identity and interface purpose must be obvious to another technician.
• Management must use approved secure methods.
• The configuration must survive a reboot and be recoverable if the switch fails.
• The design should be repeatable at future sites.

Questions for the group

1. What should be inspected and recorded before changing an unknown switch?
2. Which groups of devices should share a broadcast domain, and which should be separated?
3. What logical networks are required at every site? Which one is conditional?
4. How can a phone and a workstation use the same physical edge location while remaining logically separated?
5. What information should a hostname communicate?
6. What information belongs in an interface description?
7. How should the switch itself be managed?
8. What should happen to ports that are not currently assigned?
9. What protections reduce the risk of an accidental Layer 2 loop?
10. What must be included in the trunk to the future firewall?
11. What should a technician verify before declaring the switch ready?
12. What evidence would prove that the saved configuration is usable?

Produce a high-level design

As a group, sketch one site and identify:

• Endpoint categories
• Proposed Layer 2 boundaries
• Access-port types
• The future firewall uplink
• The management path
• Required standards controls
• Verification points

Do not write device commands yet. The purpose is to agree on what the network must accomplish and why.

Information to request

Before implementation, list the details you would need from the network standard or project owner. Consider naming, VLANs, management addressing, authentication, monitoring, time, logging, trunking, STP, unused ports, backups, and approved software.

Week 1 — Layer 2 Fundamentals and Switch Standards

Scenario

Orange and Peel is preparing four sites for deployment. Each technician has received a spare switch with an unknown or incomplete configuration. The switch must be brought into compliance with company standards before it can be installed.

Objectives

By the end of the session, participants should be able to:

• Explain basic Ethernet switching, MAC learning, broadcasts, VLANs, trunks, and STP.
• Locate and interpret the Orange Pod switch standards.
• Establish console access and identify the switch's current state.
• Apply a standards-compliant baseline without losing management access.
• Verify and back up a configuration.

Suggested duration

120 minutes

Equipment

• One switch and console cable per participant
• One test endpoint per participant
• Patch cables
• Approved switch standards and configuration template
• Terminal-emulation software
• A safe configuration-backup location

Site assignments

Agenda

1. Baseline Q&A — 30 minutes

Use short scenarios instead of trivia questions. Mark each topic as comfortable, partial, or unfamiliar.

1. What is layer 2 ?
2. How does a switch learn its MAC-address table?
3. What happens when the destination MAC address is unknown?
4. What is a broadcast domain?
5. What problem does a VLAN solve?
6. What is the difference between an access port and a trunk?
7. Why must both ends of a trunk agree about VLAN tagging?
8. What is a native or untagged VLAN?
9. What does STP protect the network from?
10. Why can two hosts in different VLANs not communicate through a Layer 2 switch alone?

2. Standards walkthrough — 30 minutes

For each applicable company standard, cover the required setting, its purpose, and the verification method.

• Device and domain naming
• Management VLAN and address
• Firmware Updates
• Interface Configuration
• Access- and trunk-port conventions
• Allowed and native VLAN expectations
• STP mode and edge-port protections
• Configuration storage and backup

Do not place real production secrets in the lab configuration.

3. Guided configuration — 45 minutes

Participants should:

1. Connect through the console.
2. Record model, serial number, software version, and existing state.
3. Reset the device.
4. Apply the assigned hostname and domain configuration.
5. Create VLANs 10, 100, 220, and 250.
6. Create VLAN 210 only when directed.
7. Configure the switch management interface as .5/24 in VLAN 220.
8. Configure the future default gateway as .1 in the Netman network.
9. Apply approved access, authentication, logging, time, monitoring, and security standards.
10. Save and export the configuration.

4. Verification and closeout — 15 minutes

Each participant demonstrates:

• The correct device identity
• The correct VLAN configuration
• The correct Netman address
• Secure administrative access
• Successful configuration save

Instructor notes

• The firewall is not present yet. A temporary test host in VLAN 220 may be used to verify management connectivity.
• Do not require inter-VLAN communication during Week 1.
• Ask participants to explain why each setting exists instead of simply reading configuration lines.
• Record weak Q&A topics so they can be revisited in Week 2.

Week 1 Homework — Build the Orange and Peel Access Switch

Assignment

Finish the standards-compliant Layer 2 configuration for your assigned site. The result must be understandable and supportable by another technician.

Required VLANs

Required work

• Complete every applicable item in the company switch standard.
• Use the assigned FQDN.
• Configure the switch as .5/24 in the site's Netman network.
• Configure .1 as the future Netman gateway.
• Add clear descriptions to every active or reserved interface.
• Configure the future firewall uplink as a trunk.
• Restrict the trunk to the approved site VLANs.
• Apply the approved native/untagged VLAN standard.
• Apply approved STP edge and loop-protection features.
• Secure or disable all unused interfaces according to standards.
• Save the running configuration to startup configuration.
• Export a dated configuration backup.

Verification

Capture the platform-equivalent output showing:

• Device identity and software version
• VLANs and VLAN names
• Access-port assignments
• Trunk state and allowed VLANs
• Management IP and default gateway
• Interface status and descriptions
• MAC-address learning from a connected endpoint
• Running and saved configuration state

Submission

Submit:

1. The sanitized configuration backup.
2. A port map.
3. Verification output.
4. A standards checklist marked Pass, Fail, or Not applicable.
5. A short explanation of why hosts in different VLANs cannot communicate yet.

Do not include reusable credentials, private keys, or production secrets.

Completion standard

Another technician should be able to audit the switch, identify every connected device, and restore the switch from the submitted documentation.