Enterprise Healthcare Network
Modernization Proposal

This document is a scenario-based technical work sample for the Network Engineer 3 role at BMC: a campus network infrastructure assessment and modernization proposal for a multi-site hospital environment.

It covers network design, security segmentation, SD-WAN, wireless, monitoring, change management, and automation, with every section mapped to a direct requirement in the job description.

Current Network Topology

Key Issues Found

Target Topology

Network Segmentation Plan

Zone Architecture

Firewall Policy Approach

• Default Deny All between zones; explicit permit only.
• Use App-ID instead of port-based rules: allow epic-ehr application, not just TCP/443.
• User-ID integration with Active Directory: policies apply to user groups, not IPs.
• Threat Prevention on all inter-zone rules; WildFire for unknown file inspection.

# Clinical-to-Datacenter Rule
Rule: Allow-EHR-Access
  Source Zone:      CLINICAL
  Destination Zone: DC
  Application:      epic-ehr, ssl
  Service:          application-default
  Source User:      domain\clinical-staff
  Action:           Allow
  Profile:          Threat-Prevention-Strict
  Log:              Yes (forward to Panorama)

High Availability Config

set deviceconfig high-availability enabled yes
set deviceconfig high-availability group 1 mode active-passive
set deviceconfig high-availability group 1 peer-ip 10.0.99.2
set deviceconfig high-availability group 1 election-option heartbeat-backup enabled yes
set deviceconfig high-availability group 1 state-synchronization enabled yes

What Was Wrong

Silver Peak was running on default settings with no smart routing. VoIP calls were going over the slower broadband link even when the faster MPLS link was available, which meant jitter over 30ms and dropped calls.

Traffic Routing Policies

Results After the Fix

RF and AP Design

• Conducted Ekahau site survey for each floor/wing before AP placement.
• Deployed Aruba AP-635 (Wi-Fi 6, tri-radio) in high-density clinical areas; AP-515 in corridors.
• Configured band steering to push capable clients to 5 GHz; airtime fairness enabled.
• Transmit power set to auto with guard rails (7 dBm min, 18 dBm max) to prevent co-channel interference.

SSID Design

Access Control Policy

Authentication:
  1. EAP-TLS (device certificate) → AD computer object check
  2. PEAP-MSCHAPv2 fallback (user credentials) → AD group membership check

Authorization Rules:
  IF [AD-Group = "Clinical-Staff"] AND [Device-Cert = Valid]
    → VLAN 100, dACL: permit-clinical-apps

  IF [AD-Group = "Contractor"] AND [Device-Cert = None]
    → VLAN 500 (Guest), redirect to IT approval portal

  IF [MAC = known-IoT-device-list]
    → VLAN 300, dACL: permit-dst-only 10.40.0.0/16

  Default:
    → DENY / quarantine VLAN

What We Monitor

• SolarWinds NPM: All network nodes, SNMP v3 only (v1/v2c disabled for security).
• SolarWinds NTA (NetFlow): NetFlow v9 from all distribution switches; top-talker analysis per VLAN.
• SolarWinds NCM: Automated nightly config backups; compliance checking (no telnet, SSH v2 enforced).
• Airwave / Aruba Central: Wireless health dashboards; client roaming analysis; rogue AP alerting.

Alert Thresholds

Pre-Change Checklist

• Nexus 9508 staged and tested in lab with production config
• All interface configs migrated and peer-reviewed by second engineer
• SolarWinds NCM config backup of 6500 captured (timestamped)
• Rollback tested in lab: old 6500 reconnected in <15 minutes
• On-call clinician IT liaison notified; Epic team on standby
• Maintenance mode set in SolarWinds (suppress alerts during window)
• Change approved by CAB; Network Lead sign-off confirmed

Implementation Steps

1. Confirm no active clinical procedures on affected segment (with charge nurse)
2. Enable maintenance mode in SolarWinds NPM
3. Gracefully migrate routing: redistribute routes to backup path
4. Disconnect 6500; patch fiber to Nexus 9508
5. Bring up Nexus 9508; verify BGP/OSPF adjacencies
6. Validate: ping all gateway IPs, verify EHR connectivity from test workstation
7. Monitor SolarWinds for 30 min; verify no alerts
8. Disable maintenance mode; then notify stakeholders once confirmed

Rollback Plan

Incident Timeline

Corrective Actions

• Immediate: Enabled BPDU Guard on all access ports campus-wide via automated NCM script.
• Short-term: ClearPass policy updated, non-802.1X ports auto-shut after 30 seconds.
• Long-term: Physical security audit of all IDF closets; keycard access required.
• Process: Added "unmanaged switch connected" to NOC Level 1 troubleshooting runbook.

1. DETECT
   - SolarWinds NPM critical alert: Core-A-NEXUS-01 unreachable
   - Confirm via physical check or OOB console (MGMT network)

2. ISOLATE
   - Confirm hardware (supervisor) vs software (process crash)
   - check: "show system resources" and "show module" via OOB console

3. FAILOVER (hardware failure confirmed)
   - Redundant supervisor: auto-failover (<30 sec with NSF/SSO)
   - Chassis failure: activate pre-staged spare Nexus 9508 in DR rack
     a. Load config from NCM backup (SCP from jump host)
     b. Reconnect fiber uplinks in IDF patch panel
     c. Verify: "show ip ospf neighbor" / "show bgp summary"
     d. Confirm EHR reachability from clinical test workstation

4. VALIDATE
   - Ping all 20 critical server IPs (/scripts/validate-core.sh)
   - Confirm SolarWinds shows all nodes green
   - Call charge nurse on each floor to confirm clinical access

5. COMMUNICATE
   - Update ServiceNow P1 incident every 15 minutes
   - Notify Network Lead and IT leadership
   - Post-incident RCA within 48 hours

The job description doesn't require scripting, but it's something I do naturally. Automating tedious, error-prone tasks at scale is how I think about infrastructure operations:

Nightly Compliance Script (Python + Netmiko)

from netmiko import ConnectHandler
import re

# Ensure all devices comply: SSH v2 only, no telnet, BPDU Guard on access ports
compliance_checks = [
    ("transport input ssh", "Telnet disabled"),
    ("ip ssh version 2", "SSH v2 enforced"),
    ("spanning-tree portfast bpduguard default", "BPDU Guard global"),
]

devices = [...]  # loaded from IPAM / SolarWinds asset list

for device in devices:
    conn = ConnectHandler(**device)
    config = conn.send_command("show running-config")
    for check, description in compliance_checks:
        status = "PASS" if re.search(check, config) else "FAIL"
        print(f"{device['host']} | {description}: {status}")
    conn.disconnect()

How My Background Connects

My title is DevOps Engineer, but a lot of what I've spent the last 6 years doing maps directly to this role. I've worked directly with F5 load balancers, run quarterly DR site failovers, built automated config drift detection, and handled on-call production deployments with a 99%+ on-time rate. Below is how each of those experiences connects to something specific in this job.