A VLAN (Virtual Local Area Network) splits one physical network into separate logical networks, each its own broadcast domain, using IEEE 802.1Q tags on switch ports and trunk links. MetroTech gave each department (Computer Science, Engineering, Business Administration, Medicine, Law) its own VLAN. Performance: broadcasts (such as ARP (Address Resolution Protocol) requests) stay inside one department instead of flooding all 600+ devices, so less bandwidth is wasted and switches work less; each VLAN maps to its own subnet, which tidies IP addressing; and traffic can be prioritised per VLAN with QoS. Security: devices in one VLAN cannot reach another without passing through a router or Layer 3 switch, where access control lists and the firewall decide what is allowed. So a compromised student laptop in a lab cannot directly reach the exam results server or medical records. Limits: VLANs are segmentation, not encryption; misconfigured trunks allow VLAN hopping, so unused ports should be shut and the native VLAN changed. Judgement: VLANs were a low-cost, high-impact step that supported both the 70% performance gain and the drop in unauthorised access.

Availability is one of the five security principles: the service must be reachable when needed. Before the redesign, the network had no failover, so one failed link or switch took the portal down. Redundancy means duplicate links to the core switch, duplicate power and spare servers, so if one path fails another takes over automatically (helped by protocols such as STP (Spanning Tree Protocol) for switch loops, or a first-hop redundancy protocol for gateways). Load balancing spreads requests across several portal servers, so no single server is overwhelmed when thousands of students log in at 9 a.m. on exam day. Together they produced 99.99% uptime, which is under an hour of downtime a year. Costs and limits: duplicate equipment and links cost money; more devices mean more configuration and monitoring; the load balancer itself must be redundant or it becomes a new single point of failure; and redundancy does not stop a DDoS (Distributed Denial of Service) attack or a software bug that affects every server. Judgement: for an exams portal, where an outage means students cannot sit exams, the cost is clearly justified. Recommend testing failover before each exam season and monitoring server load in real time.

MetroTech already has firewalls, VPNs, an IDS and Zero Trust. Further steps, each tied to a threat: (1) move from an IDS (which only alerts) to an IPS (Intrusion Prevention System) that blocks attacks in real time; (2) MFA for all staff and admin accounts against phishing and stolen passwords; (3) WPA3-Enterprise with 802.1X authentication on campus Wi-Fi so each user logs in with their own credentials; (4) NAC (Network Access Control) to check student devices for updates and antivirus before they join; (5) encrypt sensitive data at rest and in transit (TLS for the portal, AES (Advanced Encryption Standard) for stored records); (6) a SIEM (Security Information and Event Management) system to correlate logs; (7) DDoS protection from the ISP (Internet Service Provider) or a cloud provider before exams; (8) regular patching, vulnerability scans and penetration tests; (9) security awareness training, since staff and students are the main phishing targets; (10) tested backups against ransomware. Evaluation: these cost money and staff time, and too many controls can frustrate users, so prioritise by risk, starting with MFA, patching and backups. Under the NDPA (Nigeria Data Protection Act) 2023 the university must protect student personal data, so these are also compliance steps.

In a star topology every device or department connects to a central node (here the core switch). It was chosen because it gives central control (one place to manage and monitor), easy fault isolation (a broken cable affects only one link), easy expansion (add a new department by adding a link) and good performance because each link is dedicated. Its main weakness is that the central node is a single point of failure: if the core switch fails, every department loses connectivity. It also needs more cable than a bus, and the central switch must have enough capacity for all traffic. MetroTech addressed the main weakness with redundant links and a redundant core, which in practice makes it an extended star or hybrid design. Judgement: star with redundancy is the right choice for a campus; a full mesh would be more resilient but far too costly in links.

(1) Requirements gathering with each department to learn bandwidth needs and critical applications, so the design solves the real problem. (2) Network design and deployment using VLAN segmentation, redundancy and security protocols, turning requirements into logical and physical designs. (3) Testing and evaluation, especially load testing the exams portal for peak traffic, so failures are found before students meet them. (4) Training and documentation for staff and faculty, because a network nobody understands is soon misconfigured. (5) Ongoing monitoring and maintenance to spot problems early and plan capacity. These match the design process in Session 1. Skipping any phase risks a network that works on paper but fails on exam day.

SDN (Software-Defined Networking) separates the control plane (deciding where traffic goes) from the data plane (forwarding packets) and moves control into a central SDN controller, which programs the switches through a southbound protocol such as OpenFlow. At UNTech this meant: flexibility, because the IT team changed traffic policies for the whole campus from one console instead of logging into each switch, and could program rules that give the exam portal priority during exams; scalability, because new students, services or switches could be added and given policies automatically, without redesigning the network; and dynamic resource allocation, which fixed the old problem of idle capacity at quiet times and congestion at peaks. Applications can ask the controller for resources through the northbound API. The result was 50% better responsiveness during peak periods. Limit: the controller is critical, so it must be duplicated and protected.

UNTech used VLANs to separate academic, administrative and guest traffic. Security benefits: guests on Wi-Fi cannot see the finance or records systems; an infection in a student lab is contained to its segment; firewall rules between segments enforce least privilege; it supports Zero Trust by making every cross-segment request pass a check. Performance benefits: smaller broadcast domains, less congestion, and the ability to apply QoS per segment so academic and exam traffic gets priority over guest streaming. Limits: segmentation is only as good as the rules between segments; too many VLANs are hard to manage by hand (which SDN helps with); VLANs do not encrypt; and misconfigured trunks allow VLAN hopping. Counter-point: micro-segmentation in SDN can go further than VLANs by setting policy per device or per application. Judgement: VLAN segmentation is essential and cheap, and combined with SDN and Zero Trust it gave UNTech both protection for sensitive data and smoother access during exams.

Challenges: (1) Skills gap: SDN, cloud and automation need programming and new skills that traditional network staff may lack. Address with training, certification and hiring. (2) Controller as a single point of failure and attack target. Address with clustered controllers, strict access control and monitoring. (3) Cost of cloud subscriptions, licences and upgrades. Address with capacity planning, monitoring usage and negotiating education discounts. (4) Vendor lock-in with one SDN or cloud vendor. Address with open standards such as OpenFlow and multi-vendor designs. (5) Evolving threats. Address with regular patching, IPS, SIEM and security audits. (6) Growth in students and online programmes. Address with ongoing monitoring and periodic redesign reviews. (7) Power and internet reliability in Nigeria. Address with UPS (Uninterruptible Power Supply), generators and two ISPs. Judgement: none of these is a reason to abandon SDN, but UNTech must budget for people and operations, not just equipment.

Students learning from home connect over the internet to services that may sit on campus or in the cloud. SD-WAN applies SDN ideas to the wide area: a central controller chooses the best path (fibre, microwave, 4G or 5G) for each application in real time and sends exam and video-class traffic over the most reliable link. The campus SDN controller and the cloud provider's network can share policies, so a lecturer's live class or an online exam gets priority end to end. Cloud services scale up automatically during exams and back down afterwards, so UNTech pays only for what it uses. Content can be cached at the edge or in a nearby cloud region to cut latency for students across Nigeria. Security must follow the user: Zero Trust access, MFA and TLS encryption instead of trusting anyone "inside" the network. Risks: dependence on internet quality at the student's end, cloud costs and data protection compliance. Result: a consistent experience whether the student is on campus or at home.

UNTech already uses Zero Trust, VPNs, IDS/IPS and firewalls. Add: MFA for every account; micro-segmentation through the SDN controller so each application has its own policy; hardening the SDN controller (separate management network, encrypted controller-to-switch traffic with TLS, role-based admin access, controller clustering); a SIEM for central log analysis; DDoS protection for the exams portal; cloud security posture management to catch misconfigured cloud storage; regular penetration testing; encrypted backups held off-site; and staff and student awareness training. Each step should be prioritised by risk and checked against the NDPA 2023 duty to protect personal data.

The OSI (Open Systems Interconnection) model has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. The TCP/IP model has four: Network Access (Link), Internet, Transport, Application. Mapping: OSI Physical and Data Link equal TCP/IP Network Access; OSI Network equals Internet (IP); Transport matches Transport (TCP and UDP (User Datagram Protocol)); OSI Session, Presentation and Application combine into TCP/IP Application (HTTP, DNS, SMTP). Differences: OSI is a reference model designed before the protocols; TCP/IP grew from working protocols and is what the internet actually runs. Why both: OSI's finer layers are better for teaching and troubleshooting (engineers say "a Layer 2 problem" or "a Layer 7 firewall"); TCP/IP describes the real protocol stack. Example: when a Lagos bank's mobile app fails, an engineer works up the layers: is the cable or Wi-Fi up (Layer 1), is the device getting an IP address (Layer 3), is the port open (Layer 4), is the app responding (Layer 7).

Factors from the course: size and number of users at each site; cost of cabling and equipment; reliability needed (patient systems must not go down); scalability for future wards and sites; performance for imaging files and video consultations; ease of management and fault isolation; security for patient records; and the physical layout of the buildings. Applying them: inside each site, a star or extended star with redundant core switches gives central control and easy fault finding; between sites, a partial mesh WAN (Wide Area Network) with two links per site (for example fibre plus microwave or 4G) avoids one cut cable isolating a hospital; a full mesh would be most resilient but costly as sites grow (n(n−1)/2 links). Design steps: gather requirements from clinicians and IT, produce a logical design (VLANs, IP plan, security zones), then a physical design (cabling, equipment, rooms), test, train and monitor. Recommendation: hierarchical design with redundancy at the core and between sites, VLANs separating clinical, admin and guest traffic, and a monitoring system. Judgement: reliability outweighs cost for a hospital.

IPv4 uses 32-bit addresses (about 4.3 billion), and the free pool has run out, which forces heavy use of NAT (Network Address Translation) and private ranges. IPv6 uses 128-bit addresses written in hexadecimal (for example 2001:db8::1), giving an almost unlimited supply, which matters as mobile subscribers and IoT (Internet of Things) devices in Nigeria grow. Other benefits: simpler headers for faster processing, built-in address autoconfiguration, and no need for NAT so end-to-end connections are easier. Challenges: old devices and software that only support IPv4; staff unfamiliar with IPv6 addressing; cost of upgrades; security tools that must be updated to inspect IPv6 traffic; and running both at once. Transition methods: dual stack (devices run both), tunnelling (IPv6 carried inside IPv4) and translation. Recommendation: start with dual stack on new equipment, train staff, and require IPv6 support in every purchase.

Static routing: an administrator types each route by hand. It is simple, uses no bandwidth or CPU for updates, and is predictable and secure, but does not adapt to failures and becomes unmanageable as the network grows. Dynamic routing: routers share information using a protocol and recalculate paths automatically when a link fails. RIP (Routing Information Protocol) uses hop count, maximum 15 hops, and converges slowly; OSPF (Open Shortest Path First) is a link-state protocol using a bandwidth-based cost, converges fast and scales with areas; EIGRP (Enhanced Interior Gateway Routing Protocol) is fast but historically vendor-specific; BGP (Border Gateway Protocol) connects separate organisations and ISPs. For 40 branches: static routes would mean hundreds of manual entries and no automatic failover, which is unacceptable for banking. Recommend OSPF inside the bank, with branches in areas around a backbone at head office, two WAN links per branch so OSPF can reroute in seconds, and BGP only at the internet edge if the bank uses two ISPs. A default static route at very small kiosks is still fine. Judgement: dynamic routing with OSPF gives the resilience banking needs.

Confidentiality: only authorised people can read data. Control: encryption such as AES or TLS. Integrity: data is not changed without detection. Control: hashing such as SHA-256 (Secure Hash Algorithm). Availability: systems are reachable when needed. Control: redundancy, load balancing, DDoS protection. Authentication: proving who a user or device is. Control: MFA, certificates through PKI (Public Key Infrastructure). Non-repudiation: a sender cannot deny sending a message. Control: digital signatures. Example: a fintech transfer is encrypted (confidentiality), hashed (integrity), served by redundant servers (availability), approved with a password and one-time code (authentication), and digitally signed (non-repudiation).

WEP (Wired Equivalent Privacy) used RC4 with short, reused keys and can be cracked in minutes. WPA (Wi-Fi Protected Access) added TKIP as a stop-gap. WPA2 brought AES encryption and became the standard for years, but its pre-shared key mode is open to offline password guessing and the KRACK attack. WPA3 adds SAE (Simultaneous Authentication of Equals), which resists offline guessing, forward secrecy, and stronger 192-bit options in Enterprise mode, plus encryption on open networks. For a hotel: separate SSIDs and VLANs for guests, staff and payment systems; WPA3 (with WPA2 transition mode for older guest phones); a captive portal for guests; WPA3-Enterprise with 802.1X for staff; client isolation so guests cannot see each other; firewall rules blocking guest access to internal systems; and an IPS. Judgement: WPA3 is clearly better, but the bigger risk in hotels is poor segmentation, so VLANs and isolation matter as much as the encryption standard.

Latency is the delay for data to travel from sender to receiver, in milliseconds. It has four parts: propagation (distance), transmission (pushing bits onto the link), processing (devices examining packets) and queuing (waiting in buffers during congestion). Throughput is the actual amount of data delivered per second, which is usually lower than the link's bandwidth (its capacity). Packet loss is the share of packets that never arrive, caused by congestion, faulty hardware or interference. For a telemedicine call between a doctor in Lagos and a patient in Kano: high latency causes talk-over and delays; low throughput forces blurry video; packet loss causes frozen frames and broken audio; and jitter (variation in delay) makes speech choppy. Targets for good voice and video are roughly under 150 milliseconds one-way latency, under 30 milliseconds jitter and under 1% loss. Fixes: QoS priority for video, more bandwidth, and edge servers closer to users.

Monitor first. Use SNMP to poll routers and switches for interface use, errors and CPU load; NetFlow or similar flow records to see which applications use the bandwidth; packet capture (for example Wireshark) for deep troubleshooting; and synthetic tests that measure latency, jitter and loss every few minutes. Set baselines and alerts. Then apply QoS. The course gives three models: best effort (no guarantees), IntServ (Integrated Services, reserves resources per flow with RSVP (Resource Reservation Protocol), precise but does not scale), and DiffServ (Differentiated Services, marks packets into classes with DSCP values, scales well). Recommend DiffServ: classify traffic, mark voice as the top class, use priority queuing for voice with weighted fair queuing for the rest, police or shape bulk downloads, and use congestion avoidance so queues do not overflow. Evaluation: QoS shares out existing capacity but cannot create more; if links are always full, the operator must add capacity. Measure success by call drop rate, jitter and customer complaints.

SDN has three layers. The application layer holds programs such as load balancers, firewalls and monitoring tools. The control layer is the SDN controller, the "brain" with a network-wide view that decides how traffic should flow. The infrastructure (data) layer is the switches and routers that simply forward packets. Applications talk to the controller through the northbound API; the controller talks to switches through the southbound API. OpenFlow is the best-known southbound protocol: the controller installs entries in each switch's flow table, each with match fields (for example source IP or port), actions (forward, drop, modify, send to controller) and counters. When a packet matches no entry, the switch can ask the controller what to do. This is how one change in the controller reaches every switch in seconds.

IBN (Intent-Based Networking) builds on SDN: administrators state a business goal (the intent), such as "branch tellers may reach the core banking system but not the internet", and the system translates it into configuration, applies it everywhere, and continuously checks that the network still matches the intent, fixing drift automatically using analytics and machine learning. For: faster changes across hundreds of branches; fewer human errors, which cause many outages; continuous compliance evidence for CBN (Central Bank of Nigeria) audits; quicker detection of problems. Against: high cost of platforms and licences; needs SDN-capable equipment, so older branch devices may need replacing; staff need new skills; dependence on one vendor; and automation that misreads an intent can spread an error everywhere at once. Judgement: adopt in phases, starting with the head office and data centre, keep human approval for high-risk changes, require open standards, and train staff. For a large bank the reduced outages and audit benefits outweigh the cost; for a small microfinance bank, simpler SDN or good manual processes may be enough.

Network virtualisation (NV) creates several logical networks on one physical network, so each tenant or department appears to have its own network (for example VLANs, VXLAN (Virtual Extensible LAN) overlays). Example: UNTech separating academic, admin and guest networks on the same switches. NFV (Network Functions Virtualisation) takes functions that used to need dedicated hardware boxes, such as firewalls, routers, load balancers and the parts of a mobile core, and runs them as software (VNFs, Virtual Network Functions) on standard servers. Example: a mobile operator in Nigeria running its firewall and 5G core functions as VNFs in its data centre, scaling them up during festive-season traffic. In short, NV virtualises the network itself; NFV virtualises the devices on it. SDN often controls both.

5G offers three service types: eMBB (enhanced Mobile Broadband) for high-speed video, URLLC (Ultra-Reliable Low-Latency Communications) for near-instant control with latency under 1 millisecond, and mMTC (massive Machine-Type Communications) for up to a million sensors per square kilometre. Network slicing lets the operator run separate virtual networks on the same infrastructure, each with its own guarantees. Edge computing processes data close to where it is produced instead of in a distant cloud. Uses in Lagos: traffic cameras analysed at the edge to adjust signals in real time (URLLC plus edge); flood and air-quality sensors (mMTC); live CCTV for emergency services (eMBB on a dedicated slice); smart meters for electricity distribution. Challenges: high cost of dense small cells and fibre backhaul; unreliable power; spectrum costs; security of millions of IoT devices; data protection under the NDPA 2023; and the digital divide if only rich areas are covered. Judgement: strong potential, but start with targeted pilots (traffic and flood monitoring), partner with operators, secure devices from the start, and plan coverage fairly. 6G (around 2030) promises AI-native networks and even lower latency, but 5G with edge is what can be deployed now.