I build and run real network infrastructure on enterprise hardware — now going deep on security.
I'm Mihail Pascal — a career-changer moving into network and security operations. Nine years owning web, design and business outcomes taught me to finish things and stay calm under pressure. Now CCNA-certified, I run an enterprise-grade home lab I built, run, and rebuild every day.
A non-traditional path, on purpose.
No CS degree. Instead: a decade of owning real outcomes, and a lab that proves I can build and operate the real thing.
For most of the last decade I ran the business side of technology — I founded and led my own web and branding studios and worked as a UI/UX designer, frontend developer, and account manager. I owned the full lifecycle: finding clients, scoping, negotiating, delivering, and supporting what I shipped.
That work taught me things a certificate doesn't: how to communicate clearly with technical and non-technical people, how to stay calm when something is on fire, and how to take responsibility for an outcome rather than just a task.
In 2025 I started over in networking — from zero. I learn by doing, so I bought real enterprise gear and built a physical home lab I run and break every day: firewall configured end to end, the network segmented into purpose-based VLANs, dual-WAN with failover, and a full SOC learning stack to start developing blue-team skills. I'm honest about where I am — I've built real infrastructure, and I'm actively learning to operate it well.
An enterprise-grade lab I built, run, and learn on — every day.
The networking is production-style and runs my home for real. The security/SOC stack is a deliberate learning environment I stood up to study blue-team fundamentals — not professional experience. The achievement is building and operating real infrastructure, and learning on it honestly.
Default-deny between segments on the ASA, with explicit, logged exceptions. Wi-Fi segmented by SSID into matching VLANs.
- ›Dual-WAN PCC load balancing + failover (verified by simulating a WAN outage)
- ›NAT/masquerade · default-deny WAN input chain
- ›DNS forwarding to a filtering resolver over DNS-over-TLS
- ›Scheduled daily config backups · dynamic DNS
- ›SSH hardened, management restricted to the admin VLAN; Telnet/FTP/HTTP disabled
- ›End-to-end perimeter policy; inter-VLAN ACLs with explicit deny + logging
- ›No "permit ip any any" — least exposure by default
- ›NAT and per-VLAN sub-interfaces · basic threat detection
- ›Remote syslog to the SIEM · AAA · login banner · RSA 2048
- ›802.1Q VLAN trunking · STP with BPDU protection on edge ports
- ›Port security · LLDP · SNMP monitoring
- ›SSHv2-only management (Telnet/web disabled)
- ›Consistent NTP across every device
- ›Zabbix 7.0 LTS watching 14 hosts (~1,700 metrics) across the lab
- ›Agentless Proxmox + agents on Linux hosts + SNMP on ASA / MikroTik / Aruba
- ›Email alerting on high-severity events: host/link/service down, resource pressure
- ›Dashboards for dual-WAN ISP throughput and device health
Centralized syslog from the firewall, switch and router feeds the SIEM, with email alerting on high-severity events. This stack is how I practice — not production or professional experience.
Cabled to be maintained — not just to work.
Rack-mounted with structured cabling: a modular patch panel, labeled and color-coded runs, and PoE to the access points and cameras — built to stay readable a year from now, not just to work today.
PacketFlow
web-based network simulatorA modern, fully web-based network simulator I built (with AI assistance) as a cleaner, more usable alternative to Packet Tracer and GNS3 — no installation, accessible from anywhere, with a modern UI.
I built it primarily for my own studying, then made it freely available for others. It doubles as a place to sketch and validate the topologies I run in the lab.
Where I am, and where I'm headed.
Write-ups from the lab.
build notes · concepts · later, incident triageA flat network is one compromised device away from total compromise. Here's how I segmented my home lab into six purpose-based zones, and the reasoning behind each decision.
Perimeter policy, inter-VLAN ACLs, NAT and the mistakes I made getting there.
Wazuh, Suricata, TheHive and Velociraptor — how the pieces fit, from a learner's view.