# Phase 1: Network Migration — Move All Devices to INTERNAL VLAN 20

**Goal:** Consolidate all staff PCs and printers onto INTERNAL VLAN 20 (10.0.20.x / CSCNet WiFi). During migration, old permissive rules keep both networks talking. After migration, lock down with scoped rules.

---

## Current State (as of 2026-03-09)

- Staff PCs: mix of CSCNet WiFi (INTERNAL, 10.0.20.x) and CSC ENT / wired (LAN, 192.168.x.x)
- Printers: all wired on LAN (192.168.x.x) except accounting assistant (10.0.20.220) and 206 nurse station (10.0.20.69)
- CS-SERVER: 192.168.2.254 (LAN) — stays on LAN
- Synology: 192.168.0.120 (LAN) — stays on LAN
- Old permissive rules (INTERNAL→LAN pass-all, floating rule #4) allow all traffic between networks

## pfSense Aliases (created 2026-03-09)

| Alias | Type | Members | Status |
|-------|------|---------|--------|
| `Server_IPs` | Host(s) | 192.168.2.254 | Created |
| `NAS_IP` | Host(s) | 192.168.0.120 | Created |

Built-in `_private4_` alias (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) will be used instead of custom RFC1918.

---

## ~~Phase 1.1 — Guest VLAN~~ DONE 2026-03-06

All completed:
- [x] pfSense: VLAN 50, GUEST interface (10.0.50.1/24), DHCP scope (10.0.50.50–239)
- [x] pfSense: 4 firewall rules (block LAN, block 10.x, block 172.x, pass internet)
- [x] UniFi: Guest network created (VLAN 50, third-party gateway)
- [x] UniFi: Guest SSID reassigned from Default to Guest network
- [ ] **Onsite test needed:** Verify guest gets 10.0.50.x IP, internet works, cannot reach 192.168.x.x or 10.0.20.x

---

## ~~Phase 1.2 — DNS forwarding~~ DONE 2026-03-06

- [x] pfSense domain overrides: `cascades.local` → 192.168.2.254, `_msdcs.cascades.local` → 192.168.2.254
- [x] CS-SERVER DNS client: fixed to 127.0.0.1, 192.168.0.1
- [x] Stale DNS records removed, correct records added
- [x] Reverse lookup zones created (5 zones)
- [x] DNS scavenging enabled (7-day)
- [x] CS-SERVER DNS forwarder confirmed as 192.168.0.1

---

## ~~Phase 1.3 — Quick fixes~~ MOSTLY DONE

- [x] Room 218 DHCP range fixed — DONE 2026-03-07
- [x] Room 130 stale rule deleted — DONE 2026-03-07
- [x] CS-SERVER timezone fixed — DONE 2026-03-07
- [ ] UniFi: Delete unused VLAN 10 ("CSC Internal Network")

---

## Phase 1.4 — Migrate Staff PCs to CSCNet (INTERNAL VLAN 20)

**Do first** — PCs are easy to move (just connect to CSCNet WiFi). No downtime, no re-IPing needed.

### PCs Currently on LAN (need to move to CSCNet WiFi)

| PC | Current IP | User(s) | Priority | Notes |
|----|-----------|---------|----------|-------|
| RECEPTIONIST-PC | 192.168.2.17 | CJ, Christina, Kyla, Tiffany | Medium | Front desk — high traffic |
| RECEPTIONIST-PC (2nd) | 192.168.3.187 | Receptionist | Low | Determine if still in use |
| ASSISTMAN-PC | 192.168.2.38 | Assistant Manager | Low | |
| ASSISTNURSE-PC | 192.168.2.153 | Assist Nurse | Low | |
| NURSESTATION-PC | 192.168.3.135 | Nurse Station | Low | |
| MEMRECEPT-PC | 192.168.3.41 | MemCare Reception | Low | |
| ANN-PC | 192.168.3.252 | Ann | Low | |
| MDIRECTOR-PC | 192.168.3.20 | Shelby Trozzi | Low | Win10 Home — needs Pro upgrade first for domain join |
| DESKTOP-LPOPV30 | 192.168.2.250 | Unknown | Low | |
| DESKTOP-U2DHAP0 | 192.168.3.37 | Unknown | Low | |
| DESKTOP-TRCIEJA | 192.168.3.93 | Unknown | Low | |
| DESKTOP-DLTAGOI | 192.168.3.133 | Unknown | Low | |
| DESKTOP-ROK7VNM | 192.168.3.148 | Unknown | Low | |
| DESKTOP-MD6UQI3 | 192.168.3.208 | Unknown | Low | |

### PCs Already on INTERNAL (no action needed)

| PC | IP | User(s) |
|----|-----|---------|
| CRYSTAL-PC | 10.0.20.205 | Crystal Rodriguez |
| ACCT2-PC | 10.0.20.209 | Accounting |
| CHEF-PC | 10.0.20.232 | Chef/Kitchen |
| DESKTOP-H6QHRR7 | 10.0.20.235 | Unknown |
| DESKTOP-KQSL232 | 10.0.20.227 | Unknown |
| DESKTOP-VAVKCIM | 10.0.20.239 | Unknown |

### Process for each PC (WiFi move)
1. Connect PC to **CSCNet** WiFi (if not already)
2. Forget/remove **CSC ENT** WiFi profile
3. Verify PC gets 10.0.20.x IP
4. Verify can reach CS-SERVER (`ping 192.168.2.254`)
5. Verify can reach printers (still on LAN — works due to permissive rules)
6. Verify internet works

---

## Phase 1.5 — Migrate Printers to INTERNAL VLAN 20

**Do after PCs** — requires changing UniFi switch port VLAN, printers get new IPs, must update printer config on all PCs.

### Printer Migration Order (least impact first)

| Order | Printer | Current IP | Switch Port | Users | Impact |
|-------|---------|-----------|-------------|-------|--------|
| 1 | Chef Brother | 192.168.3.88 | TBD | Chef | 1 user |
| 2 | Kitchen Manager Canon | 192.168.3.232 | TBD | Alyssa | 1 user |
| 3 | Meredith's Canon | 192.168.2.67 | TBD | Meredith | 1 user |
| 4 | MemCare Director Canon | 192.168.3.52 | TBD | Shelby | 1 user |
| 5 | MemCare MedTech Brother | 192.168.2.53 | TBD | MemCare MedTechs | Low |
| 6 | Room 103 Brother | 192.168.2.145 | TBD | Ashley, Christina | 2 users |
| 7 | Room 132 Canon | 192.168.3.211 | TBD | Sharon, Susan | 2 users |
| 8 | Room 217 Sales Brother | 192.168.3.44 | TBD | Sales team | ~4 users |
| 9 | Room 206 Bizhub | 192.168.1.138 | TBD | Health Services | Medium |
| 10 | Accounting Canon | 192.168.3.227 | TBD | Lauren | Accounting — careful |
| 11 | Front Desk Epson | 192.168.2.147 | TBD | 4 users | High traffic |
| 12 | Copy Room Canon | 192.168.2.230 | 1st Floor USW Port 45 | Everyone | **LAST — highest impact** |

### Already on INTERNAL (no action needed)

| Printer | IP | Notes |
|---------|-----|-------|
| Accounting Assistant Brother | 10.0.20.220 | Already on INTERNAL |
| 206 Nurse Station Brother | 10.0.20.69 | Fax only, already on INTERNAL |

### MemCare Reception Epson — needs hardwire first, then assign to VLAN 20

### Process for each printer
1. Identify switch port in UniFi
2. Change port VLAN/network to INTERNAL (VLAN 20)
3. Printer gets new 10.0.20.x IP via DHCP
4. Create DHCP reservation on pfSense for new IP
5. Update printer IP on all user PCs that print to it
6. Test print from each user

---

## Phase 1.6 — Lock Down (AFTER all devices migrated)

Only do this after all PCs and printers are on INTERNAL VLAN 20.

### Replace INTERNAL rules

Delete old "INTERNAL to LAN PASS" rule. Replace with:

| # | Action | Proto | Source | Dest | Ports | Description |
|---|--------|-------|--------|------|-------|-------------|
| 1 | PASS | TCP/UDP | INTERNAL net | Server_IPs | 53,88,135,389,445,464,636,3268,3269,5985,9389 | AD/DNS/SMB to DC |
| 2 | PASS | TCP | INTERNAL net | Server_IPs | 3389 | RDP to server |
| 3 | PASS | TCP | INTERNAL net | NAS_IP | 445,5000,5001 | Synology access |
| 4 | PASS | ICMP | INTERNAL net | LAN net | any | Ping diagnostics |
| 5 | BLOCK | IPv4 | INTERNAL net | _private4_ | any | Block other private (LOG) |
| 6 | PASS | IPv4 | INTERNAL net | any | any | Internet access |

### Disable floating rule #4

Replace with scoped room rule:
- PASS | ResidentsGroup | IPv4 | any → ! _private4_ | "Rooms internet only"

**DISABLE only — don't delete. Rollback: re-enable.**

### Delete LAN rule #1

Remove "INTERNAL net to LAN net via WAN_Group" — no longer needed.

### Retire CSC ENT SSID

After all devices confirmed on CSCNet, remove CSC ENT SSID from UniFi.

---

## Rollback

1. Re-enable floating rule #4
2. Re-enable old INTERNAL→LAN pass rule
3. Reconnect devices to CSC ENT if needed
4. Restore pfSense XML backup (Diagnostics → Backup & Restore)
