Starnet Metro Ethernet

A local school district was running an on-prem Cisco ASA paired with a WebSense URL filter — a stack that was aging, hard to modernize, and increasingly outflanked by students who'd figured out how to circumvent it and access harmful content. Worse, the underlying network was flat. A single VLAN spanned all seven district locations, which meant any modernization effort that depended on segmentation, identity, or differentiated traffic policy was effectively blocked at the architecture layer. The plan: Migrate off the ASA + WebSense stack onto a Palo Alto firewall hosted at Ingham ISD, reachable across the StarNet county-wide metro ethernet service. The hosted model was attractive — Ingham ISD already operated the platform, the metro ethernet existed, and the migration would let Mason consume modern firewalling and URL filtering as a managed service rather than a local hardware refresh. The catch: A flat network can't safely consume a hosted firewall sitting across a metro ethernet link. Before the migration could happen, Mason's network had to be redesigned from the ground up. My role: I was the primary technical lead for the entire effort — the network redesign, the firewall migration, the wireless authentication work, and all the coordination with Ingham ISD. This was the project I was finishing as I prepared to move from Mason to Ingham ISD myself. What I built: The network redesign: I devised a master network plan replacing the flat single-VLAN topology with roughly 30 segmented VLANs across the district. Traffic was separated by location, by endpoint type, by user type, and by wired versus wireless. The redesign gave the district a foundation it had never had before — and a posture compatible with the routed, policy-driven environment Ingham was bringing to the table. The firewall migration: With the network ready, traffic was redirected across the StarNet metro ethernet to the Palo Alto firewall hosted at Ingham ISD. URL filtering was applied per-IP, relying on static IP assignments to control which traffic was filtered — a technical constraint of the platform at the time. Within that constraint, only student devices were subject to URL filtering; staff sessions were unfiltered, because the per-IP design couldn't differentiate users on shared infrastructure. The wireless authentication layer: With segmentation in place, I deployed a RADIUS-backed wireless solution that authenticated corporate, staff, and student devices into appropriate VLANs based on identity. What had been an open or PSK-based wireless environment became an identity-aware one, with each device class landing in the segment its policy was designed for. Outcome: The migration was successful. The student circumvention problem was solved at the architecture level — students no longer had a flat path to manipulate. Mason gained a modern, hosted firewall posture without buying or maintaining the hardware locally. The network redesign became the foundation everything else built on, and the project was one of the first real production uses of StarNet, the county-wide metro ethernet service that had been built but largely under-utilized until that point.