Network hosts and appliances matching lab

Match AAA, UTM, NTP, and SCADA isolation tickets; leave DNS-as-auth and IoT-on-SCADA unused.

Match each host/appliance ticket to the right role. Leave DNS-as-auth and IoT-on-SCADA unused.

CompTIA 2.3 wants you to place DNS, DHCP, AAA, UTM, NTP, SCADA, and IoT as roles — and know which box should never share a guest SSID.

Corp Wi-Fi rejects users; AP config looks fine

Credentials fail at the edge. Which role says yes/no to the AP?

SOHO wants one box for firewall, IPS, and web filter

Budget for one appliance, not a stack. Name the combined role.

After a blackout, domain logons flake until clocks catch up

Passwords 'wrong' across many apps. Time skew is the clue.

Warehouse HMI was put on guest SSID for convenience

Industrial control host placement — not a printer share problem.

Still on the bench

RADIUS/TACACS+ AAA — AP/VPN are clients of this box — AAA answers who may connect. The AP or concentrator is a client of AAA, not AAA itself.
UTM appliance — firewall + IPS + filter in one rack unit — Small offices buy one UTM instead of five boxes. Blast radius is the whole edge if it dies.
NTP time source — fix clocks after the outage — Kerberos, certs, and logs rot when time is wrong. Random password failures after power loss can be NTP.
Isolate SCADA/ICS on its own segment — not guest Wi-Fi — Plant/HMI hosts are not laptop VLANs. Putting SCADA on guest Wi-Fi is an incident.
Point the AP at DNS and call that authentication — DNS answers names. It does not authorize Wi-Fi or VPN sessions.
Park lobby IoT cameras on the SCADA VLAN for 'easy routing' — IoT gets its own segment. Mixing cameras with plant controls widens blast radius.