New intern's PC is on the production-server VLAN by mistake

From: Incident Response Lead (SOC on-call)
To: IT Leadership · Network Operations · Infrastructure Security · Server Owners · On-call SOC
Subject: [SEV-2][INC-NET-VLAN100] Marketing intern PC placed on production-server VLAN — containment and exposure review in progress

Incident: INC-NET-VLAN100 · SEV-2 / P2
Status: Investigating — containment and exposure scoping in progress
Classification: Network Engineering · VLAN Misconfiguration · Production Segmentation Violation
Affected asset: `ACCESS-SW-12 Gi1/0/24` + intern PC · High criticality
Detected: 2026-04-19 09:55 UTC

SITUATION & SUMMARY

A new marketing intern’s laptop was incorrectly placed on production-server VLAN 100 instead of the intended office VLAN 200.

Evidence shows `ACCESS-SW-12 Gi1/0/24` is configured as a static access port with `Access Mode VLAN: 100 (prod-servers)`. The port should be assigned to VLAN 200 for the marketing office area. Switch logs show this assignment was made on Apr 18 at 18:12 UTC by `cli-noc-jr`.

The intern’s laptop MAC `bcd1.7f00.55aa` was learned on VLAN 100, received DHCP address `10.0.100.84` from the `PROD-SERVERS-100` scope, and had reachability to the production VLAN gateway `10.0.100.1`. Firewall logs confirm the laptop reached `db-prod-01` over SSH and `web-prod-02` over HTTPS, while SMB to `db-prod-01` was denied by policy.

This is therefore not only L2 visibility or a cosmetic ARP issue. This is a confirmed production segmentation exposure involving one misconfigured access port and one intern workstation.

SEVERITY & PRIORITY

This is rated SEV-2 / P2 because a non-production intern laptop was placed directly into the production-server VLAN for approximately 16 hours and confirmed network sessions reached two production hosts.

There is currently no evidence of malicious activity or successful authentication to production systems, but the exposure must be scoped from logs before closure.

IMMEDIATE CONTAINMENT

* Preserve the current `ACCESS-SW-12 Gi1/0/24` switchport configuration, MAC address table output, DHCP lease evidence, NAC session details, and firewall logs before making changes.
* Remove the intern laptop from production VLAN 100 by either shutting `Gi1/0/24` or moving the port back to the approved office VLAN 200.
* After the port is corrected, force the intern laptop to release/renew DHCP or reconnect so it receives an office VLAN 200 address.
* Confirm the laptop no longer has a `10.0.100.0/24` address and can no longer reach production VLAN 100 directly.
* Do not convert the marketing access port to a trunk.
* Do not delete VLAN 100.
* Do not clear MAC address tables before evidence is preserved.

EXPOSURE SCOPING

* Bound the exposure window from Apr 18 18:13 UTC, when the DHCP lease was issued, through the time containment is completed.
* Review firewall logs for all traffic from `10.0.100.84` during the exposure window.
* Review `db-prod-01` SSH logs to confirm whether there were any authentication attempts after the SSH banner was reached.
* Review `web-prod-02` web server, application, and TLS access logs for the session from `10.0.100.84`, including requested paths, response codes, and transferred data.
* Confirm whether any additional production hosts were contacted by `10.0.100.84`.
* Review EDR telemetry on the intern laptop to confirm whether any scanning, enumeration, credential tools, or unusual network activity occurred.
* Confirm whether this was limited to `Gi1/0/24` or whether any other marketing-area ports were also incorrectly assigned to VLAN 100.

NETWORK / NAC INVESTIGATION

* Review the Apr 18 configuration change made by `cli-noc-jr` and determine whether it was approved, accidental, or copied from another template.
* Confirm why the `MARKETING-PORT` NAC profile allowed MAB fallback without 802.1X and did not enforce the intended office VLAN.
* Check whether dynamic VLAN assignment or port profile enforcement should have placed the laptop into VLAN 200 regardless of the static switchport error.
* Review all access ports on `ACCESS-SW-12` for incorrect production VLAN assignments.
* Search other access switches for any non-server access ports assigned to VLAN 100.
* Validate that no DIST or CORE trunk issue contributed to the exposure. Current evidence points to a single access-VLAN assignment error on `Gi1/0/24`.

EVIDENCE PRESERVATION

* Preserve `show interfaces Gi1/0/24 switchport`.
* Preserve `show vlan brief | include 100|200`.
* Preserve switch configuration logs showing the Apr 18 change by `cli-noc-jr`.
* Preserve `show mac address-table interface Gi1/0/24`.
* Preserve the intern laptop ARP sample showing prod VLAN gateway and production server ARP entries.
* Preserve DHCP lease records for MAC `bcd1.7f00.55aa`.
* Preserve NAC session details showing MAB authorization and no 802.1X username.
* Preserve firewall logs showing SSH, HTTPS, and denied SMB attempts involving `10.0.100.84`.

RECOVERY & NEXT STEPS

* Correct `Gi1/0/24` to VLAN 200 or place it into a quarantine VLAN until the endpoint is validated.
* Confirm the intern laptop receives the correct office network assignment and cannot reach production-server VLAN 100.
* Complete server-side log review for `db-prod-01` and `web-prod-02`.
* If any successful authentication or suspicious access is found, escalate to a broader production access investigation.
* Review and tighten NAC policy so first-day or unauthenticated laptops cannot be authorized into sensitive VLANs through MAB fallback.
* Add configuration compliance checks to flag user-facing access ports assigned to production VLANs.
* Add change-control guardrails for access VLAN changes involving high-risk VLANs such as VLAN 100.
* Review whether production-server access should be blocked from non-server MACs even when they appear inside VLAN 100.

STAKEHOLDER COMMUNICATION

* Notify Network Operations that the root cause appears to be a static access VLAN assignment error on `ACCESS-SW-12 Gi1/0/24`.
* Notify server owners for `db-prod-01` and `web-prod-02` that log review is required for the exposure window.
* Notify Marketing/Office Operations that the intern’s workstation may be temporarily disconnected or moved to the correct office VLAN.
* Notify IT Leadership that exposure was confirmed to two production hosts, but no successful authentication has been confirmed yet.

DO NOT

* Do not treat this as only a hostname or ARP display issue.
* Do not assume there was no production access; firewall logs confirm traffic reached `db-prod-01` and `web-prod-02`.
* Do not convert marketing access ports to trunks as a workaround.
* Do not delete VLAN 100 to make the symptom disappear.
* Do not clear MAC tables, DHCP leases, or switch logs before evidence is preserved.
* Do not close the incident immediately after moving the port; server-side and firewall log review must confirm the scope.
* Do not wipe the intern laptop unless endpoint telemetry shows malicious activity or compromise.