Enterprise secure network architecture with defense-in-depth segmentation across DMZ, critical, and user zones protected by firewall, IDS/IPS, and VLAN isolation. Traffic flows from Internet through edge router and principal firewall with intrusion detection to segregated zones: DMZ hosts web and DNS servers with DNSSEC, critical zone protects database and file servers, user zone connects employees and guests via core and access switches with port security. All remote access enforces SSHv2 and HTTPS encryption, with VPN gateway providing secure tunneling and Wi-Fi access points implementing cryptographic controls. This architecture demonstrates zero-trust segmentation, reducing lateral movement risk and containing breaches within isolated network zones. Fork and customize this diagram on Diagrams.so to adapt VLAN policies, add additional security appliances, or document your organization's network security posture.