Cisco IOS-XE
Catalyst 9500 L3 Core Switch
AAA, SSH hardening, VLANs, SVIs, OSPF, STP, DHCP snooping, DAI, CoPP, port-channels. Hardened baseline for campus core.
Production-ready templates for network pros
Skip the blank page. Deploy in minutes.
42 hardened templates — plus 35 Claude Code skills. Network configs (incl. pfSense, Check Point, Meraki), AWS + Azure + GCP landing zones, SOC 2 + PCI-DSS v4 + NIS 2 + ISO 27001 compliance packs, SD-WAN topology, K8s NetworkPolicy, TLS lifecycle. Ready for your environment.
Free to download. No signup. MIT licensed.
42
Products
25,000+
Lines
8
Vendor Stacks
5
Categories
100%
Customisable
About
VantagePoint Networks
A one-engineer shop. Templates built and maintained by Hak - Senior Engineer and Author - using the same material in production networks every day.
Everything on this site is original, MIT-licensed, and free to download. No signup, no paywall, no lead capture. If a template helps you ship faster or sleep better on-call, that's the whole point.
Three interactive ways to explore
Before scrolling through 26 product cards, try one of these browser-based tools. No install, no signup - just click and explore.
Visual Map
Product Ecosystem
A radial overview of all 5 product lines. Click any node to jump straight to that category in the catalogue.
Open ecosystemInteractive
Config Explorer
Filter 10 configs by vendor. The reference topology highlights matching devices. Preview the file in place before downloading.
Open explorerDashboard
Workflow System
See how the products are built: six AI agents, a five-phase pipeline, live sprint board and the protocol feed that coordinates them.
Open dashboardNetwork Configurations
CIS-hardened, annotated baselines across eight vendor stacks (enterprise + SMB + open source). Variable placeholders throughout so you can customise and deploy in one pass.
Cisco IOS-XE
ISR 4431 WAN Edge Router
BGP dual-ISP, OSPF, bogon filters, CoPP, IP SLA tracking, IKEv2 VPN template. WAN edge baseline for multi-site.
Cisco ASA
ASA 5525-X Firewall
AnyConnect SSL VPN, IKEv2 site-to-site, active/standby failover, threat detection, modular QoS inspection.
Cisco IOS-XE WLC
Catalyst 9800 Wireless Controller
Four WLANs (Corp / Voice / IoT / Guest), FlexConnect, QoS policies, RRM, rogue AP detection, mDNS gateway.
Cisco NX-OS
Nexus 9300 DC Spine Switch
BGP EVPN fabric, VXLAN VTEP, VPC peer-link, OSPF underlay, CoPP. Data-centre spine baseline for spine-leaf.
FortiOS 7.4
FortiGate 100F Zone-Based Firewall
Trust / Untrust / DMZ / Mgmt zones, AV / IPS / WF / AppCtrl profiles, HA pair config, SNAT, logging.
Junos 23.x
Juniper EX4400 Distribution
Modern SSH ciphers, VLANs with IRB, LACP to core, OSPF with BFD, 802.1X, firewall filter on loopback.
AOS-CX 10.12
Aruba CX 6300 Access Layer
802.1X / MAC-auth, RADIUS, port templates (user / printer / IoT / AP), storm control, DHCP snooping, sFlow.
PAN-OS 11.1
Palo Alto PA-5220 NGFW
Zero Trust zones, AV / AS / VP / URL / FB / WildFire profiles, DNS sinkhole, HA template, App-ID policies.
RouterOS 7
MikroTik Router Baseline
VLAN filtering bridge, firewall with DDoS protection, DHCP, queue simple, SNMP. Affordable SMB baseline.
pfSense / OPNsense
pfSense Hardened Baseline
Production-grade pfSense / OPNsense config with segmented LAN / DMZ / GUEST, deny-by-default firewall, DNSSEC-validating Unbound, SNMPv3, central syslog. Open source community gold standard.
Check Point R81
Check Point R81 Baseline
Enterprise Gaia OS hardening, ClusterXL HA, policy-package structure, Threat Prevention profile, HTTPS Inspection, Identity Awareness, log exporter. R81.20 / R82 tested.
Cisco Meraki
Meraki MX + MS Cloud-Managed Baseline
Multi-site Meraki org: MX security appliance + MS switch + MR wireless. Dashboard config checklist, API-driven provisioning, AutoVPN, threat protection, AnyConnect client VPN. Retail / SMB sweet spot.
Topology Diagrams
Professional templates for draw.io (free) with VLAN tables, IP assignments, power budgets, vendor stencils and full SD-WAN reference wired up.
draw.io Template
3-Tier Campus Network Topology
WAN cloud, dual FW HA, vPC core, 3 distribution, 9 access switches across 3 buildings, with VLAN assignment and IP tables.
draw.io Template
42U Rack Elevation Diagram
Full MDF rack layout with power budget table, port allocation summary, and cable management notes.
draw.io Template
WAN / MPLS Multi-Site Topology
HQ + 3 branches + data centre + remote workers (SSL VPN). Site summary table with subnets, bandwidth, BGP ASNs.
draw.io Template
SD-WAN Multi-Site Reference Topology
Hub-spoke SD-WAN with dual internet + MPLS underlay, IPsec overlay tunnels, cloud-hosted orchestrator, SaaS direct break-out per branch. Vendor-agnostic (applies to Fortinet, Meraki, Viptela).
Operations, Cloud & Compliance Runbooks
Battle-tested procedures for incidents, change, security, cloud landing zones, and audit-ready compliance packs (SOC 2, PCI-DSS v4, NIS 2, ISO 27001, Cyber Essentials+). NIST 800-61, ITIL v4, CIS v8, AICPA TSC aligned.
NIST SP 800-61
Incident Response Runbook
Six-phase lifecycle, P1-P4 severity matrix, 5 playbooks (DDoS / ransomware / breach / outage), chain-of-custody form.
ITIL v4
Change Management Runbook
Standard / Normal / Emergency flows, CAB agenda, 5x5 risk matrix, rollback playbook, KPI reporting templates.
MITRE ATT&CK
SOC Playbook Bundle
Eight alert playbooks - brute force, malware, phishing, C2, privilege escalation, exfiltration, DHCP spoofing, VPN anomaly.
Business Continuity
Disaster Recovery Runbook
BIA template, 5 scenario playbooks (data centre / cyber / network / cloud / building), DR test types, failback procedures.
CIS Controls v8
Network Security Audit Checklist
120+ controls across 12 domains, mapped to CIS Controls v8 and NIST CSF. Finding summary and sign-off ready.
HR / Operations
New Hire Onboarding Checklist
Pre-arrival through 90-day review. Access matrix, training resources, contact table, equipment checklist.
Cloud Architecture
AWS Landing Zone Reference
Multi-account org, IAM Identity Center, Transit Gateway hub, centralised egress, GuardDuty + Config + Security Hub, SCP guardrails, 12-week implementation order.
Cloud Architecture
Azure Landing Zone Reference
Microsoft CAF Enterprise-scale done practically: management group hierarchy, Entra ID baseline, hub-and-spoke + Azure Firewall, Defender + Sentinel, Azure Policy initiative pack.
Cyber Essentials Plus
Cyber Essentials Plus Readiness Pack
UK NCSC scheme: 5 control areas, evidence to collect per area, common audit findings, pre-assessment dry run, annual cycle. Built for first-time and renewal.
ISO/IEC 27001:2022
ISO 27001 Annex A Evidence Pack
All 93 controls grouped by 4 themes (Organisational, People, Physical, Technological). Evidence to collect per control, common findings, SoA starter, 12-week pre-audit timeline.
Detection-as-code
Sentinel KQL Detection Pack
20 production-ready Sentinel detections - identity, endpoint, cloud, email, network, persistence. Each with KQL, MITRE ATT&CK mapping, FP triage, response actions.
M365 / Entra ID
M365 + Entra ID Hardening Baseline
Practical hardening for Microsoft 365 + Entra ID. Break-glass, PIM, 10 Conditional Access policies, Defender preset, mailbox + DLP, Secure Score trajectory, 12-week rollout.
AICPA TSC
SOC 2 Type II Evidence Pack
Working evidence index for SOC 2 Type II across the five Trust Services Criteria. Control-by-control checklist, 12-month cadence calendar, and the common findings to pre-empt before fieldwork.
PCI-DSS v4.0
PCI-DSS v4.0 Readiness Pack
All 12 requirements plus the future-dated controls mandatory from 2025-03-31. Scoping worksheet, CDE definition, evidence index, and 15-question fast-track gap assessment.
EU Directive 2022/2555
NIS 2 Directive Readiness Pack
NIS 2 scoping (essential vs important), the 10 Article 21 risk-management measures, Article 23 incident-reporting clocks (24h / 72h / 1-month), and a 72-hour crisis playbook.
GCP CFT
GCP Landing Zone Reference
Enterprise-scale GCP foundation: resource hierarchy, Shared VPC, HA VPN, org policies, aggregated logging, VPC-SC, Workload Identity Federation. Rollout order that has survived audit.
Kubernetes
Kubernetes NetworkPolicy Baseline Pack
Default-deny patterns, namespace isolation, tier-based flows, egress to managed services, CNI-specific notes for Calico, Cilium and AWS VPC CNI. Ready-to-apply YAML, rollout strategy, gotchas.
PKI / TLS
Certificate & TLS Lifecycle Runbook
Inventory, issuance, renewal, rotation, revocation, monitoring, and the emergency replacement runbook when a cert dies in production at 1am Saturday. Ownership + automation front and centre.
Study Guides & Cheat Sheets
Exam-focused references for network and security certifications. Worked examples, visual tables, and acronym glossaries.
CCNA 200-301
CCNA Subnetting Cheat Sheet
CIDR table /0-/32, magic-number method with 5 worked examples including VLSM. Port numbers, protocol distances, STP states.
CompTIA N10-009
CompTIA Network+ Cheat Sheet
OSI / TCP-IP, Ethernet and wireless standards, cable reference, 40 common ports, routing, switching, troubleshooting, 60 acronyms.
CompTIA SY0-701
CompTIA Security+ Cheat Sheet
Threat actors, attack types, malware families, crypto, IAM, wireless, cloud, IR, GRC. Security-relevant ports and 80 acronyms.
Cisco ENCOR 350-401
CCNP ENCOR Cheat Sheet
OSPF / EIGRP / BGP deep dive, STP, EtherChannel, FHRP, wireless, VXLAN, LISP, automation (NETCONF, YANG), QoS.
Planning Spreadsheets
IP address management, VLAN planning, circuit tracking, equipment inventory. Import into Excel or Google Sheets and customise.
Excel / Sheets
IP & VLAN Planning Spreadsheet
VLAN table, device IPs, subnet calculator, point-to-point links, trunk matrix, SSID-to-VLAN mapping, DNS records.
Excel / Sheets
WAN Circuit & SLA Tracker
12 circuits across 5 sites, 3 months of SLA data, renewal calendar, incident-cause breakdown, cost summary by provider.
Excel / Sheets
Network Equipment Inventory
28 devices with serials, firmware matrix with CVE counts, lifecycle summary, 16 access points with MAC and channel data.