Thirty schools, one managed network: CIPA-filtered, segmented and readable by a three-person IT team

A school district has two audiences for its network: children, whom the law says it must protect, and a small IT team that has to run thirty buildings. This district had grown a network at each school. Cameras, door controllers, bells and thermostats shared a flat network with student laptops, filtering differed by building, and Wi-Fi quality depended on which summer a school was last upgraded. The Children's Internet Protection Act, 47 U.S.C. 254(h), ties E-rate discounts to filtering and monitoring, so the stakes were real.

The design is a routed network with two district hubs and 10 Gb/s fiber to every school. Each school gets the same set of VRFs and VLANs: students, staff, administration (student information, finance, payroll), building systems and guests, with a default-deny firewall between them. A compromised student device can reach the internet through the filter and nothing else. The student information system, which holds education records protected by FERPA (20 U.S.C. 1232g), sits in the administration segment, reachable only by staff with MFA. BGP to two providers and DDoS-aware edge filtering keep the district online when one provider or one school fails.

The statute asks for a technology protection measure that blocks obscene material, child sexual abuse material and material harmful to minors, and for schools it also asks for monitoring of minors' online activity. We built filtering with DNS and TLS SNI inspection at the district hubs and a management-console policy for school-owned Chromebooks, so the same rules follow the child home. The statute lets an authorized person turn the measure off for an adult's lawful research, so staff run a lighter policy. The district writes and adopts the Internet safety policy after public notice and hearing; we supply the technical description of what the controls do.

Identity does the rest. Managed laptops and staff devices use IEEE 802.1X with EAP-TLS and certificates pushed by device management. Printers, projectors and building systems that cannot do 802.1X use MAC authentication bypass and land in a restricted VLAN, and guests get an isolated, rate-limited portal. Wi-Fi 6 access points were placed from a measured survey with real classroom client counts, not from a brochure ratio. Switch configurations are templates, backed up automatically, and changed through a reviewed process.

The rollout took two summers, school by school, with a rollback ready for each night. Because every school is a copy of the same template, the three-person central team can see and fix all thirty from one dashboard, and a new school or a rebuilt wing is a configuration exercise. When a reviewer asks how filtering, monitoring and segmentation work, the answer is a diagram and a test report. Our zero trust article applies the same identity-first thinking to a mid-size organization.