Enterprise Home Lab 2.0: 5-Node Proxmox Cluster, Dual Dell Latitudes & Cisco Catalyst 3560-CG

The "Why" Before the "How": Evolving Beyond the Plastic Switch

When I first documented my home lab in Part 1, the architecture was deliberately minimal: three Lenovo ThinkCentre M70q Tiny PCs, a Zimaboard running pfSense, and an unmanaged 5-port Tenda switch.

That little plastic switch served its purpose well. It was cheap, fanless, and silently forwarded Ethernet frames between nodes. But as lab workloads grew—expanding to an enterprise Active Directory domain, a System Center Configuration Manager (SCCM / ConfigMgr) Primary Site, and high-availability Kubernetes clusters—an unmanaged switch became an unacceptable operational bottleneck:

Zero Spanning Tree Visibility: An unmanaged switch does not run 802.1D or 802.1w Rapid Spanning Tree Protocol. An accidental cabling loop instantly triggers a broadcast storm that melts the network.
No 802.1Q VLAN Tagging: An unmanaged switch cannot inspect or forward IEEE 802.1Q tagged frames cleanly across trunk links.
Black-Box Diagnostics: If a hypervisor interface begins flapping or dropping frames due to CRC errors, an unmanaged switch gives you zero interface counters or telemetry.

To resolve this debt, I executed a major infrastructure expansion:

Upgrading Core Switching: Swapping the plastic Tenda switch for enterprise silicon—a Cisco Catalyst 3560-CG compact switch.
Expanding the Proxmox Compute Fleet: Adding two dedicated mini-PC nodes—an HP ProDesk 600 G6 Desktop Mini (lab04) and a Dell OptiPlex 7050 Micro (lab05)—bringing the Proxmox cluster (dcruz-homelab) to 5 nodes.
Adding Dedicated Windows Hypervisors: Integrating 2x Dell Latitude 5420 laptops (11th Gen Core i7, 32 GB RAM each), giving Active Directory (DC01) and SQL Server (CM01) built-in battery UPS protection and a dedicated bare-metal PXE client for Dell driver injection testing.

1. Physical Hardware Fleet Inventory

Here is the authoritative hardware matrix of the expanded lab environment:

Host / Node	Physical Hardware Model	Hardware Specifications	Primary Role in Homelab
`GW-PFSENSE-01`	Zimaboard 832	Intel Celeron N3450, 8 GB RAM, Dual Realtek GbE (`re0`, `re1`)	Edge Firewall, Router (`10.1.1.1/16`), Static Range (`10.1.1.10–100`), DHCP Server (`10.1.2.1–245`), DNS, NAT, Tailscale Gateway
`SW-CORE-01`	Cisco Catalyst 3560-CG	8x 10/100/1000 RJ-45 + 2x Dual-Purpose 1G Uplinks (RJ45/SFP), Fanless, Layer 3 IOS	Core Layer 2/3 Switch, Rapid PVST+, PortFast, In-band Management (`10.1.1.9`)
`pve-dell01`	Dell Latitude 5420 #1	11th Gen Intel Core i7-1185G7, 32 GB RAM, 256/512 GB NVMe, Intel I219-LM GbE, TPM 2.0	Primary Windows & SCCM Hypervisor: Hosts `DC01` (4 GB), `CM01` (16 GB, SQL capped at 12 GB), `CLIENT01` (4 GB) with natural battery UPS protection
`LAT5420-BM01`	Dell Latitude 5420 #2	11th Gen Intel Core i7-1185G7, 32 GB RAM, 256/512 GB NVMe, Intel I219-LM GbE, TPM 2.0	Dual-Role Asset: Bare-metal PXE client for Dell WMI driver injection & Autopilot/BitLocker testing + secondary 32 GB Proxmox node
`lab01`	Lenovo ThinkCentre M70q	Intel Core i5/i7, 16–32 GB RAM, 1 TB NVMe Storage, Realtek GbE	Primary Storage & Backup: Proxmox Backup Server (PBS), `/export/lab-storage` NFS export, `Fileshare_TurnKeySMB`
`lab02`	Lenovo ThinkCentre M70q	Intel Core i5/i7, 16–32 GB RAM, 1 TB NVMe Storage, Realtek GbE	Network Services & Ingress: Traefik v3 reverse proxy, Authelia SSO, Cloudflare Tunnels
`lab03`	Lenovo ThinkCentre M70q	Intel Core i5/i7, 16–32 GB RAM, 1 TB NVMe Storage, Realtek GbE	Kubernetes Compute: K3s Worker Nodes (`301`–`303`) & Azure Arc hybrid servers
`lab04`	HP ProDesk 600 G6 Desktop Mini	10th Gen Intel Core i5-10500T (6C/12T @ 2.30GHz), 16 GB RAM, 256 GB Samsung NVMe + 256 GB SanDisk SSD	K3s Control Plane Node: High-availability control nodes (`401 cp1`, `402 cp2`, `403 cp3`), cloud-init template `1004`
`lab05`	Dell OptiPlex 7050 Micro	7th Gen Intel Core i5-7600T (4C/4T @ 2.80GHz), 32 GB RAM, 512 GB Intel NVMe + 1.02 TB ADATA SU800 SATA SSD	K3s Ingress & High-Capacity Storage: HAProxy/Keepalived load balancers (`501 lb1`, `502 lb2`), cloud-init template `1005`

2. Power Resilience & Turning Laptops into Hypervisors

Using laptops as hypervisors is one of the best homelab tricks for running mission-critical databases like Active Directory and SQL Server. If household power blips, the built-in laptop battery provides seamless, zero-cost UPS battery backup, preventing Active Directory database (ntds.dit) and SQL transaction log corruption.

However, laptops must be configured properly in BIOS and Linux so they do not sleep when closed on the shelf:

1. Dell Latitude 5420 BIOS Settings

Tap F2 on boot to configure the firmware:

System Configuration → Integrated NIC: Enabled w/PXE.
Virtualization Support: Intel Virtualization Technology = Enabled, VT for Direct I/O (VT-d) = Enabled.
Security: TPM 2.0 Security = On, PPI Bypass for Clear Commands = Enabled.
Power Management: AC Behavior = Wake on AC (Powers on automatically when power restores after a full drain), Block Sleep (S3 State) = Enabled.

2. Disabling Lid-Close Sleep in Proxmox (`systemd-logind`)

On pve-dell01, Linux systemd will suspend the machine when the lid is closed by default. Edit /etc/systemd/logind.conf to ignore lid-close signals:

sed -i 's/#HandleLidSwitch=suspend/HandleLidSwitch=ignore/' /etc/systemd/logind.conf
sed -i 's/#HandleLidSwitchExternalPower=suspend/HandleLidSwitchExternalPower=ignore/' /etc/systemd/logind.conf
sed -i 's/#HandleLidSwitchDocked=ignore/HandleLidSwitchDocked=ignore/' /etc/systemd/logind.conf

# Restart the login daemon to apply immediately
systemctl restart systemd-logind

3. Physical Port & Cabling Matrix on the Cisco Catalyst 3560-CG

To make the transition seamless without disrupting existing DHCP leases or IP addresses, the switch was cabled using this deterministic layout:

[Internet / ISP]
       │
       ▼ (WAN)
 [Zimaboard re0]
 [Zimaboard re1] (LAN 10.1.1.1)
       │
       ▼
 [Cisco 3560-CG Port Gi0/9] ─── (Uplink Trunk / Access VLAN 1)
       │
 ┌─────┴────────────────────────────────────────────────────────────────────────┐
 │ Gi0/1   Gi0/2   Gi0/3   Gi0/4   Gi0/5   Gi0/6   Gi0/7   Gi0/8   Gi0/9  Gi0/10│
 └─┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬────┘
   │       │       │       │       │       │       │       │       │       │
   │       │       │       │       │       │       │       │       │       └─ [Local Admin Laptop (RJ-45 Copper Access)]
   │       │       │       │       │       │       │       │       └─ [pfSense re1 LAN Uplink]
   │       │       │       │       │       │       │       └─ [Spare Access / Downstream Peripheral Switch]
   │       │       │       │       │       │       └─ [Dell OptiPlex 7050 (lab05) - i5-7600T / 32GB / 1TB SSD]
   │       │       │       │       │       └─ [HP ProDesk 600 G6 (lab04) - i5-10500T / 16GB / K3s CP]
   │       │       │       │       └─ [Lenovo lab03 - K3s Workers / Azure Arc]
   │       │       │       └─ [Lenovo lab02 - Docker / Reverse Proxy]
   │       │       └─ [Lenovo lab01 - NFS Storage / PBS Backups]
   │       └─ [Dell Latitude #2 - Bare Metal OSD / PVE Node 2]
   └─ [Dell Latitude #1 - Primary Windows Server Hypervisor]

Switch Port	Connected Device	Default Subnet	Operational Function
`Gi0/1`	Dell Latitude 5420 #1 (`pve-dell01`)	`10.1.1.20/16` (Static)	Primary Windows Server & SCCM Hypervisor (`DC01`, `CM01`, `CLIENT01`)
`Gi0/2`	Dell Latitude 5420 #2 (`LAT5420-BM01`)	`10.1.2.x/16` (DHCP)	Bare-Metal Dell OSD PXE Endpoint / Proxmox Node 2
`Gi0/3`	Lenovo Tiny M70q (`lab01.local`)	`10.1.1.11/16` (Static)	Proxmox Storage Node: PBS, TurnKey SMB, `/export/lab-storage` NFS
`Gi0/4`	Lenovo Tiny M70q (`lab02.local`)	`10.1.1.12/16` (Static)	Linux Ingress Stack: Traefik v3, Authelia SSO, Cloudflare Tunnels
`Gi0/5`	Lenovo Tiny M70q (`lab03.local`)	`10.1.1.13/16` (Static)	Compute Node: K3s Worker Nodes (`301`–`303`) & Azure Arc
`Gi0/6`	HP ProDesk 600 G6 Mini (`lab04.local`)	`10.1.1.14/16` (Static)	K3s Control Plane Node: HA control nodes (`401 cp1`–`403 cp3`)
`Gi0/7`	Dell OptiPlex 7050 Micro (`lab05.local`)	`10.1.1.15/16` (Static)	K3s Load Balancers (`501 lb1`–`502 lb2`) & 1.02 TB SSD storage pool
`Gi0/8`	Available Access Port	`10.1.1.0/16` (VLAN 1)	Expansion / Test Bench / Peripheral Switch Port
`Gi0/9` (Uplink)	Zimaboard pfSense (`re1` LAN)	`10.1.1.1/16` (Default Gateway)	Main LAN Uplink to Firewall & Internet Gateway
`Gi0/10` (Uplink/Access)	Local Admin Laptop / Engineering Access	`10.1.2.1–245/16` (DHCP)	Dual-Purpose RJ-45 copper access port for direct laptop engineering & admin

4. Cisco Catalyst 3560-CG Baseline Configuration

The baseline script hardens administrative access, configures sub-second Rapid PVST+, turns on PortFast on edge ports, enables Gi0/10 as an active copper access port, and assigns in-band management SVI 10.1.1.9/16:

enable
configure terminal

! 1. System Identification & CLI Usability
hostname SW-CORE-01
ip domain-name lab.dariocruz.dev
no ip domain-lookup
service password-encryption
enable secret STRONG_SECRET_PASSWORD
username dario privilege 15 secret ADMIN_PASSWORD

! 2. SSHv2 Remote Management Hardening
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
no ip http server
no ip http secure-server

! 3. Terminal Lines & Formatting
line con 0
 logging synchronous
 exec-timeout 15 0
 login local
 exit

line vty 0 15
 logging synchronous
 exec-timeout 15 0
 login local
 transport input ssh
 exit

! 4. Rapid Spanning Tree (802.1w) & Edge PortFast
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default

! 5. Host Access Ports (Ports 1 through 8)
interface range GigabitEthernet0/1 - 8
 description LAB-HOST-ACCESS-PORTS
 switchport mode access
 switchport access vlan 1
 switchport nonegotiate
 spanning-tree portfast
 no shutdown
 exit

! 6. pfSense Firewall LAN Uplink (Port 9)
interface GigabitEthernet0/9
 description UPLINK-TO-PFSENSE-ZIMABOARD-RE1
 switchport mode access
 switchport access vlan 1
 switchport nonegotiate
 no shutdown
 exit

! 6b. Direct Admin Laptop Access (Port 10)
interface GigabitEthernet0/10
 description LOCAL-ADMIN-LAPTOP
 switchport mode access
 switchport access vlan 1
 switchport nonegotiate
 spanning-tree portfast
 media-type rj45
 no shutdown
 exit

! 7. Management SVI & Layer 2 Default Gateway
no ip routing
interface Vlan1
 description IN-BAND-MANAGEMENT-VLAN1
 ip address 10.1.1.9 255.255.0.0
 no shutdown
 exit

ip default-gateway 10.1.1.1

end
write memory

Why `spanning-tree portfast` and `media-type rj45` Matter

Preventing Windows DHCP Timeout (PortFast): Standard 802.1D Spanning Tree forces newly connected endpoints through 30–50 seconds of Listening and Learning states. By the time the port unblocks, Windows has already timed out its initial DHCP request and assigned itself an unusable APIPA address (169.254.x.x). portfast moves the port directly into Forwarding immediately upon link-up.
Activating the Copper Jack (media-type rj45): Ports 9 and 10 are dual-purpose uplinks with both RJ-45 jacks and SFP cages. Setting media-type rj45 explicitly binds the PHY layer to the copper jack, allowing you to plug your laptop directly into Gi0/10 with a standard Ethernet patch cable.

5. Verification: Trust, but Verify

After applying the configuration, execute these diagnostic checks from privileged EXEC mode (SW-CORE-01#):

1. Port Status & Link Negotiation

SW-CORE-01# show interfaces status

Expected Output:

Port      Name               Status       Vlan       Duplex  Speed Type
Gi0/1     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/2     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/3     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/4     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/5     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/6     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/7     LAB-HOST-ACCESS-PO connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/8     LAB-HOST-ACCESS-PO notconnect   1              auto   auto 10/100/1000BaseTX
Gi0/9     UPLINK-TO-PFSENSE- connected    1            a-full a-1000 10/100/1000BaseTX
Gi0/10    LOCAL-ADMIN-LAPTOP connected    1            a-full a-1000 10/100/1000BaseTX

2. Spanning Tree Edge State Verification

SW-CORE-01# show spanning-tree vlan 1

Confirm that all host ports display P2p Edge in the Type column:

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p Edge
Gi0/2               Desg FWD 4         128.2    P2p Edge
Gi0/3               Desg FWD 4         128.3    P2p Edge
Gi0/4               Desg FWD 4         128.4    P2p Edge
Gi0/5               Desg FWD 4         128.5    P2p Edge
Gi0/6               Desg FWD 4         128.6    P2p Edge
Gi0/7               Desg FWD 4         128.7    P2p Edge
Gi0/9               Desg FWD 4         128.9    P2p
Gi0/10              Desg FWD 4         128.10   P2p Edge

3. Management SVI & Default Gateway Reachability

SW-CORE-01# ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

What's Next?

With the Cisco Catalyst 3560-CG operating stably at Layer 2 and our compute fleet expanded to 5 Proxmox nodes and dual Dell 5420 hypervisors, the stage is set for:

Part 2: Home Lab Network Segmentation (Upcoming): Partitioning our flat network into isolated 802.1Q VLANs (VLAN 10 Management, VLAN 20 Windows/AD, VLAN 30 Endpoints, VLAN 40 Linux).
Project 1 (SCCM / ConfigMgr & Endpoint Engineering): Building out DC01, CM01, and deploying thin-image Windows 11 Enterprise task sequences to our physical Dell Latitude 5420.

The "Why" Before the "How": Evolving Beyond the Plastic Switch​

1. Physical Hardware Fleet Inventory​

2. Power Resilience & Turning Laptops into Hypervisors​

1. Dell Latitude 5420 BIOS Settings​

2. Disabling Lid-Close Sleep in Proxmox (systemd-logind)​

3. Physical Port & Cabling Matrix on the Cisco Catalyst 3560-CG​

4. Cisco Catalyst 3560-CG Baseline Configuration​

Why spanning-tree portfast and media-type rj45 Matter​

5. Verification: Trust, but Verify​

1. Port Status & Link Negotiation​

2. Spanning Tree Edge State Verification​

3. Management SVI & Default Gateway Reachability​

What's Next?​