Network Segmentation

Segmentation splits a network into separate zones and forces traffic between zones through a control point. On a flat network, one compromised laptop can reach every server, printer and database. With segmentation, the attacker lands in one zone and has to get past a rule set to go further. It is one of the most effective ways to apply defence in depth and least privilege to the network (see Security Architecture Principles).

Why segment

• Limit blast radius: malware, ransomware and attackers moving laterally are contained to one zone (Malware).
• Reduce compliance scope: only the zone holding card data or regulated data needs the full set of controls and audits (see GDPR and Security Requirements).
• Protect critical assets: management interfaces and databases are not reachable from guest Wi-Fi.
• Better monitoring: fewer allowed flows makes anomalies obvious.
• Performance and fault isolation: broadcast domains stay small.

Building blocks

VLANs and trunking

A VLAN is a logical Layer 2 network on shared switches. Hosts in different VLANs cannot talk directly; traffic must be routed, which is where you apply policy.

• Access port: carries one VLAN to an end device.
• Trunk port (802.1Q): carries several VLANs between switches or to a router/firewall by tagging frames.
• Inter-VLAN routing: done by a router or Layer 3 switch; ACLs or a firewall there enforce the rules.

VLANs are a separation mechanism, not a security control on their own: misconfiguration undermines them (see mistakes below).

Subnets as boundaries

Give each zone its own IP subnet (for example 10.10.20.0/24 for users, 10.10.30.0/24 for servers). Clear addressing makes rules readable and aggregates cleanly. See Networking Fundamentals for subnetting.

ACLs and firewalls between zones

Layer 3 ACLs on a router are stateless and coarse. A stateful or next-generation firewall between zones adds connection tracking, application awareness and logging (see Firewalls and IDS/IPS). Use default deny between zones and allow named flows only.

DMZ / screened subnet

A buffer zone for internet-facing services (web, mail relay, reverse proxy). The internet reaches the DMZ, the DMZ reaches only specific internal back ends, and the internal network is never directly exposed. Diagram and placement are in Firewalls and IDS/IPS.

Typical zones

                      Internet
                          |
                    [ Edge firewall ]
          +---------------+----------------+
          |               |                |
        DMZ            Guest             Partner/VPN
     (public svcs)    (Wi-Fi)            (remote access)
          |
    [ Internal firewall / L3 core ]
   +------+--------+---------+----------+----------+
   |      |        |         |          |          |
 Users  Servers  Databases  Mgmt     IoT / OT    Backup
 VLAN   VLAN     VLAN       (OOB)    VLAN        VLAN

Example zone/rule matrix

Rows are the source, columns the destination. Anything not listed is denied.

Traffic direction

• North-south: in and out of the network (internet to DMZ, users to internet). Traditional perimeter firewalls watch this.
• East-west: between internal hosts and workloads. Most lateral movement happens here, and perimeter devices never see it. Segmentation and host firewalls address it.

Modern data centres and clouds carry far more east-west than north-south traffic, which is why internal controls matter.

Beyond VLANs

Microsegmentation and software-defined segmentation

Policy is enforced per workload, not per subnet, using host firewalls, hypervisor/overlay networking, cloud security groups, or Kubernetes network policies. Rules follow the workload by label or identity (for example "web tier may reach app tier on 8443"), even if IP addresses change. This is a practical step towards zero trust (see Cloud Security).

Jump hosts and bastions

Administrators do not connect straight from their laptops to servers. They go through a hardened jump host (bastion) in the management zone that is MFA-protected, logged, and the only host allowed to reach admin ports. See SSH Advanced for ProxyJump and tunnelling, and VPN and Tunneling for remote access into the zone.

Out-of-band management

A separate physical or logical network for device management (iLO/iDRAC/BMC, switch consoles, hypervisor management). If the production network is compromised or down, administrators can still reach and recover devices, and attackers on production cannot reach management interfaces.

Air gaps

A system with no network connection to other networks (some OT, key ceremonies, offline backups). Strongest isolation, but data still moves by removable media, which becomes the attack path (see Endpoint Security for USB control). Treat "air-gapped" claims sceptically and verify.

Controlling who joins a segment

Use 802.1x and NAC to place devices in the right VLAN based on identity and posture, and to quarantine non-compliant ones.

Common mistakes

• Flat network: everything in one subnet, one firewall at the edge only.
• Allow-any between zones: segments exist on paper but the ACL is permit ip any any.
• Management plane exposed to user networks; default credentials on switches.
• VLAN hopping via switch spoofing (DTP negotiation) or double tagging, made possible by unused trunk-capable ports and the native VLAN being used for user traffic. Mitigate by disabling DTP, setting access ports explicitly, shutting unused ports, and not using VLAN 1 or the native VLAN for data. See Network Attacks.
• Dual-homed hosts bridging zones, and forgotten VPN or Wi-Fi paths that bypass the firewall.
• IoT/OT on the user network because it was easier.
• No egress or east-west logging, so segmentation failures are never noticed.
• Rules never reviewed; exceptions pile up (Change Management).

Key points

• Segment by trust and function: users, servers, data, management, guest, IoT/OT, DMZ.
• Boundaries need enforcement (firewall/ACL, default deny), not just VLAN labels.
• Control both north-south and east-west traffic; use microsegmentation for workloads.
• Admin access goes through a jump host, ideally on an out-of-band management network.
• Test segmentation regularly (scan from each zone) to prove the rules work.

Related

• Firewalls and IDS/IPS
• Security Technologies
• Wireless Security
• Security Controls
• Attack Surface and Vectors
• Firewall Fundamentals (TryHackMe)