Network segmentation and access scope
A flat network places many devices and services in one segment. Communication shares one broadcast domain, while rules between departments or resource types are harder to apply. If one host is compromised, broad connectivity can give an attacker a path to other systems unless additional controls restrict lateral movement.
separates resources according to function and protection requirements. Traffic between segments passes through a router, firewall, Layer 3 switch, or host control. Rules can restrict lateral movement and the consequences of a compromise, while correct configuration and monitoring remain necessary.
Network segmentation methods
Segmentation can use physical isolation, VLANs, IP subnets, host firewalls, application gateways, and identity-based rules. The choice depends on required isolation, cost, scale, and management model.
1. Physical segmentation and the air gap
Physical segmentation uses separate switches, interfaces, cabling, or other infrastructure. Two networks can remain completely disconnected, a configuration often called an "air gap." This isolation limits communication paths but requires separate equipment and operating procedures.
Physical separation limits connections but increases the cost, change time, and maintenance effort. Moving an employee from Sales to Engineering may require recabling the computer or installing another interface.
A physically disconnected network requires controls for media, service devices, and data transfer procedures. Each temporary connection should have an owner, scope, expiry, and record of the performed actions. Reviews verify that disconnected interfaces remain inactive.
2. Logical segmentation with VLANs
divide switch ports into multiple Layer 2 domains. A VLAN does not create access control between segments by itself, so inter-VLAN traffic requires routing and policy rules.
One switch can carry several logical segments, which reduces the need for separate equipment for every group.
How VLANs work: tagging and isolation
VLANs operate at Layer 2 of the OSI model. An access port assigns an incoming frame to a specific VLAN, such as VLAN 10 for Sales or VLAN 20 for Engineering. On a trunk link, the switch marks frames with a tag defined by the IEEE 802.1Q standard. Access ports usually carry traffic without that tag, while trunk ports can carry multiple VLANs.
The receiving switch reads the tag and forwards the frame only within the permitted VLAN. VLAN 20 does not receive broadcasts from VLAN 10, so the segments have separate broadcast domains. Traffic between VLANs requires a Layer 3 device and access rules.
A trunk configuration should define the permitted VLAN list and the handling of untagged frames. Unused ports and VLANs can be disabled, and configuration changes should be recorded. Frame separation alone does not protect an application from an incorrect routing rule.
Inter-VLAN routing
VLANs are separate Layer 2 domains. Controlled communication between them requires a Layer 3 device, usually a router or Layer 3 switch. One example is Sales access to a printer in the Marketing VLAN.
A router can connect several VLANs through logical interfaces, a "router on a stick" configuration, or a Layer 3 switch. An administrator creates Access Control Lists (ACLs) that specify direction, address, protocol, and port. An example rule allows devices in the Sales VLAN to access the printer at IP in the Marketing VLAN and blocks other traffic between those VLANs.
3. Layer 3 segmentation: IP subnets
Layer 3 segmentation uses IP subnets. A subnet is a logical address range with its own route and usually its own Layer 2 broadcast domain. A design often assigns one IP prefix to one VLAN so that routing and ACL rules remain clear.
For example:
- VLAN 10 (Sales) might use the subnet .
- VLAN 20 (Engineering) might use the subnet .
- VLAN 99 (Guests) might use the subnet .
The router selects an interface for a packet destined for , while an ACL determines whether the flow is permitted. IP segmentation connects addressing with routing and traffic control between VLANs.
Each subnet requires a consistent plan for its default gateway, DHCP, DNS, routes, and monitoring. Rules should cover the flows required by the service and the direction in which connections are initiated. Reviewing routes and ACLs after an addressing change reduces the risk of unintended connectivity.
Microsegmentation
VLANs and subnets create segments whose scope depends on the design. A Finance segment can contain many servers and applications, while its access rules might allow broad communication. If one server is compromised, that connectivity increases the risk of lateral movement to other systems.
applies rules close to a host, service, or workload. It supports a Zero Trust model, while segmentation alone does not replace authentication, authorization, or monitoring.
Microsegmentation can cover one host, service, or application. Rules define permitted connections between components and limit lateral traffic to required flows.
Least privilege for network flows
Microsegmentation describes which application components may communicate. The policy can include port, protocol, direction, service identity, and device state when those signals are available.
An example three-tier web application includes:
- Web Server Tier: The public-facing web servers.
- Application Tier: The servers running the business logic.
- Database Tier: The servers storing the sensitive data.
An example microsegmentation policy can specify:
- The Web Server can only communicate with the Application Server on TCP port .
- The Application Server can only communicate with the Database Server on TCP port .
- All other communication is denied by default. The web servers cannot talk to each other directly. The database server cannot initiate a connection to the internet.
These rules limit the attack surface and permitted flows. After a web server is compromised, an attacker can use flows allowed by the policy, so the rules should block direct connections between web servers and direct database access. Incident scope depends on the correctness and monitoring of the rules.
Microsegmentation rules should be tested against an application dependency map. Logs of allowed and denied flows help identify missing exceptions and unnecessary connections. After deployment, the service owner reviews the policy when the version, addressing, or communication method changes.
Technologies supporting microsegmentation
Microsegmentation can use the following technologies:
- Software-Defined Networking (SDN): Separates the control plane from the data plane so policies can be defined in software and applied across managed infrastructure.
- Host-based firewalls: Apply rules in each server's operating system, allowing control at the host and service level.
- Next-generation firewalls (NGFWs): Can act as segmentation gateways and classify traffic by application or identity when supported by configuration and identity integration.
A microsegmentation deployment starts with observing dependencies and creating a policy for the flows required by the application. A reporting mode helps compare traffic with the design before rules are tightened. Each exception should have an owner, a review date, and a risk description.
Effects of network segmentation
Segmentation affects communication scope, broadcast domains, monitoring, and compliance evidence. The result depends on rules, topology, and configuration maintenance.
- Limited breach impact: Traffic isolation limits the reachable area after a host compromise. Segmentation can narrow lateral movement when rules block connections that services do not require.
- Smaller broadcast domains:In a flat network, one device's broadcast traffic reaches a larger group. A VLAN confines that traffic to its own domain, which can reduce load and make diagnosis easier.
- Access control and monitoring: Traffic between segments passes through a router, firewall, or host control. Administrators can record flows and compare them with access rules.
- Compliance scope: Segmentation can reduce the systems in scope for the Payment Card Industry Data Security Standard (PCI DSS) when configuration and evidence show isolation of the cardholder data environment. The standard does not prescribe one segmentation method, so the design must be documented and verified.
VLANs, subnets, host firewalls, and microsegmentation address different problems. The design should match the application flows, protection requirements, maintenance cost, and monitoring capability.
Segmentation effectiveness is assessed through tests of permitted and denied flows, configuration review, and log analysis. The result should confirm that administration paths, backups, and shared services have explicitly described exceptions.
A topology or rule change can affect service availability, latency, and failure handling. The design should document permitted recovery paths, control points, and the change rollback method. Tests also cover management traffic, DNS, time synchronization, and backups.
Test and review results should be retained as evidence that the controls operate. The record includes the tested flows, observed decisions, configuration version, and any unresolved risk with its owner and due date. The same record supports incident analysis and later configuration review, and owners update it after topology or policy changes. The service owner approves the result and the next scheduled review date for audit purposes.