Network Segmentation Strategies

Network Segmentation Strategies

Designing network segmentation and isolation — from VLANs and subnets through micro-segmentation, zero-trust network access, and multi-tenant isolation.

When to Use

• Segregating sensitive systems from general access
• Implementing compliance requirements (PCI, HIPAA)
• Containing breaches through lateral movement prevention
• Designing multi-tenant SaaS infrastructure
• Implementing zero-trust network principles

Segmentation Models

SEGMENTATION_MODELS = {
    'flat': 'Single network — all systems can communicate (legacy, insecure)',
    'vlan_based': 'Logical segments by function (DMZ, internal, production, staging)',
    'micro_segmentation': 'Granular per-workload policies (zero-trust, SaaS multi-tenant)',
    'overlay': 'Software-defined segmentation on top of physical network (VXLAN, SDN)',
}

SEGMENTATION_TIERS = {
    'public': 'Internet-facing (web servers, API gateways, load balancers)',
    'application': 'Business logic (app servers, microservices)',
    'data': 'Databases, storage, caches (most restricted access)',
    'management': 'Administrative access (SSH, RDP, bastion hosts)',
    'internal_services': 'Internal tools, monitoring, CI/CD',
}

# Firewall rule pattern for segmentation
SEGMENTATION_RULES = """
# Internet → DMZ (web)
allow proto tcp from any to DMZ port 443
# DMZ → Application (backend API)
allow proto tcp from DMZ to APP port 8080
# Application → Database (read/write)
allow proto tcp from APP to DATA port 5432
# Deny everything else
deny ip any any
"""

Common Pitfalls

1. Overly permissive rules — "allow any any" between segments defeats segmentation
2. Segment sprawl — hundreds of tiny segments become unmanageable; group by function
3. No east-west monitoring — lateral movement between segments isn't monitored
4. Flat inside the segment — once inside a segment, no further controls; implement host-based firewalls too
5. Dependence on IP addresses — IP-based segmentation breaks with dynamic IPs; use identity-based

Verification Checklist

• Network tiers defined (public, app, data, management)
• Segmentation rules documented and enforced (firewall)
• Only required traffic allowed between segments
• East-west traffic monitored and logged
• Micro-segmentation for critical workloads (if applicable)
• Segmentation tested (attempt lateral movement, verify blocks)
• Compliance requirements met (PCI, HIPAA, SOC2)
• Overlay segmentation for multi-tenant (VXLAN, SDN)