Network Segmentation and Infrastructure Design

# Network Segmentation and Infrastructure Design

Introduction

Network segmentation divides a network into smaller, isolated segments to improve security, performance, and manageability. By limiting the scope of broadcast domains, containing security breaches, and controlling traffic flow between segments, segmentation is a cornerstone of secure enterprise network design.

This tutorial covers network segmentation strategies including VLANs, subnets, security zones, DMZ design, micro-segmentation, and zero trust architecture. You will learn how to design segmented networks, implement inter-segment firewalling, and validate segmentation effectiveness.

By the end of this guide, you will be able to design and implement a segmented enterprise network that balances security, performance, and operational simplicity.

Technical Background

Segmentation Concepts

**Flat network**: All devices in a single broadcast domain. Simple but insecure and poorly performing at scale.

**Segmented network**: Multiple broadcast domains connected by routers or firewalls. Traffic between segments requires Layer 3 forwarding and security policy enforcement.

**Security zone**: Logical grouping of network segments with similar security requirements (e.g., production, development, guest, management).

**DMZ (Demilitarized Zone)**: Network segment hosting publicly accessible services (web, email, DNS) isolated from internal networks.

Segmentation Methods

| Method | Layer | Granularity | Typical Use | |--------|-------|-------------|-------------| | VLAN | Layer 2 | Port/subnet | Department or function separation | | Subnet | Layer 3 | IP range | Geographic or logical separation | | Firewall zones | Layer 3-7 | Policy | Security boundary enforcement | | Micro-segmentation | Layer 3-7 | Workload | Zero trust, container isolation | | VPN tunnels | Layer 3 | Site-to-site | Remote access and branch connectivity |

Zero Trust Networking

Zero trust assumes no implicit trust based on network location. Every access request is authenticated, authorized, and encrypted regardless of source network. Key principles:

• Verify explicitly (authenticate and authorize every request)
• Use least privilege access
• Assume breach (design for containment)
• Micro-segmentation limits lateral movement

Prerequisites

• Managed switches with VLAN support
• Firewalls or Layer 3 switches with ACLs
• IP addressing plan
• Network documentation and change management process

Architecture

Three-Tier Segmentation Model

┌─────────────────────────────────────────────────────────────┐
│                    INTERNET / WAN                           │
└───────────────────────┬─────────────────────────────────────┘
                        │
                ┌───────▼───────┐
                │  Edge Firewall│
                └───────┬───────┘
                        │
          ┌─────────────┼─────────────┐
          │             │             │
    ┌─────▼─────┐ ┌────▼────┐ ┌─────▼─────┐
    │   DMZ     │ │ Internal│ │  Guest    │
    │ (Web,     │ │ Network │ │  Wi-Fi    │
    │  Mail,    │ │  (Prod) │ │  (Isolated)│
    │  DNS)     │ │         │ │           │
    └─────┬─────┘ └────┬────┘ └─────┬─────┘
          │             │             │
    ┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼─────┐
    │ Web Servers││ Workstations││ Guest APs │
    │ Mail Servers││ Servers    │ │ Captive   │
    │ DNS Servers││ DB Servers  │ │ Portal    │
    └───────────┘ └───────────┘ └───────────┘

Micro-Segmentation Example

┌─────────────────────────────────────────────────────────────┐
│                    Hypervisor / K8s Cluster                 │
│                                                             │
│  VM/Container A ────┬──── VM/Container B ────┬──── VM C    │
│  (Web tier)         │   (App tier)           │   (DB tier) │
│  VLAN 10 / SG-A     │   VLAN 20 / SG-B       │   VLAN 30   │
│  Allowed: 80,443    │   Allowed: 8080 from A │   Allowed:  │
│                     │   Denied: all else     │   3306 from B│
└─────────────────────────────────────────────────────────────┘

Step-by-Step Implementation

Step 1: Define Security Zones and VLANs

**Purpose**: Create logical grouping of network segments by security level.

**Configuration**:

Zone: TRUSTED (Internal)
  VLANs: 10 (Users), 20 (Servers), 30 (Management)
  Trust level: High
  Access: Restricted to authorized users/devices

Zone: DMZ
  VLANs: 100 (Web), 101 (Mail), 102 (DNS)
  Trust level: Medium
  Access: Internet can initiate to DMZ; DMZ cannot initiate to Internal

Zone: GUEST
  VLANs: 200 (Guest Wi-Fi)
  Trust level: Low
  Access: Internet only; no Internal access

Zone: UNTRUSTED (Internet)
  VLANs: N/A (WAN)
  Trust level: None
  Access: Initiates to DMZ only

**Commands**: None (design phase)

**Expected output**: Documented zone-to-VLAN mapping.

Step 2: Configure VLANs and SVIs

**Purpose**: Create Layer 2 segments with Layer 3 gateways.

**Commands**:

configure terminal
!
vlan 10
 name Users-Production
vlan 20
 name Servers-Production
vlan 30
 name Management
vlan 100
 name DMZ-Web
vlan 200
 name Guest-WiFi
!
interface Vlan10
 ip address 10.1.10.1/24
 description Users-Production-Gateway
!
interface Vlan20
 ip address 10.1.20.1/24
 description Servers-Production-Gateway
!
interface Vlan30
 ip address 10.1.30.1/24
 description Management-Gateway
!
interface Vlan100
 ip address 10.1.100.1/24
 description DMZ-Web-Gateway
!
interface Vlan200
 ip address 10.1.200.1/24
 description Guest-WiFi-Gateway
!
end

**Expected output**: SVIs active with correct IP addresses.

**Verification**:

show ip interface brief
show ip route connected

Step 3: Configure Inter-VLAN Firewall Rules

**Purpose**: Control traffic between security zones.

**Example firewall policy (pseudo-configuration)**:

# Allow Internal users to access DMZ web servers
access-list ACL-INTERNAL-TO-DMZ permit tcp 10.1.10.0 0.0.0.255 10.1.100.0 0.0.0.255 eq 80
access-list ACL-INTERNAL-TO-DMZ permit tcp 10.1.10.0 0.0.0.255 10.1.100.0 0.0.0.255 eq 443
access-list ACL-INTERNAL-TO-DMZ deny ip any any

# Allow DMZ to access Internal DB (specific)
access-list ACL-DMZ-TO-INTERNAL permit tcp 10.1.100.0 0.0.0.255 10.1.20.0 0.0.0.255 eq 3306
access-list ACL-DMZ-TO-INTERNAL deny ip any any

# Guest zone: Internet only
access-list ACL-GUEST permit udp 10.1.200.0 0.0.0.255 any eq 53
access-list ACL-GUEST permit tcp 10.1.200.0 0.0.0.255 any eq 80,443
access-list ACL-GUEST deny ip any any

**Expected output**: Traffic filtered according to zone policy.

Step 4: Implement Micro-Segmentation (Host Firewall)

**Purpose**: Enforce segmentation at the workload level.

**Example** (Linux nftables):

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        iifname "lo" accept
        ct state established,related accept
        ip protocol icmp accept
        tcp dport 22 ip saddr 10.1.30.0/24 accept  # SSH from management only
        tcp dport 80 accept  # Web from anywhere
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
        # Web tier can talk to app tier
        ip saddr 10.1.10.10 tcp dport 8080 ip daddr 10.1.20.10 accept
        # App tier can talk to DB tier
        ip saddr 10.1.20.10 tcp dport 3306 ip daddr 10.1.30.10 accept
        # DB tier cannot initiate to anyone
    }
}

Configuration Examples

Cisco ACL for Inter-VLAN Filtering

!
ip access-list extended INTERNAL-TO-DMZ
 remark Allow users to DMZ web servers
 permit tcp 10.1.10.0 0.0.0.255 10.1.100.0 0.0.0.255 eq 80
 permit tcp 10.1.10.0 0.0.0.255 10.1.100.0 0.0.0.255 eq 443
 remark Deny all other internal-to-DMZ traffic
 deny ip 10.1.10.0 0.0.0.255 10.1.100.0 0.0.0.255
 permit ip any any
!
interface Vlan10
 ip access-group INTERNAL-TO-DMZ in

pfSense/OPNsense Firewall Rules

Rule 1: Internal LAN -> DMZ Web
  Action: Pass
  Protocol: TCP
  Source: 10.1.10.0/24
  Destination: 10.1.100.0/24
  Port: 80, 443

Rule 2: DMZ -> Internal DB
  Action: Pass
  Protocol: TCP
  Source: 10.1.100.0/24
  Destination: 10.1.20.0/24
  Port: 3306

Rule 3: Guest -> Internet
  Action: Pass
  Protocol: Any
  Source: 10.1.200.0/24
  Destination: Any
  Port: Any

Default: Deny all other inter-zone traffic

Kubernetes NetworkPolicy (Micro-segmentation)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-to-app
spec:
  podSelector:
    matchLabels:
      tier: app
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: web
    ports:
    - protocol: TCP
      port: 8080

Verification

Segmentation Validation

# Verify VLAN assignment
show vlan brief
show interfaces switchport

# Verify inter-VLAN routing
show ip route

# Test allowed traffic
ping 10.1.20.10 (from VLAN 10)  -- Should succeed if allowed
telnet 10.1.20.10 3306 (from VLAN 100) -- Should succeed (DMZ to DB)

# Test denied traffic
telnet 10.1.10.10 22 (from VLAN 200) -- Should fail (Guest to Internal SSH)
ping 10.1.10.10 (from VLAN 200) -- Should fail (Guest to Internal)

Firewall Rule Verification

show access-lists              -- Cisco ACL contents
show ip access-list            -- Detailed ACL info
iptables -L -v -n              -- Linux firewall rules
nft list ruleset               -- nftables rules

Expected Results

• Intra-zone traffic flows according to policy
• Inter-zone traffic follows allow/deny rules
• Guest zone cannot reach internal networks
• DMZ can reach Internet and specific internal services
• Management zone restricted to authorized administrators

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | Cannot reach other VLAN | Missing inter-VLAN routing | `ip route show` | Enable `ip routing`; configure SVIs | Routes appear | | Traffic blocked by firewall | ACL denies traffic | `show access-lists` | Add permit rule before deny | Traffic flows | | Guest can reach internal | Missing deny rule or wrong zone | Firewall rule order | Add explicit deny; verify zone assignment | Guest blocked | | Broadcast storm in VLAN | Large flat VLAN | `show mac address-table count` | Segment VLAN; add Layer 3 boundary | Broadcast domain reduced | | DMZ server unreachable from Internet | NAT or firewall missing | Firewall NAT rules | Add NAT and allow rule | External access works | | Asymmetric routing | Different paths for outbound/inbound | `traceroute` both directions | Align routing policies | Symmetric paths | | VLAN hopping | Native VLAN mismatch or DTP | `show interfaces trunk` | Set native VLAN; disable DTP | Hopping prevented | | Management access lost | Management ACL too restrictive | `show access-lists` | Permit admin subnet | Management restored | | Micro-segmentation blocking app | NetworkPolicy too restrictive | `kubectl get networkpolicy` | Adjust policy selectors/rules | App communication restored |

Best Practices

1. **Default deny**: Deny all inter-zone traffic by default; explicitly permit only required flows. 2. **Document traffic flows**: Maintain a matrix of allowed communication between zones. 3. **Separate management plane**: Use out-of-band or dedicated management VLAN with strict access controls. 4. **Implement DMZ for public services**: Isolate Internet-facing servers from internal networks. 5. **Use micro-segmentation for critical workloads**: Apply host-level firewalls or NetworkPolicies for containers and VMs. 6. **Review segmentation regularly**: Audit firewall rules quarterly; remove unused rules. 7. **Test segmentation**: Periodically verify that unauthorized cross-zone traffic is blocked. 8. **Log denied traffic**: Enable logging on deny rules for security monitoring and troubleshooting. 9. **Use named objects**: Use network objects/groups in firewall configurations for maintainability. 10. **Plan for growth**: Reserve VLAN and subnet space for future segments.

Conclusion

Network segmentation is fundamental to secure, manageable enterprise networks. By dividing networks into security zones with enforced boundaries, organizations limit blast radius from security incidents, reduce broadcast domains, and simplify troubleshooting. Combined with firewalls, ACLs, and micro-segmentation, segmentation enables zero trust architectures where trust is never implicit and every communication is explicitly verified. Design segmentation with both security and operational simplicity in mind, and validate regularly.

References

• NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy (https://csrc.nist.gov/)
• NIST SP 800-207 - Zero Trust Architecture (https://csrc.nist.gov/)
• Cisco SAFE Design Guide (https://www.cisco.com/c/en/us/solutions/enterprise/design-guide.html)
• VMware NSX Micro-Segmentation Guide (https://docs.vmware.com/)
• Kubernetes NetworkPolicy documentation (https://kubernetes.io/docs/concepts/services-networking/network-policies/)
• SANS Network Segmentation (https://www.sans.org/)