Network Segmentation

In Firewall basics, you saw a firewall separate the inside network from the internet and the DMZ. But what about the inside network itself? In many small offices, every device, from the manager's laptop to the coffee machine, sits in one large network where any device can talk to any other. Segmentation fixes that.

💡 In simple terms: a ship is built with watertight compartments. If the hull is damaged, one compartment floods, the doors close and the ship stays afloat. A segmented network works the same way: one compromised device affects one compartment, not the whole ship.

What network segmentation is

Network segmentation means dividing a network into smaller parts, called segments or zones, and then controlling the traffic between them with rules. It needs two things:

1. Separation: devices are placed in different networks, so they can't reach each other directly.
2. Control: a device in the middle (normally a firewall) decides which traffic may cross from one segment to another.

Separation without control is just tidiness. Control without separation is impossible, because the firewall can't check traffic that never passes through it. Segmentation needs both.

Why it matters: the flat network problem

A flat network is one big segment: one subnet, one broadcast domain and no internal rules. It is simple to build, and it works well until something malicious gets in.

Lateral movement

Attackers rarely break straight into the most valuable server. They first get a foothold somewhere easy, such as a laptop through a phishing email or a camera with a default password. Then they move sideways from device to device, looking for something valuable. This is called lateral movement. On a flat network, nothing stands in their way.

Blast radius

The blast radius is how much can be damaged when one thing goes wrong. For example, ransomware on one PC in a flat network can scan and encrypt every reachable file share. In a segmented network, it can only reach what that PC's segment is allowed to reach.

Other benefits

• Least privilege for networks: each group can reach only what it needs, the same least-privilege principle used for user accounts.
• Visibility: traffic between segments passes through a firewall, which logs it, so unusual flows stand out.
• Smaller broadcast domains: each segment is its own broadcast domain, so broadcasts such as ARP and DHCP stay local.
• Compliance: security standards for card payments and health data expect sensitive systems to be separated from everything else.
• Containing faults: a misbehaving device, such as a rogue DHCP server or the cause of a broadcast storm, only affects its own segment.

Where segmentation happens

The key fact is this: traffic inside one subnet never passes through the firewall. Two PCs in 192.168.10.0/24 talk directly through the switch, using ARP to find each other's MAC address. A PC sends a packet to its default gateway only when the destination is in a different subnet. So the boundary between segments is the router or firewall that acts as the default gateway, and that is where the rules are applied.

This is the same different-subnet journey that a later lesson follows step by step, with the firewall acting as the router.

Learn more: Different-Subnet Communication

Ways to segment a network

VLANs, conceptually

VLANs deserve a closer look because they are the most common segmentation tool. Without VLANs, five segments would need five sets of switches. With VLANs, one switch can carry all five: the administrator assigns each port to a VLAN, and the switch never forwards frames between VLANs. Each VLAN is its own broadcast domain. A link that carries several VLANs between switches (a trunk) tags each frame with its VLAN number, so the VLANs stay separate.

Remember: a VLAN separates devices, but it doesn't decide what may cross. If the device that routes between VLANs simply allows everything, you have several subnets but the security of one flat network. The rules on that routing device are what make segmentation a security control.

Going further (CCNA): how to create VLANs, assign ports and configure trunks on Cisco switches is covered in the CCNA lesson VLANs and trunks. You don't need it for this course.

Guest networks

Guest Wi-Fi is the simplest form of segmentation most people use. The access point broadcasts a second network name (SSID) that is mapped to its own segment, 192.168.50.0/24, with its own DHCP range. The firewall allows guests to reach the internet and denies everything towards internal subnets. Good guest networks also turn on client isolation, so guests can't reach each other either.

Learn more: Wireless Security

The DMZ

A DMZ (demilitarised zone) is a segment for systems that must accept connections from the internet: a public website, a mail gateway, a VPN portal. Because they are exposed, they are the most likely to be attacked, so they are kept out of the internal network. A typical rule set says:

• The internet may reach the DMZ on a few ports only.
• The DMZ may reach the inside only on very specific ports, for example from the web server to the database.
• The inside network may manage the DMZ.

Example: segmenting a small office

Here is a 60-person office that has been redesigned from one flat network into seven segments. The firewall is the default gateway (.1) in every segment.

Next come the allowed flows. Anything not listed is blocked by the implicit deny at the end of the rule list.

Designing your own segments

1. List the groups of devices and people: staff, servers, guests, IoT devices and admin interfaces.
2. Rank their trust. Anything you can't patch or control, such as IoT devices and guests, gets low trust.
3. Write down the flows each group really needs. Ask the application owners which ports their applications use.
4. Give each segment its own subnet (and usually its own VLAN and DHCP scope). The Subnet Calculator helps you plan the ranges.
5. Make the firewall the default gateway for each segment, allow only the listed flows, and log everything that is denied.
6. Watch the logs for a few weeks. Add rules for genuine needs you missed, and question everything else.

What happens when segmentation goes wrong

Troubleshooting and useful commands

Start by checking which segment a device is actually in:

C:\> ipconfig
Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : office.example
   IPv4 Address. . . . . . . . . . . : 192.168.10.23
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.1

Then check whether traffic crosses the firewall, and where it stops. The -d option skips name lookups, so the output shows only IP addresses:

C:\> tracert -d 192.168.30.10
Tracing route to 192.168.30.10 over a maximum of 30 hops

  1     2 ms     1 ms     1 ms  192.168.50.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
^C

Finally, test the exact service a user needs:

PS C:\> Test-NetConnection 192.168.30.10 -Port 445
ComputerName     : 192.168.30.10
RemoteAddress    : 192.168.30.10
RemotePort       : 445
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.10.23
TcpTestSucceeded : True

Common mistakes

• Creating VLANs and then allowing everything between them. This gives separation without control, so an attacker can still move freely between segments.
• Putting IoT devices in the staff segment. Cameras and printers are often old and unpatched, so they belong in a low-trust segment.
• Forgetting the management network. The admin pages of switches, access points and the firewall should be reachable only from IT admin PCs.
• Creating too many tiny segments at once. Start with a few clear zones; complex designs lead to mistakes.
• Treating VPN users as fully trusted. Give VPN users their own segment and only the access they need.
• Not logging denied flows. The logs are how you notice both a missing rule and an attacker.

Knowledge check

Where to go next

You now know the four pillars of network security covered in this course: the principles in Basic network security, the rules in Firewall basics, protected paths with VPN basics, and the zones in this lesson. Next, the course puts everything together and follows packets end to end, starting with Same-subnet communication.