What Is Network Segmentation?

Network segmentation is the process of dividing a network into smaller logical or physical sections.

Instead of allowing every device to communicate freely with every other device, segmentation creates boundaries between different groups of devices.

                Internet
                   |
                Firewall
                   |
          +--------+--------+
          |                 |
      User Network       Server Network
      192.168.10.0/24    192.168.20.0/24
          |                 |
    +-----+-----+       +---+---+
    |           |       |       |
  PCs/Laptops   WiFi   Web DB  Files
    

Why Is Network Segmentation Important?

• Limits unauthorized access
• Reduces lateral movement
• Contains security incidents
• Improves network organization
• Separates sensitive systems
• Improves troubleshooting
• Allows different security policies

For example, a compromised guest laptop should not automatically be able to communicate with database servers or network-management systems.

What Is a VLAN?

A VLAN (Virtual Local Area Network) logically separates devices at Layer 2 of the network.

Devices can be connected to the same physical switch while belonging to different logical networks.

                Switch
      +-------------------------+
      |                         |
   VLAN 10                  VLAN 20
   Users                   Students
      |                         |
 PC1  PC2  PC3             PC4  PC5
    

Devices in different VLANs normally require Layer 3 routing to communicate with each other.

Example VLAN Design

What Is a Subnet?

A subnet is a logical division of an IP network. Subnetting allows administrators to divide a larger IP network into smaller IP networks.

For example:

```

192.168.1.0/24

can be divided into:

192.168.1.0/26
192.168.1.64/26
192.168.1.128/26
192.168.1.192/26 

Each subnet represents a separate Layer 3 IP network.

VLAN vs Subnet

In many enterprise designs, one VLAN is associated with one IP subnet, although the concepts are not identical.

What Are Security Zones?

A security zone is a network area with a defined security level and access policy.

              INTERNET
                 |
              Firewall
                 |
         +-------+-------+
         |               |
      DMZ Zone        Internal Zone
         |               |
      Web Server      User Network
                         |
                    Server Network
    

Common security zones include:

• Internet / Untrusted Zone
• DMZ
• Internal User Zone
• Server Zone
• Guest Zone
• Management Zone
• IoT Zone

What Is a DMZ?

A DMZ (Demilitarized Zone) is a network segment used for systems that need to be reachable from less-trusted networks while remaining separated from the internal network.

Public-facing web servers are a common example.

```

Internet
|
Firewall
|
+---- DMZ ---- Web Server
|
+---- Internal ---- Employees
|
Database 

A properly designed firewall policy can prevent a compromised public-facing server from having unrestricted access to internal systems.

How Segmentation Reduces the Attack Surface

The attack surface represents the systems, services, applications, interfaces, and paths that an attacker could potentially target.

Segmentation can reduce attack opportunities by limiting which systems can communicate with each other.

    Flat Network
```

PC1 --- PC2 --- PC3 --- Server --- Database
|       |       |        |          |
+-------+-------+--------+----------+

Problem:
Many systems may be reachable from many other systems.

```
    Segmented Network
```

Users ---- Firewall ---- Servers ---- Database
|
Guest Network

Management ---- Separate Security Controls

Result:
Fewer permitted communication paths. 

Example: Guest Wi-Fi

Guest users should normally not have direct access to internal business systems.

```

Guest Wi-Fi
192.168.40.0/24
|
v
Firewall
|
+---- Internet       ALLOWED
|
+---- Internal LAN   BLOCKED
|
+---- Database       BLOCKED 

This limits the potential impact of a compromised guest device.

Microsegmentation

Microsegmentation applies segmentation at a much more granular level.

Instead of simply separating entire departments, policies can control communication between individual workloads, applications, services, or groups of devices.

Microsegmentation is commonly associated with modern data centers, cloud environments, and Zero Trust security architectures.

Common Segmentation Technologies

Practical Cisco VLAN Example

```

Switch(config)# vlan 10
Switch(config-vlan)# name USERS

Switch(config)# vlan 20
Switch(config-vlan)# name SERVERS

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20 

Best Practices

• Separate guest devices from internal systems.
• Place servers in appropriate security zones.
• Separate management traffic from normal user traffic.
• Use firewalls or ACLs to control inter-segment traffic.
• Do not assume that a VLAN alone provides complete security.
• Use least-privilege communication rules.
• Monitor traffic between important network segments.
• Review segmentation rules regularly.

Quick Quiz

1. At which OSI layer does a VLAN primarily operate?
2. What is the purpose of subnetting?
3. Why should guest Wi-Fi normally be separated from internal networks?
4. What is a DMZ?
5. What does microsegmentation provide?

Key Takeaways

• VLANs provide logical Layer 2 segmentation.
• Subnets divide IP networks at Layer 3.
• Security zones group systems according to security requirements.
• Firewalls and ACLs control communication between segments.
• Segmentation can reduce lateral movement.
• Microsegmentation provides more granular control.
• Segmentation is an important part of reducing network attack surfaces.