Network segmentation cheat sheet — VLANs, firewall rules, and microsegmentation
Network Segmentation Tiers
Tier 1: Basic VLANs (minimum viable)
- Separate user, server, IoT, and guest traffic
- Inter-VLAN routing through firewall (not L3 switch)
- ACLs preventing IoT → Server and Guest → anything internal
Tier 2: Zone-based (recommended)
- DMZ for internet-facing services
- Management VLAN for switches, APs, IPMI/iDRAC
- Separate VLANs per department or security level
- Firewall rules: deny all, allow specific
Tier 3: Microsegmentation (advanced)
- Per-workload firewall policies
- East-west traffic inspection
- Identity-based access (not just IP-based)
- Tools: VMware NSX, Illumio, Guardicore
Common mistakes
- VLANs without firewall rules between them (VLANs alone don't provide security)
- Management interfaces on the same network as user traffic
- Flat server network where every server can talk to every other server
- No monitoring of inter-VLAN traffic
AlertMonitor's network mapping can help visualize your current segmentation and identify devices in the wrong VLAN.
The "VLANs without firewall rules" point is so important. I audit networks where they proudly show me 10 VLANs but the L3 switch routes between all of them with no ACLs. That's a flat network with extra steps.
For the management VLAN: this should be the most restricted VLAN on your network. Only jump hosts/PAWs should have access. I've seen networks where any user can access switch management interfaces.
Microsegmentation tip: start with your crown jewels (domain controllers, database servers, backup servers). Segment those first, then work outward. Don't try to microsegment everything at once.
Document your firewall rules. Sounds obvious but I've inherited firewalls with 2000+ rules and nobody knows what half of them do. AlertMonitor's network mapping shows actual traffic flows which helps identify what rules are actually needed vs legacy cruft.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access