Key points
- VLANs separate Layer 2 broadcast domains
- Routed traffic still needs access controls
- Workload policies can restrict east-west traffic
- Segmentation supports a wider Zero Trust program
- Validate dependencies before enforcing new rules
In this article
A flat network can allow broad communication between connected devices. Network segmentation divides resources into zones and applies controls to the traffic between them. Layer 2 tools such as VLANs are part of that design, alongside routing rules, firewalls and workload controls.
What Is Network Segmentation (L2 Perspective)?
Network segmentation divides resources into smaller segments or zones and applies policy to their communication. Its benefits depend on the design and enforcement.
At Layer 2 (L2) in the OSI model, segmentation typically means:
- VLANs (Virtual LANs)
- Private VLANs
- MAC-based access controls, where supported
- L2 policy enforcement between endpoints
VLANs create separate Layer 2 broadcast domains. They do not automatically enforce least privilege between routed networks, and devices in the same VLAN may still communicate. ACLs, firewalls, private VLANs or host/workload policies are needed to enforce the intended isolation.
Why Organizations Move Beyond Flat Networks
Flat designs often developed around assumptions such as:
- All devices were trusted
- Traffic was minimal
- Security layers were less complex
But today's scenario is different, as follows:
1) Modern Attacks Move Laterally Fast
Broadly permitted internal communication can give a compromised device more reachable systems. The risk depends on existing host and network controls.
Segmentation can restrict lateral movement when traffic rules are enforced and tested. A VLAN layout with unrestricted inter-VLAN routing leaves many attack paths open.
2) Traffic Explosion
Broadcast traffic remains within its VLAN, which can reduce unnecessary local traffic. Segmentation does not remove all congestion or guarantee higher application throughput.
3) Zero Trust & Least Privilege
A segmentation design can support least privilege when it permits only the required communications and denies unnecessary paths.
4) Compliance & Audit Requirements
Segmentation can help isolate sensitive systems and reduce assessment scope in some environments. Applicable requirements and evidence should be checked against the relevant framework. A VLAN layout alone does not establish compliance.
Where Segmentation Is Useful
1. Hybrid & Multi-Cloud Networks
Networks are no longer contained in a single data center. Workloads span branches, SaaS, and cloud, increasing the need for logical segmentation.
2. Remote & Distributed Work
With distributed users, organizations require segmentation to ensure access policies apply consistently from campus to home.
3. Micro-Segmentation for East-West Traffic
Workload-level controls can restrict east-west communication between servers. Enforcement may occur at hosts, virtual networks or other supported policy points.
4. Integration With Zero Trust
Segmentation supports Zero Trust by restricting communication, but identity, device posture, application access and monitoring remain necessary parts of the wider architecture.
Future Vision of Network Segmentation
Possible development directions include:
1. AI-Driven Policy Automation
AI and analytics can help observe traffic and suggest policy boundaries. Teams should validate dependencies and use controlled changes before enforcing suggested rules.
2. Cloud-Native Segmentation
Cloud providers (AWS, Azure, GCP) are building segmentation into VPCs/VNets, making segmentation part of hybrid networking.
3. Integration With Identity & Zero Trust
Segmentation can use identity, device posture and risk context in addition to IP addresses and VLANs, where the chosen platform supports those inputs.
4. Programmable Networks and Secure Access
Software-defined networking (SDN) can support programmable policy enforcement. SASE and SSE can control user access to applications. They do not automatically replace data-center workload microsegmentation.
Industry Approaches and Vendor Examples
Common approaches include:
1) Workload Microsegmentation
Traditionally a data center technology, micro-segmentation lets admins define fine-grained policies between workloads.
Platforms such as VMware NSX and Cisco ACI provide different approaches to policy enforcement. Azure also offers traffic controls such as network security groups and application security groups. Their enforcement models and deployment requirements differ.
2) AI & Analytics-Assisted Policies
Vendors are using AI to:
- Suggest segmentation boundaries based on real observed traffic
- Detect abnormal lateral movement and recommend controlled policy changes
3) Segmenting Remote Access
Remote users can receive access to specific applications through ZTNA or SSE policies. This differs from placing those users in an internal VLAN.
- SASE / SSE platforms
- Zero Trust Network Access (ZTNA)
- Cloud-delivered security policies
Secure-access vendors offer different application-access and policy controls. Verify the selected product’s enforcement points rather than assuming it provides the same isolation as a data-center segmentation platform.
4) Integration Across Security Stack
Segmentation is no longer isolated. It ties into:
- Network firewalls
- Next-Gen IPS/IDS
- EDR/XDR security platforms
- Zero Trust policy engines
5) Policy Orchestration Tools
Policy orchestration can help manage rules across environments. Its benefit depends on supported enforcement points, accurate dependencies and change management.
Practical Next Step
Map the communication paths to your critical systems before changing access rules. Discuss network segmentation requirements with Servicing24 Limited.
Sources and Further Reading
Common questions
Is creating VLANs enough for security segmentation?
No. VLANs separate broadcast domains. Inter-VLAN ACLs, firewalls or other policies are needed to restrict routed access, with controls for same-VLAN traffic where required.
What is microsegmentation?
Microsegmentation applies fine-grained controls between workloads or endpoints, often beyond broad subnet or VLAN boundaries.
Does segmentation always improve performance?
It can reduce unnecessary broadcast traffic. Application performance still depends on routing, bandwidth, inspection and workload behavior.
Does segmentation alone deliver Zero Trust?
No. It supports containment and least privilege, but identity, device posture, application policy and monitoring remain necessary.
How should a segmentation project start?
Identify critical systems and their required communications, observe application dependencies, then pilot and test rules before wider enforcement.
Need help with this in your own setup?
Talk to a Servicing24 engineer. We’ll give you a plan and a clear price.
