A flat network is convenient. The laptop that reads mail can see the file server, the camera, the printer, and the management panel. Until one of those devices starts talking for an intruder, that convenience is the whole blast radius.
Segmentation is a decision about who is allowed to talk to whom. The VLAN, the firewall, and the ACL are how that decision gets enforced and checked.
A label on the port is not a zone yet
Moving printers to “VLAN 20” changes nothing if the router between VLANs allows every port. The drawing shows two networks. The packets show one.
A zone starts at the filter: default deny, and a short allow list. An allow has a source, a destination, and a port. “The office network to the server network” is too wide if the office does not need SMB to the domain controller or RDP to everything that listens.
Four zones are enough to start
On a small network I do not draw forty zones. I draw a split that survives a sheet of paper:
- users — laptops and desktops, where mail and the browser live
- servers — what holds the data and the services
- management — switches, iLO, the hypervisor, the panels
- the rest — guests, cameras, printers, anything I will not keep in the same drawer as the directory
Then the concrete lines:
- a user reaches the service they actually use, on the port it actually listens on
- a camera does not reach the directory or the file shares
- a guest reaches nothing but the way out to the internet
- the management panel opens from the admin workstation, not from every laptop in the office
If you cannot write a line down, the firewall line will be “any” anyway.
What it is for
One compromise reaches less. A laptop on the user network does not scan management, because that path is not there. A log on the zone boundary can be read: you see what tried to cross, rather than “all internal traffic”. A rule can be checked — the packet passes, or it does not.
When “the rule does not work”, check the stack from the bottom before you touch policy. The order is on the network troubleshooting cheat sheet: interface, address, gateway, DNS, route, then the service.
What the filter alone does not settle
An account that is allowed everywhere will cross every zone it is allowed into. A program running on the file server is already there — it does not need a new route. Segmentation is a network boundary. The account, the backup, and the admin workstation are a separate problem: isolation.
On a production network the change starts from a drawing and from a list of what is exposed today. Turning off “all internal traffic” on a Friday afternoon is not a segmentation project. It is an outage you ordered yourself.