Chapter 17: Network Security Architecture and Segmentation

Network segmentation divides a network into smaller, isolated sections to limit the blast radius of security incidents, enforce policy boundaries, and improve manageability. Think of segmentation like the watertight compartments on a ship: if one compartment is breached, the bulkheads prevent the entire vessel from flooding.

1.1 VLAN-Based Segmentation

VLANs are the most fundamental form of segmentation. They create Layer 2 broadcast domain boundaries, and inter-VLAN communication requires a Layer 3 device where ACLs can filter traffic.

• Provides macro-segmentation by grouping devices into subnets based on function, department, or security level
• Policy is topology-dependent: a device's VLAN assignment is tied to the physical or logical port
• Limitation: VLAN sprawl is a management burden in large enterprises; ACLs grow complex; cannot enforce policy within a single VLAN

1.2 VRF-Based Segmentation

Virtual Routing and Forwarding (VRF) creates entirely separate routing tables within the same physical infrastructure. Each VRF maintains its own independent Forwarding Information Base (FIB).

1.3 Fusion Firewall Architecture

In modern campus architectures, the fusion firewall handles communication between separate Virtual Networks (VNs) or VRFs, providing stateful inspection at segmentation boundaries with application-layer visibility.

1.4 TrustSec and SGT-Based Segmentation

Cisco TrustSec assigns a Security Group Tag (SGT) -- a 16-bit identifier -- to traffic based on the identity of the user or device. This decouples security policy from network topology entirely.

How SGTs Work:

1. A user or device connects to the network
2. Cisco ISE authenticates the endpoint (via 802.1X, MAB, or WebAuth)
3. ISE assigns an SGT based on identity attributes: role, department, device type, posture
4. The SGT is embedded in the Ethernet frame (inline tagging) or shared via IP-to-SGT mappings (SXP)
5. Enforcement points apply SGACLs based on source SGT and destination SGT

Figure 17.1: SGT Assignment and SGACL Enforcement Flow

1.5 Macro-Segmentation vs. Micro-Segmentation

Figure 17.2: Layered Macro and Micro-Segmentation Architecture

1.6 Segmentation in SD-Access and ACI

SD-Access uses VXLAN overlays with LISP. Virtual Networks (VNs) map to VRFs for macro-segmentation. SGTs within VNs provide micro-segmentation enforced by fabric edge nodes. A fusion firewall handles inter-VN traffic.

ACI uses Endpoint Groups (EPGs) and Contracts to define allowed communication. VRFs and Bridge Domains provide Layer 3/Layer 2 isolation. Both platforms integrate with ISE for identity-based policy.

Network Access Control (NAC) is the gatekeeper that determines who and what gains access and under what conditions. NAC directly feeds segmentation: the authentication result determines the VLAN, SGT, ACL, or policy applied to the endpoint.

2.1 802.1X and MAB Design

802.1X is the IEEE standard for port-based network access control using EAP for authentication before granting network access.

The Three Roles:

• Supplicant: Software on the endpoint (built into Windows, macOS, Linux)
• Authenticator: The switch port or wireless controller that controls access
• Authentication Server: Cisco ISE, which evaluates credentials against identity stores

MAB (MAC Authentication Bypass): For devices without 802.1X supplicants (printers, IoT sensors, cameras). The switch submits the MAC address to ISE as credentials. Typical authentication order: 802.1X first, then fall back to MAB after timeout.

2.2 ISE Deployment Architecture

2.3 Phased ISE Deployment

Figure 17.3: Phased ISE Deployment -- Monitor, Low-Impact, and Closed Mode

2.4 BYOD and Guest Access

BYOD: Personal devices are redirected to a self-service portal, provisioned with certificates, and granted limited access based on posture and identity. BYOD devices receive a different SGT than corporate-managed devices.

Guest Access (CWA):

1. Guest connects (no supplicant), switch times out 802.1X, initiates MAB
2. ISE returns URL-redirect authorization to guest portal
3. Guest enters credentials (sponsor-approved, self-registration, or social login)
4. ISE issues CoA (Change of Authorization) applying guest VRF + guest SGT + restricted ACL

Figure 17.4: Central Web Authentication (CWA) Guest Access Flow

2.5 Remote Access: VPN vs. ZTNA

Figure 17.5: Traditional VPN vs. ZTNA Traffic Flow

3.1 Firewall Placement and Zone Design

A firewall zone is a logical grouping of interfaces sharing a common security policy. Traffic within a zone flows freely; traffic between zones is subject to inspection.

Extended zones include: Management (out-of-band), Database (isolated tier), PCI (cardholder data), and Partner/Extranet (B2B).

NGFW integrates: (1) Stateful packet inspection + NAT + VPN, (2) IPS -- signature and anomaly-based detection, (3) Application control -- identifies traffic by application, not just port/protocol.

3.2 IPS/IDS Placement

Figure 17.6: Defense-in-Depth -- Independent Security Layers

3.3 DMZ and Service Edge Design

Single Firewall DMZ (Three-Legged): One firewall with three interfaces. Simple but single point of failure -- compromise exposes both DMZ and internal network.

Dual Firewall DMZ (Recommended): Outer firewall between internet and DMZ, inner firewall between DMZ and internal. Advantages:

• Compromise of outer firewall does not expose internal network
• Vendor diversity reduces risk of single vulnerability compromising both layers
• Each firewall has a simpler, more focused rule set

Service Edge Principles: Public services belong in the DMZ. DMZ servers should never initiate connections to internal networks. Database servers reside behind the inner firewall, accessible only from the application tier.