Segmentation and Next-Gen Firewalls

• Containment is how a single exploited host stops being a full-network compromise — the single biggest win in defense.
• Regulators and auditors now inspect east-west flows, not just the perimeter ACL.
• NGFW features (app ID, user ID, TLS decryption) let you filter by what the traffic does, not only its destination port.

A fire in one workshop does not gut the whole building because the compartments are sealed and the doors self-close.

• Zones are defined by policy intent: e.g. 'web-zone', 'app-zone', 'data-zone', each with its own ACL and routing rules.
• VLANs put zone isolation at layer 2; inter-zone traffic hits the firewall or the ACL-able router/firewall, never a flat bridge.
• NGFWs rebuild application streams (TLS decryption, app-ID) so a rule like 'allow HTTPS to CRM asset' matches an app, not an IP.
• Micro-segmentation (often via workload/service-mesh) applies the same zone principle at container and VM granularity.

• A bank separates card-processing VLANs from general traffic so a compromised workstation cannot reach the payment pinset.
• An e-commerce site places public web in the DMZ and keeps the order DB two zones deep with only one allow rule.
• A Kubernetes fleet uses network policies as per-namespace zones, blocking all east-west by default.

• Make the default deny and the allow list tiny and explicit — document the intent of every rule.
• Split management plane traffic (SSH to appliances) into its own zone with jump-host control.
• Enforce stateful sessions and source/dest verification (uRPF, BCP38) at the edge.
• Review the rule set quarterly; delete rules nobody can explain within a release.

• A 'DMZ' that is really just a VLAN with the same firewall rules as the inside — a naming-only boundary.
• Wide-open east-west: nobody contains the lateral move, so one phished laptop reaches the backups.
• Blocking ports but leaving legacy protocols (SMB, RDP) allowed everywhere because 'apps need them'.
• Treating segmentation as a firewall rule instead of a whole-system discipline (DNS, routes, Wi-Fi too).

• Test reachability from inside each zone with nc -vz; map cross-zone paths in a small table.
• When 'the firewall blocks everything' watch state tables — asymmetric routing poisons entries.
• Log dropped traffic during rollout and diff the noise against intended flows before tuning.

• Only test segmentation on your own lab/network; probing others' zones without authorization is illegal.
• Document the compliance stance: zone models back up PCI/SOC/ISO evidence around 'system components'.
• Require an owner per zone; orphaned segments are unmanaged risk.