Network Segmentation: Fundamentals, Models, Best Practices and When to Use It

Understand network segmentation, models such as VLAN, DMZ, Zero Trust and microsegmentation, and when to use each approach in corporate, industrial, cloud and critical-infrastructure environments.

Check it out!

Network segmentation is the planned division of a communications infrastructure into smaller domains, with explicit technical and policy boundaries that limit which assets, users, applications, and services may exchange traffic with one another.

In a professional design, segmentation does not mean merely creating VLANs. The architecture must combine addressing, subnets, routing, ACLs, firewalls, zones, identity, monitoring, and test criteria to reduce lateral movement, limit the impact of failures, and make authorized flows verifiable.

The appropriate strategy depends on the environment. Corporate networks, data centers, cloud, IP CCTV, IoT, and OT/ICS require different levels of isolation, availability, and granularity. The goal is to apply least privilege to network communications as well, without creating an architecture so complex that it becomes unmanageable.

What Is Network Segmentation?

Network segmentation is an architectural strategy that divides a network into smaller, controllable parts. Each segment groups assets, users, applications, data, or services with similar communication and security requirements.

In practice, segmenting a network may involve VLANs, subnets, ACLs, firewalls, NGFWs, DMZs, NAC, SDN, identity-based policies, cloud-native resources, endpoint agents, service meshes, and Zero Trust Network Access (ZTNA) models. The right choice depends on risk, asset criticality, operational maturity, legacy environments, and the need to preserve availability, especially in industrial networks and critical infrastructure.

The objective is not merely to organize IP addresses. The objective is to control who can communicate with whom, through which protocol, in what context, and with what privilege level. In an unsegmented network, a compromised device can reach many other internal assets. In a segmented network, this reach is reduced by explicit technical rules and policies.

Segmentation, Isolation, and Filtering: What Is the Difference?

Although the terms are often used together, they are not identical:

• Segmentation: division of the network into zones, VLANs, subnets, domains, or microsegments.
• Isolation: effective separation among assets or groups of assets to prevent unauthorized communication.
• Filtering: application of rules that allow, deny, log, or inspect traffic between segments.

A VLAN by itself creates logical separation at Layer 2. However, if inter-VLAN routing is allowed without control, segmentation may exist on the diagram but fail to perform its security function. Segmentation should therefore be treated as an architectural discipline, not merely as switch configuration.

Essential Concepts

Several concepts frequently appear in segmentation projects:

• VLAN: Layer 2 logical domain used to separate groups of devices within a LAN.
• Subnet: logical division of IP addressing, normally associated with routing between segments.
• ACL: access control list used to allow or deny traffic based on source, destination, port, and protocol.
• Firewall zone: logical grouping of interfaces or networks subject to a security policy.
• DMZ: intermediate zone for exposed services, reducing the risk of directly exposing the internal network.
• Microsegment: small segment often associated with an application, workload, service, or specific flow.
• North-south traffic: communication between the internal network and an external environment, such as the internet, cloud, or partners.
• East-west traffic: lateral communication within the network itself, common among servers, applications, and microservices.
• PEP and PDP: in a Zero Trust context, the Policy Enforcement Point applies the access decision, while the Policy Decision Point evaluates the policy.

Why Segment Networks?

Reduce Lateral Movement

One of the main reasons to segment networks is to limit lateral movement. After an attacker compromises a workstation, IP camera, outdated server, or user account, the next step is usually to look for other reachable assets. If the network is flat, exploitation spreads more easily. If the network is segmented, the attacker encounters additional barriers before reaching servers, databases, industrial systems, backups, and administrative consoles.

Reduce the Blast Radius

The term blast radius describes the potential reach of an incident. In segmented networks, the impact of a failure, malware infection, compromised credential, or misconfiguration tends to remain more contained. This does not eliminate the need for endpoint protection, backups, MFA, and monitoring, but it reduces the affected area when something fails.

Increase Visibility and Response Capability

Well-designed segments make traffic inspection, event logging, and anomalous-behavior detection easier. When there are clear boundaries among users, servers, CCTV, automation, guests, cloud, and administration, it becomes simpler to identify unexpected flows and respond to incidents precisely.

Apply Least Privilege to the Network

The principle of least privilege does not apply only to users and systems. It should also be applied to network flows. An application server should access only the databases it needs. An IP camera should communicate only with the VMS, NTP, and authorized services. A vendor should access only the contracted resource, not the entire corporate network.

Support Zero Trust

Zero Trust architectures assume that network location alone should not create automatic trust. Instead of trusting everything that is “inside,” the architecture evaluates identity, context, device posture, resource sensitivity, and access policy. Segmentation and microsegmentation are important mechanisms for reducing implicit trust zones and bringing access control closer to protected resources.

Technical Foundations of Network Segmentation

Layer 2 Segmentation

Layer 2 segmentation typically uses VLANs to separate broadcast domains. It is common to create VLANs for users, servers, voice, corporate Wi-Fi, guests, CCTV, building automation, administration, and IoT devices.

This model is widely used because it leverages existing switch infrastructure. However, it requires care with trunks, native VLANs, default VLANs, unused ports, and improper VLAN propagation. Good practice is to allow only the required VLANs on trunks, disable dynamic trunking, remove the default VLAN from operational use, and document each VLAN with a clear purpose.

Layer 3 Segmentation

At Layer 3, separation occurs through consistently sized subnets, routing, VRFs, and policies applied between networks. This model enables communication control by source and destination IP, but it must be combined with ACLs, firewalls, or equivalent policies. Otherwise, address separation does not prevent broad communication between segments.

In larger architectures, routing choices also affect propagation boundaries and available paths between zones. Protocols such as OSPF e BGP must be handled together with summarization, filters, policies, and prevention of improper advertisements between domains.

Layer 4 Segmentation

At Layer 4, rules consider ports and protocols. A simple example is allowing workstations to access an application over TCP/443 while preventing direct connections to the database. This approach is useful but limited when modern applications use common ports for multiple services.

Layer 7 Segmentation

At Layer 7, control begins to consider applications, users, content, and context. Next-generation firewalls, WAFs, proxies, and SASE/ZTNA solutions can apply more refined policies than rules based only on IP and port. This topic connects directly with A3A’s article on NGFW: What Is a Next Generation Firewall and When to Use It.

Identity- and Context-Based Segmentation

More modern models use attributes beyond the IP address. Policy can consider user, group, device, security posture, location, time, accessed application, session risk, data sensitivity, and observed behavior. This approach is essential for cloud, remote users, distributed applications, and Zero Trust environments.

Layer or criterion	Typical mechanism	What it controls	Limitation if used alone
Layer 2	VLAN	Broadcast domains and port association	Does not prevent communication between VLANs when routing is permissive
Layer 3	Subnets, VRFs, and routing	Reachability between prefixes and logical paths	Separating addressing is not equivalent to applying a security policy
Layer 4	ACLs and port/protocol policies	Services allowed between source and destination	Provides little semantic context when different applications share common ports
Layer 7	NGFW, proxy, WAF, and application controls	Application, content, and session context	Requires inspection capability and policy governance
Identity and context	NAC, ZTNA, and workload policies	User, device, posture, application, and risk	Depends on inventory, trusted identity, and platform integration

Network Segmentation Models

Macrosegmentation

Macrosegmentation divides the network into large domains such as users, servers, guests, CCTV, OT, administration, telephony, Wi-Fi, and DMZ. It is a fundamental step for networks that are still largely flat.

When to use: traditional networks, initial modernization projects, separation among business areas, and environments where there is not yet enough inventory for microsegmentation.

VLAN and Subnet Segmentation

This is the most common model in corporate LANs. Similar devices are grouped into different VLANs and subnets. Traffic between them passes through routers, Layer 3 switches, firewalls, or gateways.

Advantages: operational familiarity, low incremental cost, and compatibility with existing infrastructure.

Limitations: IP-based policies can become difficult to maintain; dynamic and cloud environments reduce the effectiveness of static rules; VLANs without inter-segment controls do not provide sufficient security.

Firewall- and Zone-Based Segmentation

In this model, segments are represented by security zones. Rules determine which flows are allowed, denied, inspected, and logged. The recommended approach is deny-by-default and permit-by-exception: everything is denied by default, and only necessary flows are allowed.

This model is suitable for controlling traffic between users and servers, the DMZ and internal network, third-party networks, backup environments, administration, and critical zones.

DMZ

A DMZ is an intermediate zone used for services that need to interact with external networks, such as portals, reverse proxies, VPN concentrators, integration servers, and published applications. The goal is to prevent an internet-exposed service from having direct and broad access to the internal network.

A well-designed DMZ controls flows in three directions: external to DMZ, DMZ to internal, and internal to DMZ. Each flow should have a justification, port, protocol, source, destination, and logging requirement.

NAC and Device-Based Segmentation

Network Access Control (NAC) controls who can enter the wired or wireless network. It can use 802.1X, certificates, user authentication, device posture, and dynamic VLAN assignment. Unknown or noncompliant devices can be blocked, quarantined, or directed to a restricted network.

It is especially useful in environments with extensive circulation of laptops, third parties, mobile devices, meeting rooms, corporate Wi-Fi, and guests.

OT/ICS Segmentation

Industrial networks and control systems require special care. Availability, operational safety, and compatibility with legacy equipment are often more important than flexibility. Therefore, OT segmentation should separate corporate and industrial networks, create zones and conduits, control remote access, use an industrial DMZ, and monitor specific protocols.

When security agents are not supported by PLCs, HMIs, relays, sensors, or legacy systems, network-based segmentation and passive monitoring become more important. The goal is to allow only the flows required for operation, maintenance, and supervision.

Microsegmentation

Microsegmentation evolves traditional segmentation into smaller units positioned closer to protected resources. It can be applied through the network, endpoint, hypervisor, container, service mesh, cloud-native controls, or workload identity.

Its main benefit is limiting east-west traffic. Instead of allowing every server in a zone to communicate with every other server, each application, service, or workload receives a specific policy. Even if one server is compromised, lateral movement remains restricted.

There are several approaches:

• Network-based: uses firewalls, routers, SD-WAN, WAF, or NGFW.
• Endpoint-based: uses agents or local firewalls on servers and workstations.
• Hypervisor-based: applies policies in the virtualization environment.
• Container/service mesh: controls communication among containers, pods, and services.
• Cloud-native: uses security groups, network policies, cloud firewalls, and workload controls.
• Identity-based: uses cryptographic application or service identity, reducing dependence on IP.

Cloud Segmentation

In cloud environments, segmentation depends on resources such as VPCs, VNets, public and private subnets, security groups, network ACLs, gateways, cloud-native firewalls, and identity policies. The logic changes: instead of depending only on the physical perimeter, control must follow workloads, accounts, regions, managed services, and integrations.

The most common mistake is replicating the local network in the cloud without redesigning flows, controls, and responsibilities. Cloud projects should treat segmentation as part of the security architecture from the beginning.

ZTNA and Software-Defined Perimeter

Traditional VPNs tend to extend the user’s logical presence into the network. ZTNA and Software-Defined Perimeter follow another logic: the user or device receives access only to the authorized application or resource. This reduces exposure, improves auditing, and enables conditional policies based on identity, context, and risk.

In environments with remote work, third parties, cloud applications, and distributed teams, ZTNA can be a safer and more governable alternative than granting broad VPN access.

When to Use Each Model

Scenario	Recommended model	Reason
Small corporate network	VLAN + firewall between segments	Simple, familiar model suitable for initial maturity.
Guest network	Guest VLAN + NAC or access portal	Prevents visitors from reaching the internal network.
IP CCTV and electronic security	Dedicated VLAN + ACL/NGFW + controlled access to the VMS	Prevents cameras, NVRs, and video servers from being exposed to the user network.
Data center	Firewall zones + microsegmentation	Controls east-west traffic and reduces lateral movement among servers.
Public or hybrid cloud	Subnets, security groups, network policies, and cloud-native firewall	Follows distributed workloads and services.
OT/ICS environment	Zones and conduits + industrial DMZ + monitoring	Protects availability, legacy systems, and operational communication.
Remote users	ZTNA/SASE	Grants access by application, not to the entire network.
Critical applications	Workload- or identity-based microsegmentation	Enables granular policies and reduces the impact of compromise.
Third parties and vendors	Dedicated segment + least privilege + logs	Reduces risk from excessive access and the supply chain.
Legacy environments	Network and firewall segmentation	Agents and modern controls may not be supported.

Design Best Practices

Start with the Inventory

You cannot segment well what you do not know. The project should begin with an inventory of assets, applications, users, groups, communication flows, dependencies, sensitive data, vendors, and regulatory requirements.

Classify Criticality and Risk

Assets do not have equal value. Identity, backups, application servers, databases, industrial systems, administration networks, and internet-facing services require priority attention.

Use Deny-by-Default

The default policy should deny traffic and allow only what is necessary. Broad rules such as any-any should be treated as temporary exceptions with an owner, justification, and review deadline.

Reduce Implicit Trust Zones

Being on the internal network should not be sufficient to obtain broad access. Policy should consider identity, context, device posture, and the actual need for access.

Monitor Traffic Between Segments

Segmentation without visibility makes operations and incident response more difficult. Analysis of network traffic, firewall logs, NIDS/NDR, SIEM, and NetFlow/IPFIX helps validate policies and detect unexpected communications.

This visibility should feed continuous network monitoring and the network-management process, enabling rules to be reviewed based on evidence, availability, performance, and actual environmental changes.

Separate Administration Networks

Administration of switches, firewalls, Wi-Fi controllers, hypervisors, backup systems, critical servers, and OT consoles should occur through a dedicated segment with strong authentication, least privilege, logging, and restricted access.

Protect VLANs and Trunks

Good practices include disabling dynamic trunking, avoiding operational use of the default VLAN, allowing only required VLANs on trunks, disabling unused ports, and using port security or 802.1X where feasible.

Treat OT, IoT, and Legacy as Special Cases

Industrial devices, IP cameras, controllers, sensors, embedded systems, and legacy equipment may not receive agents or frequent updates. In these cases, network-based segmentation, minimal rules, passive monitoring, and dedicated DMZs are essential measures.

Test Before Blocking

Before activating strict blocks, it is advisable to observe actual traffic, map hidden dependencies, and apply policies in monitor mode when the technology allows it. This reduces outage risk.

Review Periodically

Segmentation is not a one-time project. Changes in applications, cloud, users, vendors, threats, and topology require continuous review. Accumulated legacy rules are a common source of risk.

Implementation Roadmap

A safe approach is to implement segmentation in phases, starting with higher-value assets or environments with lower operational complexity.

Phase 1 — Identify Candidates

Select applications, environments, assets, or workflows that are candidates for segmentation. Useful criteria include criticality, exposure, implementation ease, data value, and incident history.

Fase 2 — Map dependencies

Identify who communicates with whom, through which port, protocol, and purpose. The result should feed the architecture documentation and the network diagram, making zones, boundaries, required flows, and policy-enforcement points explicit. Application owners, operations, security, infrastructure, and key users should be involved.

Phase 3 — Define Policies

Create business-oriented policies, not merely IP-oriented policies. Examples:

• Finance users may access the ERP over HTTPS.
• IP cameras may communicate only with the VMS, NTP, and authorized services.
• Application servers may access the database only on the required port.
• Vendors may access only the contracted resource, within defined windows and methods.

Phase 4 — Implement, Test, and Monitor

Apply the policy in monitor mode where possible, correct dependencies, activate blocking, monitor logs, document exceptions, and establish a review routine.

Common Network Segmentation Errors

Error	Consequence
Creating VLANs without controlling inter-VLAN traffic	There is logical separation, but no effective security.
Using permanent any-any rules	The policy loses value and creates excessive exposure.
Segmenting without an inventory	Applications break because of unknown dependencies.
Failing to monitor east-west traffic	Lateral movement may go unnoticed.
Using IP as the only policy basis	Low scalability in cloud, virtualization, and dynamic environments.
Ignoring OT, IoT, and legacy systems	Fragile assets can become entry or propagation points.
Failing to document exceptions	Accumulated rules remain without owners, deadlines, or justification.
Failing to review old rules	The attack surface increases over time.

Final Considerations

Network segmentation is one of the most important foundations of modern security. It organizes infrastructure, reduces the attack surface, limits lateral movement, improves visibility, and enables least privilege to be applied to communication flows.

The central point is choosing the right model for each context. VLANs and subnets are useful, but they are not sufficient by themselves. Firewalls and DMZs remain relevant, but they need to be complemented by visibility, identity, and granular policies. In data centers, cloud, OT/ICS, and critical environments, microsegmentation and Zero Trust tend to provide a higher level of control.

For organizations that depend on corporate or industrial networks, IP CCTV, data centers, or critical infrastructure, segmentation should be part of the design from the beginning, together with cabling, topology, security, operations, and governance. A3A Engenharia supports companies in assessing, designing, documenting, and implementing safer, scalable network architectures aligned with technical best practices.

When there is uncertainty about the maturity of existing segmentation, the assessment should begin with a technical diagnosis that identifies flows, dependencies, exceptions, implicit trust points, and opportunities to improve security, availability, and governance.

Technical References

[1] ROSE, Scott; BORCHERT, Oliver; MITCHELL, Stu; CONNELLY, Sean. Zero Trust Architecture. NIST SP 800-207, 2020. Available at: https://csrc.nist.gov/pubs/sp/800/207/final

[2] CHANDRAMOULI, Ramaswamy. Guide to a Secure Enterprise Network Landscape. NIST SP 800-215, 2022. Available at: https://csrc.nist.gov/pubs/sp/800/215/final

[3] CISA. Microsegmentation in Zero Trust, Part One: Introduction and Planning. 2025. Available at: https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-releases-part-one-zero-trust-microsegmentation-guidance

[4] NSA. Network Infrastructure Security Guide. October 2023 Update. Available at: https://www.nsa.gov/Press-Room/Digital-Media-Center/Document-Gallery/igphoto/2003018261/

[5] STOUFFER, Keith et al. Guide to Operational Technology (OT) Security. NIST SP 800-82 Rev. 3, 2023. Available at: https://csrc.nist.gov/pubs/sp/800/82/r3/final

[6] IEC. IEC 62443-3-2:2020 — Security for industrial automation and control systems — Part 3-2: Security risk assessment for system design. Available at: https://webstore.iec.ch/en/publication/30727

[7] CENTER FOR INTERNET SECURITY. CIS Critical Security Controls v8.1. Available at: https://www.cisecurity.org/controls/v8-1

[8] SCARFONE, Karen; HOFFMAN, Paul. Guidelines on Firewalls and Firewall Policy. NIST SP 800-41 Rev. 1, 2009. Available at: https://csrc.nist.gov/pubs/sp/800/41/r1/final

Frequently Asked Questions

Is Network Segmentation the Same as a VLAN?

No. A VLAN is a Layer 2 segmentation technique. Network segmentation is a broader concept that may involve VLANs, subnets, firewalls, ACLs, identity, agents, cloud, ZTNA, and microsegmentation.

Does Every VLAN Need a Firewall?

Not every VLAN necessarily needs a dedicated firewall, but any communication between segments should have some control. In critical environments, explicit policies should be applied between VLANs, preferably with inspection, logging, and periodic review.

Does Microsegmentation Replace Firewalls?

Not necessarily. Microsegmentation complements firewalls, NAC, EDR, IAM, SIEM, and defense in depth. In many projects, firewalls remain an important part of the architecture.

When Should Microsegmentation Be Used?

Use microsegmentation when there are critical assets, distributed applications, significant east-west traffic, cloud environments, data centers, lateral-movement risk, or a need for granular policy by workload, identity, or application.

Does Segmentation Help Against Ransomware?

Yes. Segmentation does not by itself prevent infection, but it helps limit lateral movement, reduce incident reach, and improve containment. It should be combined with backups, EDR, MFA, vulnerability management, logging, and incident response.

How Should Industrial Networks Be Segmented?

Industrial networks should be separated from corporate networks, preferably using zones and conduits, an industrial DMZ, strict remote-access control, minimal protocol-specific rules, and OT-compatible monitoring. Operational availability should guide the design.

Additional Technical Materials

Related Services

• Logical Network and Corporate Network Design
• Technical Engineering Due Diligence
• Owner’s Engineering
• Engineering Commissioning

Main Content on the Topic

• Logical Networks: VLANs, IP, Routing, Segmentation and Design
• Network Design: Stages, Architecture and Technical Documentation
• Corporate Network Architecture: Layers, Models and Design Criteria
• Complete Guide to Network Architecture
• Network Diagram: Types, Logical and Physical Architecture, and Technical Documentation

Related Technical Content

• Subnetting: How IPv4 Subnetting Works and How to Size Subnets
• Network Traffic: Flows, Load, Broadcast, Multicast and Capacity
• NetFlow: What It Is, How It Works and How to Analyze Network Traffic
• Network Monitoring: Metrics, Availability, Performance and Observability
• Network Management: FCAPS, SNMP, Configuration, Performance and Security
• OSPF: How It Works, Areas, LSAs, Costs and Design Criteria
• BGP: What It Is, ASN, Peering and Design Criteria
• Cisco ISE: 802.1X, NAC and Network Segmentation
• Industrial Networks: Protocols, Architecture, Security and SCADA Integration