Skip to content
Skillpedia
PT
Security35k · #5599

configuring-network-segmentation-with-vlans

Teaches your AI agent to build APIs and back-end systems.

What it does

This helps organize your computer network into smaller, more secure groups, like separate "rooms." Each group (VLAN) can only talk to other groups if you allow it.

When to use it

  • ✓When you want to separate the employee network from the guest network.
  • ✓To protect sensitive data, like payment or medical information.
  • ✓To prevent a problem on one device from spreading to others on the network.

Example of what to ask your AI

“Set up my network to separate traffic for employees, guests, and servers.”

Want more? Open the sections below.

How to use

The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.

Skill link

https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/main/skills/configuring-network-segmentation-with-vlans/SKILL.md

Ready-to-paste message

Use this skill to help me: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/main/skills/configuring-network-segmentation-with-vlans/SKILL.md Read the SKILL.md file at that link and follow its instructions for my task.
View on GitHub ↗Raw file
How it works

The AI creates virtual "rooms" (VLANs) on your network equipment (switches). It defines which devices can talk to which other devices, creating security barriers.

Installation

Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.

In the terminal (Claude Code, Codex, Cursor), in your project folder:

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-network-segmentation-with-vlans

Or download just the file:

curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/configuring-network-segmentation-with-vlans/SKILL.md -o SKILL.md
Technical content (original SKILL.md)

Original text by the author, straight from GitHub.

Configuring Network Segmentation with VLANs

When to Use

  • Segmenting an enterprise network into isolated security zones (corporate, servers, DMZ, guest, IoT)
  • Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) that mandate network isolation for sensitive data
  • Reducing blast radius of security incidents by preventing lateral movement between network segments
  • Isolating high-risk devices (IoT, BYOD, legacy systems) from critical infrastructure
  • Implementing defense-in-depth by combining VLANs with firewall rules and access control lists

Do not use VLANs as the sole security control without Layer 3 filtering, for isolating networks that require air-gapping, or without proper switch hardening against VLAN hopping attacks.

Prerequisites

  • Managed switches supporting 802.1Q VLAN trunking (Cisco Catalyst, HP Aruba, Juniper EX, etc.)
  • Layer 3 switch or firewall for inter-VLAN routing and access control
  • Network design document specifying VLAN assignments, IP subnets, and traffic flow requirements
  • Console or SSH access to switches with privileged configuration mode
  • Understanding of 802.1Q trunking, STP, and inter-VLAN routing concepts

Workflow

Step 1: Design the VLAN Architecture

# Define VLANs based on security zones and function

VLAN Plan:
  VLAN 10  - CORPORATE    (10.10.10.0/24)  - Employee workstations
  VLAN 20  - SERVERS      (10.10.20.0/24)  - Internal servers
  VLAN 30  - DMZ          (10.10.30.0/24)  - Internet-facing servers
  VLAN 40  - GUEST        (10.10.40.0/24)  - Guest WiFi
  VLAN 50  - IOT          (10.10.50.0/24)  - IoT/OT devices
  VLAN 60  - VOIP         (10.10.60.0/24)  - VoIP phones
  VLAN 100 - MANAGEMENT   (10.10.100.0/24) - Switch/AP management
  VLAN 999 - QUARANTINE   (10.10.99.0/24)  - Isolated/compromised hosts
  VLAN 998 - NATIVE_UNUSED                  - Native VLAN (no traffic)

# Traffic flow matrix:
# CORPORATE -> SERVERS: Allowed (specific ports)
# CORPORATE -> DMZ: Allowed (HTTP/HTTPS only)
# CORPORATE -> GUEST: Denied
# CORPORATE -> IOT: Denied
# GUEST -> Any Internal: Denied
# IOT -> SERVERS: Allowed (specific ports to specific hosts only)
# DMZ -> SERVERS: Allowed (database ports only)
# MANAGEMENT -> All: Allowed (from management stations only)

Step 2: Configure VLANs on Cisco Catalyst Switch

! Enter configuration mode
enable
configure terminal

! Create VLANs
vlan 10
  name CORPORATE
  exit
vlan 20
  name SERVERS
  exit
vlan 30
  name DMZ
  exit
vlan 40
  name GUEST
  exit
vlan 50
  name IOT
  exit
vlan 60
  name VOIP
  exit
vlan 100
  name MANAGEMENT
  exit
vlan 998
  name NATIVE_UNUSED
  exit
vlan 999
  name QUARANTINE
  exit

! Configure access ports for workstations (VLAN 10)
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 10
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure access ports for servers (VLAN 20)
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 20
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure trunk ports to other switches
interface GigabitEthernet1/0/48
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Configure trunk to firewall/router
interface GigabitEthernet1/0/47
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Shutdown unused ports
interface range GigabitEthernet1/0/37-46
  shutdown
  switchport mode access
  switchport access vlan 999
  exit

Step 3: Harden Switch Against VLAN Hopping

! Disable DTP on all ports (prevents switch spoofing)
interface range GigabitEthernet1/0/1-46
  switchport nonegotiate
  exit

! Set native VLAN to unused VLAN on all trunks
interface range GigabitEthernet1/0/47-48
  switchport trunk native vlan 998
  exit

! Enable DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip dhcp snooping trust
  exit

! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip arp inspection trust
  exit

! Enable IP Source Guard (prevents IP spoofing)

…
FAQ

What is a VLAN?

VLAN stands for Virtual Local Area Network. It's like creating divisions within your computer network so they can communicate more organized and securely.

Do I need special equipment?

Yes, you need network switches that support VLAN technology (called 802.1Q) and a device (router or another switch) to manage communication between VLANs.

Does this replace antivirus software?

No, VLANs are a network security layer. They help isolate devices but don't directly protect against viruses or malware on the computers themselves.

Details

Original description by the author

Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, and to limit lateral movement paths. Use when segmenting an enterprise network into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC 2) for network isolation, or reducing blast radius from a security incident. '

repo: mukul975/Anthropic-Cybersecurity-Skills

Popularity

GitHub stars
35k
Ranking position
#5599
License
Apache-2.0
Updated
8/31/2026

Is this skill useful?

0

Sign in to vote.

Comments

  • …

More skills from this repository

APIs & servers (backend)35k

abusing-dpapi-for-credential-access

Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.

mukul975/Anthropic-Cybersecurity-Skills

Writing35k

abusing-shadow-credentials-for-privesc

Teaches your AI agent to write clear, well-structured text.

mukul975/Anthropic-Cybersecurity-Skills

Misc35k

achieving-cmmc-level-2-compliance

Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.

mukul975/Anthropic-Cybersecurity-Skills

Misc35k

acquiring-disk-image-with-dd-and-dcfldd

Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.

mukul975/Anthropic-Cybersecurity-Skills

Similar skills

Security280k

django-security

Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.

affaan-m/ECC

Security280k

laravel-security

Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.

affaan-m/ECC

Security280k

module-regression

Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.

affaan-m/ECC