Implementing Network Segmentation with Firewall Zones

Overview

Network segmentation divides a flat network into isolated security zones with firewall-enforced boundaries to contain breaches, restrict lateral movement, and enforce least-privilege access between workloads. Segmentation is a foundational control required by PCI DSS, HIPAA, NIST 800-53, and zero trust architectures. Modern segmentation combines traditional VLAN-based approaches with microsegmentation at the workload level for granular east-west traffic control. This skill covers designing zone architectures, configuring inter-zone firewall policies, implementing VLAN segmentation on switches, and deploying microsegmentation for dynamic environments.

When to Use

• When deploying or configuring implementing network segmentation with firewall zones capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Network topology documentation with asset inventory
• Firewall supporting zone-based policies (Palo Alto, Fortinet, Cisco Firepower)
• Managed switches with VLAN support (802.1Q trunking)
• Traffic flow documentation or NetFlow data for baseline analysis
• Compliance requirements (PCI DSS scope, HIPAA ePHI boundaries)

Core Concepts

Zone Architecture Tiers

Segmentation Approaches

Workflow

Step 1: Map Traffic Flows and Define Zones

Before implementing segmentation, capture baseline traffic:

# Capture NetFlow data to understand existing traffic patterns
nfdump -R /var/cache/nfdump/ -s srcip/bytes -n 50

# Identify east-west traffic between subnets
nfdump -R /var/cache/nfdump/ -s record/bytes \
  'src net 10.0.0.0/8 and dst net 10.0.0.0/8' -n 100

# Map application dependencies
# Document which servers need to communicate with which other servers

Step 2: Configure VLANs on Switches

! Core switch VLAN configuration
vlan 10
 name Management
vlan 20
 name Corporate-Users
vlan 30
 name Servers
vlan 40
 name PCI-CDE
vlan 50
 name Guest
vlan 60
 name DMZ
vlan 99
 name Native-Unused

! Trunk port to firewall
interface GigabitEthernet1/0/1
 description Trunk-to-Firewall
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,60
 switchport trunk native vlan 99
 switchport nonegotiate

! Access port for corporate users
interface range GigabitEthernet1/0/2-24
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast

! Access port for servers
interface range GigabitEthernet1/0/25-36
 switchport mode access
 switchport access vlan 30

! Prevent VLAN hopping
interface range GigabitEthernet1/0/37-48
 switchport mode access
 switchport access vlan 99
 shutdown

Step 3: Configure Firewall Zone Policies

Palo Alto zone-based policy:

# Define zones on firewall sub-interfaces
set network interface ethernet ethernet1/1 layer3 units ethernet1/1.10 tag 10 ip 10.0.10.1/24

…