Network Segmentation and VLANs

Network segmentation divides a large flat network into smaller, isolated zones. Without segmentation, a single compromised host can communicate with every other device on the network — giving attackers free rein once they are inside. Segmentation enforces the principle of least privilege at the network layer: a workstation should not be able to directly reach a database server, and a guest Wi-Fi device should never see internal file shares. Segmentation dramatically reduces the blast radius of a breach.

A VLAN (Virtual Local Area Network) is a logical network created on a switch that groups ports together regardless of physical location. Devices in the same VLAN communicate as if they are on the same physical segment; devices in different VLANs cannot communicate without going through a router or Layer 3 switch that enforces access control. VLANs are tagged with an 802.1Q header that carries a VLAN ID (1-4094), allowing a single physical link (trunk port) to carry traffic from multiple VLANs simultaneously.

While VLANs segment at Layer 2, subnets segment at Layer 3 (IP). Each VLAN typically maps to its own subnet, and routing between subnets is controlled by a firewall or router that applies access control lists. This creates a clean separation: VLAN 10 might be 10.10.10.0/24 for corporate users, VLAN 20 might be 10.20.20.0/24 for guests. Firewall rules between subnets enforce which traffic is allowed and which is blocked at the IP level.

A DMZ (Demilitarized Zone), also called a screened subnet, is a network zone that sits between the internet and the internal network. Public-facing servers — web servers, mail servers, DNS servers — are placed in the DMZ so that external users can reach them without having direct access to internal systems. If a DMZ host is compromised, the internal firewall prevents the attacker from reaching sensitive internal resources. The DMZ is a critical segmentation concept tested heavily on Security+.

Micro-segmentation takes network isolation to the workload level, applying security policies between individual VMs, containers, or applications rather than just between network zones. Software-defined networking (SDN) and hypervisor-based tools (VMware NSX, AWS Security Groups) enforce policies without requiring hardware changes. Micro-segmentation is a core component of zero-trust architecture because it removes implicit trust between workloads running in the same data center or cloud region.

VLAN hopping is an attack that allows traffic to escape its VLAN and reach another VLAN without going through a router. Two methods exist: switch spoofing, where an attacker configures their NIC to speak 802.1Q trunking and negotiates a trunk link with the switch, gaining access to all VLANs; and double tagging, where an attacker wraps a frame with two 802.1Q headers to make it appear destined for a different VLAN. The defenses include disabling dynamic trunking protocol (DTP), explicitly configuring access ports, and not using the native VLAN for user traffic.

The most extreme form of network segmentation is an air gap — a network with no physical or logical connection to external networks. Air-gapped systems are used for highly classified government networks, industrial control systems, and nuclear facility controls. Data transfer requires physical media (USB drives, CDs), which itself introduces risks (Stuxnet spread via USB to reach air-gapped Iranian centrifuges). Even air-gapped systems need controls: strict media management, hardware write blockers, and endpoint protection.

NAC (Network Access Control) enforces security policies before a device is allowed onto the network. NAC systems check the device's posture — patch level, antivirus status, and certificate — before granting full network access. Devices that fail checks are quarantined to a remediation VLAN where they can only reach update servers. NAC integrates with 802.1X for authentication and communicates with directory services to apply policies based on user role and device type.

Traditional perimeter security focused on north-south traffic — data entering and leaving the data center from external sources. Modern attackers exploit east-west traffic — lateral movement between servers within the data center or cloud environment, which historically lacked inspection. Micro-segmentation and internal firewalls address east-west risks. SIEM correlation rules should monitor for unusual east-west connection patterns, such as a workstation suddenly communicating with dozens of internal hosts, which may indicate a worm or active attacker.

ICS/SCADA networks that control physical infrastructure (power grids, water treatment, manufacturing) require strict segmentation from corporate IT networks. The Purdue Model defines levels from field devices (Level 0) through plant control (Level 2) to enterprise IT (Level 4), with a DMZ between Levels 2 and 3 to prevent direct connectivity. NERC CIP standards mandate this separation for energy sector organizations. A breach in the corporate network should never be able to directly manipulate physical actuators or sensors.

The ultimate goal of network segmentation is to minimize the blast radius of any single compromise — the scope of damage an attacker can cause once inside one segment. Combined with other controls (endpoint detection, strict IAM, patch management), segmentation creates defense in depth: multiple independent layers that an attacker must breach serially. Segmentation alone does not prevent initial compromise, but it slows attackers, generates detection opportunities, and limits the impact of ransomware and worms that rely on unrestricted lateral movement.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: VLANs provide logical Layer 2 segmentation that limits broadcast domains and lateral movement, a DMZ (screened subnet) isolates public-facing servers between an external and internal firewall, and VLAN hopping attacks can be prevented by disabling dynamic trunking, changing the native VLAN, and assigning unused ports to a dead VLAN. Next up we explore common network attacks including DoS, spoofing, and MITM.