Network Segmentation and Microsegmentation

April 15, 2026·3 min read·441 words

Network segmentation isolates traffic between zones to limit the spread of attacks and enforce differentiated policies. Microsegmentation goes further by providing isolation at the VM/container/workload level. It is essential for ZTNA and compliance with NIS2/ISO 27001. 2026 guide.

Traditional Segmentation (Macrosegmentation)

VLAN 802.1Q: L2 separation by switch port
IP subnets: L3 separation, with inter-subnet routing controlled by ACL/FW
VRF: separation of routing tables on a router (multi-tenant)
DMZ: isolated public-facing zone (web, email, VPN)
Admin network: isolated management network (OOB)

Typical Enterprise Segmentation

VLAN 10 DATA: office users
VLAN 20 VOICE: IP phones
VLAN 30 WIFI: guest WiFi
VLAN 40 PRINT: printers
VLAN 50 CAM: IP cameras and IoT
VLAN 60 IOT: sensors and access badges
VLAN 70 SERVERS: on-prem servers
VLAN 99 MGMT: OOB management

Intersegment Policies

The FW enforces rules between zones:

DATA → Internet: allow HTTP/HTTPS
VOICE → DATA: allow SIP/RTP to PBX
Guest WIFI → Internet: allow, → LAN: deny
IOT → Internet: deny, → MQTT broker: allow
SERVERS → LAN: deny except for specific applications
MGMT: accessible only from the bastion host

Microsegmentation

Microsegmentation goes further by isolating each workload individually (VM, container, K8s pod):

Granularity: by application, not by VLAN
Policy: 'App-WEB may communicate with App-DB on port 3306 only'
Lateral Zero Trust: deny by default, explicitly allow authorized traffic
Enforcement: hypervisor (VMware NSX), OS agent (Illumio), hardware switch (Cisco Nexus 10000 with Pensando)

Microsegmentation Solutions

VMware NSX-T: hypervisor overlay, DFW (Distributed FireWall), 5-10K rules per host
Cisco ACI: contracts and EPGs (End-Point Groups), hardware enforcement
Illumio Core: OS agent, label-based policies
Guardicore Centra (Akamai): agent + multi-cloud orchestration
Aruba CX 10000 + Pensando DPU: stateful FW in the hardware switch

Application Mapping (Critical Step)

Before implementing microsegmentation, identify actual traffic flows:

NetFlow/IPFIX on switches/FW
Tools: ExtraHop, Darktrace, Cisco Tetration, Guardicore Reveal
Period: 30-60 days to capture all traffic flows (batch processes, backups, monthly cron jobs)
Output: app-to-app matrix with protocols/ports

NIS2 and Microsegmentation

The NIS2 Directive (EU, effective in 2024) requires:

Network segmentation
Prevention of lateral movement
Audit trail for interzone traffic
Microsegmentation is strongly recommended for essential and important entities

Use Cases

Hospital

Segments: patient records, medical imaging, biomedical IoT (pumps, monitors), administration, and public WiFi. Medical IoT microsegmentation is mandatory (Cisco Cyber Vision + Stealthwatch).

Industry 4.0 Facility

Purdue Model: Level 0-5. IT/OT segmentation is critical. Industrial DMZ (L3.5). ISA/IEC 62443.

Bank

PCI-DSS: strictly isolated cardholder data environment (CDE). Tier 1 (front office), Tier 2 (back office), Tier 3 (core banking). Microsegmentation is mandatory within the CDE.

Order from OPTINOC

Turnkey segmentation assessment, macrosegmentation design, and microsegmentation deployment. VMware NSX, Cisco ACI, Fortinet, and Palo Alto. Application traffic-flow mapping. Quote within 48h.