Network Segmentation: Macro, Micro, and the Building Blocks

What Is Network Segmentation?

I’ve talked about network segmentation in many blog posts, but I’ve never had a blog post dedicated specifically to that topic. So, here we go.

Before we jump into Macro & Micro Segmentation, let’s talk about network segmentation in general and how it is implemented at each layer of the network stack. Traditionally, the network is split up into layers as shown in the following diagram. The over-engineered model is the OSI model with seven layers. The TCP / IP-based networks that took over the networking world decades ago collapse that into five layers. Each of those layers has its own network segmentation concepts built into it. You can see this in the following diagram.

OSI Model with Segmentation-Based Security Controls

The network is split up into layers that are each responsible for a specific aspect of modern networking:

• Physical Layer
• Network Access (or Data Link Layer)
• Network
• Transport
• Application (Session, Presentation, Application)

Network segmentation is the practice of dividing a network into smaller, isolated segments to control traffic flow, improve security, and limit the impact of breaches (thereby, reducing risk). The goal is simple enough:

• Limit what (network nodes) can talk to what (other network nodes).
• Reduce the blast radius
• Slow or stop lateral movement

Network segmentation isn’t one technology, mechanism, or best-practice. It happens at multiple layers of the networking stack and each layer gives you a different level of isolation, control, and risk reduction. However, if you only segment at one layer (or subset of layers), you’re leaving gaps.

Physical Segmentation (Layer 1)

This is the networking hardware layer.

Separate hardware provides the strongest isolation. This means completely separate:

• Switches
• Routers
• Cabling
• Other network equipment
• Server cabinets; maybe, data centers (bit extreme).

Some common examples include:

• Production network on one set of switches and routers.
• Development network on entirely different hardware.

The strengths of segmentation at this level are:

• True isolation (no shared infrastructure)
• Very hard to bypass
• Resistant to misconfiguration

The weaknesses are:

• Expensive
• Hard to scale
• Operationally complex

This is used for:

• OnPrem (though, there are rather expensive public cloud options available).
• High-security environments (finance, government, nuclear power plants)
• Air-gapped or critical systems are required.

Data Link Layer Segmentation (Ethernet / Layer 2)

This is commonly referred to as the ethernet layer because the ethernet protocol is probably the most popular / common protocol used at this layer.

This can provide logical separation on the same physical network through:

• VLANs (Virtual Local Area Networks)
• MAC-based segmentation (Medium Access Control (MAC) addresses are a unique identifier assigned to network cards that are used to uniquely identify a network node for various protocols including Ethernet, Wifi, and Bluetooth).

I remember learning what a MAC address was in the first week or two of my first job out-of-school in the late 1990s. I was so proud when I was able to rattle that bit of trivia off a while later.

An example of VLAN segmentation would be:

• VLAN 10 → Web Servers
• VLAN 20 → Application Servers
• VLAN 30 → Database Servers

Devices are:

• Physically connected to the same switch (possibly set of switches)
• Logically isolated into separate broadcast domains

However, some basic level of discipline is required in order to keep related systems on the same VLANs. Some MacroSegmentation products key off existing VLAN configuration to establish the segmentation policy. If your VLAN usage / architecture hasn’t been enforced over the years, that macrosegmentation product isn’t going to magically solve anything. Well, not without much work, heartache, and drama.

The strengths of using VLANs include:

• Cost-effective
• Easy to deploy
• Reduces broadcast traffic
• Basic isolation between groups

The weaknesses are:

• VLAN hopping attacks possible (if misconfigured)
• No security by default — just separation
• It still requires Layer 3 controls to enforce policy

VLANs, by itself, are segmentation, but not security.

Network Layer Segmentation (IP / Layer 3)

This is the IP network layer. The networking layer people are most familiar with.

Segmentation is enforced through routing and policy. This includes:

• Subnets
• Routing tables
• Firewalls / ACLs

An example:

• 10.0.1.0/24 → Web tier
• 10.0.2.0/24 → App tier
• 10.0.3.0/24 → Database tier

Traffic between these subnets must pass through a router or firewall.

I’ve always been uneasy when a network engineer tells me that a node on subnet A cannot connect to a subnet B because there are no routing rules for it. This is implicit control that is topology dependent and easy to break accidentally. I prefer there to be a firewall that is explicitly enforcing the deny-by-default policy.

The strengths of this approach are:

• Enforceable security policies
• Control over east-west traffic
• Scalable and flexible

The weaknesses are:

• Misconfiguration becomes an exposure to a potential vulnerability.
• Flat networks are still possible within a subnet; so, define your network topology and create subnets with dedicated purposes (you need room to grow in each subnet, but don’t want the subnets to be enormous).
• It requires careful rule management.

Regardless of these potential risks, this is where the real network-level security controls start. At Layer 3, you can:

• Allow / deny specific traffic.
• Enforce least privilege networking.

In order for this to be effective, systems / applications need to be uniquely identifiable by their source IP + port. Otherwise, it’s impossible to write an IP firewall rule that only allows traffic from Application A to Service B.

Usually, there are multiple source IPs that represent an application. In a situation where something like Kubernetes / OpenShift is being used, unless steps are taken to create a unique source IP per pod / namespace (possibly per worker node), then it is very common for everything running inside the K8S cluster to have the same source IP. This is not useful for traditional IP-based firewall rules.

Similarly, in situations where NAT / SNAT rules are being applied somewhere in the traffic path, it can become extremely difficult to reliably understand where all of the traffic is originating or ultimately being sent. I was working with a client once that had four layers of NATting between a DMZ-based API Gateway and the internal ESB. There were multiple layers of firewalls and no one remembered how any of it worked. Troubleshooting was a nightmare. The same basic issues exist with a source IP NAT before the firewall or a destination IP NAT after the firewall. In each case, a network engineer has to keep track of the NATs in order to maintain the firewall rules. Very few networking teams I’ve met are good at keeping track of these details. They may have a solid understanding at the time it is implemented, but this always seems to be the tribal knowledge that is lost first as resources leave and new ones come in the door.

Host-Based Segmentation (Layer 7)

Host-based segmentation is the practice of enforcing network access controls directly on individual systems (hosts), so that each host restricts which traffic it can send or receive regardless of the surrounding network. Examples include:

• OS firewalls: Filters network traffic directly on an individual machine based on defined rules. Instead of controlling traffic at the network boundary, it enforces policy on the endpoint itself.
• Endpoint controls: Security mechanisms running on the endpoint (server, VM, laptop, container) that enforce or influence network communication at or near the host. This could include host-based firewalls (mentioned above), Endpoint Detection & Response (EDR) packages, Host Intrusion Prevention Systems (HIPS), Identity-Aware Agents with similar functionality to these, and Local Proxies / Agents (enforce outbound restrictions, inspect traffic at the host).

All of this can control traffic on the machine / device / endpoint itself. And, hence, provides another layer of segmentation.

Application-Level Segmentation (Layer 7)

Application-level segmentation restricts communication based on application identity, context, and behavior rather than just network location or IP address. This application identity could be based on service accounts, Operating System identity, X509 client certificates, OAuth2 Client Credentials, or something similar. Examples include:

• API gateways
• Kubernetes (and other Container Management System) network security controls (K8S network policies, Sidecar Patterns, Service Meshes).

Various sources described the Kubernetes / CMS-level network security controls as being host-based. Let us not quibble. In the practical Layers mentioned earlier, these are treated as being at the same layer. The end result is the same.

This controls what can talk to which services and creates another possible layer of segmentation (mostly based on an application identity).

Identity-Based Segmentation (Layer 7)

This layer of security controls and segmentation is based upon an end-user or caller identity as opposed to an application or service identity in the last section. Doing so aligns with Zero Trust Architecture principals:

• Access based on identity, not network location.
• Policies enforced per user/service.
• Identity-aware proxies.

Ideally, every layer of the application infrastructure will validate (authenticate) this end-user identity credential (usually in the form of an identity token such as an OAuth2 Access Token or something similar), but it is done in the “software” layers of the network stack.

How All These Layers Work Together

A well-designed network uses multiple (ideally, all of these) layers:

• Physical separation for critical systems.
• VLANs for logical grouping.
• IP segmentation for policy enforcement.
• Host / Application / Identity-based controls for fine-grained security.

MacroSegmentation (Coarse Grained Segmentation)

MacroSegmentation is the coarse-grained division of a network into large zones. Think:

• Data center vs corporate network
• Production vs development
• DMZ vs internal network

MacroSegmentation is implemented with:

• Physical separation for critical systems (Layer 1).
• VLANs for logical grouping (Layer 2).
• IP segmentation for policy enforcement (Layer 3, to some extent).

Examples include:

• Internet → DMZ (web servers)
• DMZ → App tier
• App tier → Database tier

Each boundary is enforced with firewalls or routing controls.

MacroSegmentation Is Good At:

• Reducing exposure to external threats
• Creating clear trust zones
• Enforcing broad policy boundaries

It fails inside each segment where everything often trusts everything else.

So if an attacker gets into:

• The application subnet, they can often reach every app server.
• The database network, lateral movement becomes trivial.

MicroSegmentation (The Fine-Grained Control)

MicroSegmentation is granular control of traffic between individual workloads, services, or even processes.

Instead of “App servers can talk to DB servers” as the rule, one can define “This specific service on this host can talk to that specific database on this port” as a network communication rule.

The Application Layer (Layer 7) segmentation concepts discussed earlier are used to implement MicroSegmentation. This includes

• Host-based firewalls
• Endpoint controls
• API Gateways
• Service meshes (for microservices)
• All the stuff mentioned in the “Host-Based Segmentation”, “Application-Based Segmentation”, and “Identity-Based Segmentation” Sections.

Here’s an example:

Instead of one big “app tier”, everything is blocked by default except for the following rules:

• Service A → can call Service B on port 443
• Service B → can access DB on port 5432 (postgresql)
• Service C → blocked from everything except its dependencies

MicroSegmentation Is Good At:

• Stopping lateral movement.
• Enforcing least privilege networking.
• Protecting east-west traffic.
• Enabling Zero Trust principles.

How Macro & Micro Segmentation Work Together

This is the part people mess up: MicroSegmentation does NOT replace MacroSegmentation.

You need both.

You need a layered approach.

MacroSegmentation

• Separates prod, dev, DMZ, other major pieces / zones of your network.
• Establishes major trust boundaries.

MicroSegmentation

• Locks down communication within those zones.
• Enforces least privilege at the workload level.

In Modern Environments (Cloud / Hybrid)

In platforms like AWS Outposts or cloud VPCs (AWS / GCP) / VNets (Azure):

MacroSegmentation becomes:

• VPCs
• Subnets
• Routing domains

Microsegmentation becomes:

• Security groups
• Service-to-service authentication (Mutually Authenticated SSL / TLS)
• Policy engines

The details differ by cloud provider.

Software Defined Networks (SDNs)

In an attempt to be comprehensive, I will very briefly mention how segmentation maps into SDNs.

SDNs decouple the control plane from the data plane and lets you program network behavior centrally. One no longer configures VLANs, ACLs, and routes device-by-device; instead, one is defining policies centrally and dynamically pushing it out to the network.

MacroSegmentation

By its very nature, there is no direct mapping to segmentation controls at the physical layer (Layer 1).

At Layer 2, traditionally, where VLANs are configured manually on switches, with SDNs:

• VLANs or overlays (VXLAN, NVGRE) are created dynamically
• Logical networks span physical boundaries

This has the benefit of automating segmentation at Layer 2 and removing physical topology constraints.

At Layer 3, the traditional setup is static routing and firewall rules. With SDNs, centralized policy engine defines:

• Which subnet can talk to which
• On what ports

and, distributes enforcement across:

• Virtual switches
• Hypervisors
• Network appliances

So, then, MacroSegmentation becomes policy-driven instead of topology-driven.

Microsegmentation

At the Application Layer, SDNs enables:

• Per-workload segmentation
• Per-application rules
• Dynamic policy based on identity, tags, and labs.

Instead of “Subnet A can talk to Subnet B” one gets “App X on this VM can talk to DB Y on port 5432 — and nothing else.”

Modern SDN platforms push controls down to:

• Hypervisors
• Containers
• Virtual NICs

This makes enforcement happens inside the host, not just at the network boundaries.

Environment Isolation

All these network isolation techniques can be used to implement the environment isolation patterns described in the earlier “Achieving Environment Isolation” post.

Common Mistakes

• We have VLANs, we’re segmented. No, you have MacroSegmentation only.
• Flat networks inside zones. Everything can talk to everything → attacker paradise
• Overcomplicating Microsegmentation

Too many rules

No visibility

Nobody understands the policies

MicroSegmentation without understanding traffic flows ends with broken apps.

Summary

Network segmentation exists at multiple layers — physical, Ethernet (VLAN), and IP — with real security emerging when Layer 3 controls and higher-level policies are applied on top of basic separation.

MacroSegmentation divides the network into zones; MicroSegmentation controls what can happen inside those zones.

Notes

• AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
• I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
• Names have been changed to protect the guilty.
• None of the hostnames or users used in examples actually exist.
• Feel free to post any comments or suggestions below.