5.2.2. Firewall Types and Placement Strategies
💡 First Principle: Network segmentation limits the blast radius of a compromise. If every system is on the same flat network, a single compromised workstation can reach every server, every database, every management interface. Segmentation forces an attacker who has breached one segment to breach additional boundaries — each boundary is a detection opportunity and an obstacle that slows lateral movement.
VLAN (Virtual LAN):
VLANs are logical segmentation at Layer 2 — traffic from one VLAN cannot reach another without being routed through a Layer 3 device (router or Layer 3 switch) where access control can be applied. That separation only limits lateral movement if the access control is actually there: inter-VLAN routing with no ACLs or firewall rules turns the VLANs back into one flat network for an attacker. VLANs divide a single physical switch infrastructure into multiple isolated broadcast domains.
VLAN security attacks and defenses:
| Attack | Description | Defense |
|---|---|---|
| VLAN hopping | Switch spoofing: attacker configures their port as a trunk port to access all VLANs | Disable dynamic trunking (DTP); manually configure trunk ports; assign unused ports to unused VLAN |
| Double tagging | Attacker adds two 802.1Q tags; outer tag is stripped at first switch, inner tag delivers to target VLAN | Ensure native VLAN is not used for user traffic; use dedicated native VLAN (e.g., VLAN 999) not present elsewhere |
| MAC flooding | Overwhelm switch CAM table causing it to flood traffic like a hub | Enable port security to limit MAC addresses per port; shut down unused ports (parked in an unused VLAN); use 802.1X authentication |
| ARP spoofing / poisoning | Unsolicited (gratuitous) ARP replies map the gateway's or a victim's IP to the attacker's MAC, so traffic flows through the attacker (MITM) | Dynamic ARP Inspection backed by DHCP snooping; static ARP entries for critical hosts |
| DHCP starvation | Flood DHCP requests from forged client MACs until the address pool is exhausted — often the prelude to a rogue DHCP server | DHCP snooping with rate limiting on untrusted ports; port security |
Network Access Control (NAC):
NAC enforces a security policy before a device is allowed to connect to the network. Rather than trusting any device that can physically plug in, NAC evaluates device posture: Is it domain-joined? Is antivirus current? Is the OS patched?
NAC components:
- Posture assessment: Check device compliance before granting access
- Quarantine VLAN: Compliant devices go to the production network; non-compliant go to quarantine for remediation
- 802.1X: IEEE standard for port-based network access control; device authenticates to a RADIUS server before the switch port opens (until then the port stays unauthorized and passes only EAPOL authentication traffic)
- MAC Authentication Bypass (MAB): for devices that cannot run an 802.1X supplicant (printers, medical and IoT devices), the switch submits the device's MAC address to RADIUS instead. MACs are easily spoofed, so MAB devices go to a restricted VLAN with tight access rules rather than being exempted from NAC
NAC enforcement methods:
- Pre-admission: Check compliance before connecting; non-compliant = no connection or quarantine
- Post-admission: Monitor behavior after connecting; violation = disconnect
Network zones and trust model:
| Zone | Trust Level | Examples | Controls |
|---|---|---|---|
| Internet | Untrusted | External users, attackers | Perimeter firewall, DDoS protection |
| DMZ | Semi-trusted | Web servers, email relays, public APIs | Firewall rules, WAF, IPS |
| Internal | Trusted | Corporate workstations, internal servers | Internal firewall, IDS, NAC |
| Secure/Restricted | Highly trusted | Financial systems, PII databases, IP repositories | Additional authentication, DLP, enhanced logging |
| Management | Admin only | Network management, jump servers, PAM | Strict IP whitelisting, MFA, session recording |
Micro-segmentation: Extends VLAN-level segmentation down to individual workloads or VMs. In cloud and SDN environments, security policies attach to the workload, not the network segment — a VM can move physical hosts without changing its security policy. East-west traffic (between servers in the same data center) is enforced, not just north-south (in/out of the data center). Granularity is a risk-and-maturity decision: high-value or regulated workloads justify micro-segmentation, but it multiplies the policies to maintain, and a team without the automation and operational maturity to run it tends to pile up over-permissive exceptions — a false sense of security. Coarser macro-segmentation (zones/VLANs) is easier to operate correctly.
Zero Trust Network Access (ZTNA):
- Replaces VPN as remote access architecture
- Access granted per application, not per network segment
- Device posture and user identity verified for every session
- Never implicitly trusts any request based on source IP or network location
⚠️ Exam Trap: VLANs provide traffic isolation — they do not provide encryption. Traffic within a VLAN can still be captured by a device on the same VLAN. If the confidentiality of intra-VLAN traffic matters, separate encryption is required. This is a common architectural confusion: VLANs isolate segments; they don't encrypt communication within a segment.
Reflection Question: A healthcare organization's network has all clinical workstations, administrative PCs, medical devices, and servers on a single flat /16 network with no segmentation. A ransomware attack compromises one workstation and spreads to 400 systems in three hours. Propose a segmentation architecture that would have limited the blast radius, specifying the zones, the controls between zones, and how medical device connectivity would be handled differently from clinical workstations.
