Secure Network Architecture and Segmentation

Introduction

A secure network architecture is an organised arrangement of devices, services, communication paths, trust boundaries and security controls. Its purpose is not merely to prevent unauthorised access. A well-designed architecture must also support business operations, acceptable performance, availability, maintainability and regulatory obligations.

Traditional networks often placed many systems on one flat LAN. In such an environment, a compromised workstation may communicate directly with servers, printers, administrative interfaces and other users. Segmentation reduces this exposure by dividing the network into controlled security zones. Traffic between zones is then inspected and permitted according to explicit policy.

This chapter develops practical design principles for zones, VLANs, subnets, DMZs, microsegmentation, bastion hosts, redundancy and secure remote access. It also explains how to balance confidentiality, integrity and availability rather than treating security as an isolated technical feature.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the purpose of security zones, VLANs, subnets and trust boundaries.
2. Design a small enterprise topology containing internal, guest, server and DMZ zones.
3. Apply least privilege and deny-by-default rules between network segments.
4. Distinguish network segmentation from microsegmentation.
5. Explain the role and limitations of bastion hosts.
6. Design resilient network paths and secure remote-access arrangements.
7. Evaluate security, performance, cost and availability trade-offs.
8. Test and document a segmentation design using practical methods.

1. Architectural Foundations

1.1 Defence in depth and least privilege

Defence in depth uses multiple, partly independent controls. For example, a public web application may be protected by a reverse proxy, firewall policy, host hardening, application authentication, logging and backup. If one control fails, the others can reduce the impact.

Least privilege means that a user, device or service receives only the access required for its legitimate function. In network design, this normally means that a workstation cannot initiate arbitrary connections to every server. A payroll application server may be permitted to reach a database on one specific port, while all unrelated traffic is denied.

A useful policy model is:

• Identify the asset and its owner.
• Classify the data and service importance.
• Identify legitimate communication flows.
• Place systems with similar requirements in suitable zones.
• Permit only required flows.
• Log, review and periodically remove obsolete rules.

1.2 Trust boundaries and attack surfaces

A trust boundary is a point at which traffic moves between different assumptions about identity, risk or control. Examples include the boundary between the Internet and an organisation, between guest Wi-Fi and corporate systems, and between an application server and a database.

An attack surface consists of reachable interfaces and services that could be exploited. Segmentation does not eliminate vulnerabilities; it limits the number of systems an attacker can reach after gaining an initial foothold. This containment function is often called limiting lateral movement.

Security boundaries should be based on business and technical risk, not simply on the physical location of equipment. Two servers in the same rack may require different controls, while a cloud service and an internal service may need a carefully controlled encrypted connection.

2. Zones, VLANs and Subnets

2.1 Security zones

A zone is a logical group of assets governed by a common security policy. Common zones include:

A zone is a policy concept. It may be implemented using VLANs, routed interfaces, virtual firewalls, cloud security groups or combinations of these technologies.

2.2 VLANs

A virtual local area network (VLAN) divides a switched Ethernet infrastructure into separate Layer 2 broadcast domains. Devices in different VLANs normally require a Layer 3 routing function to communicate. VLANs improve organisation and reduce broadcast scope, but a VLAN is not automatically a complete security control.

A malicious or misconfigured trunk, weak switch configuration, insecure native VLAN or vulnerable network device can undermine VLAN isolation. Consequently, inter-VLAN traffic should pass through an enforcing device such as a firewall or suitably controlled Layer 3 switch. Unused switch ports should be disabled or assigned to an unused VLAN, and trunk ports should allow only required VLAN identifiers.

2.3 Subnets and routing

An IP subnet defines which addresses are considered local according to a prefix length or subnet mask. For IPv4, the number of addresses in a subnet with prefix length /n is:

where N is the total number of addresses and n is the prefix length. In ordinary IPv4 host addressing, the network and broadcast addresses are reserved, so the usual number of usable host addresses is:

This special-case expression assumes a conventional IPv4 subnet with at least two reserved addresses. Point-to-point links, /31 addressing and IPv6 follow different conventions and must not be calculated using this rule without checking applicability.

For example, a /27 IPv4 subnet has 2^(32−27) = 32 total addresses and normally 32−2 = 30 usable host addresses. If a zone needs 22 hosts, a /27 provides capacity, whereas a /28 provides only 14 usable addresses and is insufficient.

Subnetting supports policy boundaries and address management, but an address range alone does not enforce security. A router may route between subnets unless an access-control list or firewall policy controls the traffic.

2.4 IPv6 considerations

IPv6 uses 128-bit addresses and does not use broadcast in the IPv4 sense. Network design commonly assigns a /64 to an ordinary LAN, although the exact addressing plan depends on the organisation and service provider. IPv6 security must be designed explicitly: disabling IPv4 rules does not secure IPv6, and firewalls must enforce policy for both protocol versions where both are deployed.

3. A Reference Segmented Architecture

A small organisation might use the following logical flow:

Figure: Example of a segmented architecture with policy enforcement at the edge.

The diagram is conceptual. In practice, a guest network may be terminated on a wireless controller, while management access may use a separate physical interface, dedicated firewall context or software-defined policy. The important property is not the drawing style but the controlled flows between zones.

A baseline policy could be:

• Internet to internal zones: deny by default.
• Internet to DMZ: permit only published services, such as HTTPS to a reverse proxy.
• DMZ to internal servers: permit only documented application flows.
• User zone to servers: permit required business services, not administrative protocols by default.
• Guest to internal zones: deny; allow Internet access through a restricted gateway.
• Management to infrastructure: permit only from authorised administrators using strong authentication.
• Backup zone: accept scheduled backup traffic; restrict general outbound access.

A firewall rule should identify source, destination, service or port, direction, authentication context where available, action, logging requirement, owner and review date. “Any-to-any allow” rules are difficult to justify and should be treated as temporary exceptions requiring formal approval.

4. DMZ Design

A demilitarised zone is a controlled network for services that must be reachable from less-trusted networks. Typical examples include reverse proxies, public web servers, mail gateways and authoritative DNS services.

A DMZ is not a place where security can be relaxed. Public-facing systems should be hardened, patched, monitored and isolated from internal systems. A common design places a reverse proxy or web application firewall in the DMZ, while application and database tiers remain in internal zones. The public component should not have unrestricted access to the database. Instead, a narrowly defined application flow is permitted through an inspected policy.

A dual-firewall DMZ can use separate devices or separate logical enforcement contexts. It may provide independent control points, but it also increases cost and operational complexity. A single high-quality firewall with carefully separated interfaces may be appropriate for a small organisation; the choice should follow risk, availability and administrative capability.

5. Microsegmentation and Zero Trust

Traditional segmentation commonly protects groups: all finance workstations may share a VLAN. Microsegmentation applies policy at a finer level, potentially to individual workloads, users, processes or virtual machines. It may use host firewalls, endpoint agents, identity-aware proxies, software-defined networking or cloud security groups.

Microsegmentation supports a zero-trust approach. Zero trust does not mean that no communication is possible; it means that implicit trust based on network location is removed. Access decisions consider identity, device condition, requested resource, context and policy. Authentication and authorisation are continuously evaluated where practical.

Microsegmentation is valuable for:

• separating application, API and database tiers;
• isolating high-value workloads;
• restricting east–west traffic within a data centre;
• limiting ransomware propagation; and
• applying different controls to devices on the same physical network.

However, excessive segmentation can create policy complexity, troubleshooting difficulty and performance overhead. Begin with high-value assets and clearly understood communication flows. Use flow logs and application dependency maps before enforcing restrictive rules. An undocumented dependency can cause an apparently secure rule to interrupt a critical service.

6. Bastion Hosts and Administrative Access

A bastion host, or jump server, is a hardened system through which administrators access protected devices or servers. Instead of exposing SSH, RDP or device-management interfaces broadly, the organisation permits administration from a management network or through the bastion host.

A bastion host should have a minimal operating system, limited software, strong authentication, central logging, time synchronisation, rapid patching and tightly controlled outbound access. Administrative sessions should use named accounts rather than shared credentials. Privileged access management may provide approval workflows, short-lived credentials, session recording and command auditing.

A bastion host is not a substitute for endpoint security or network policy. If it is compromised, it can become a high-value pivot point. Administrative access should therefore be restricted by source, destination, time and role. The host should not be used for email, general browsing or unrelated work.

7. Redundancy, Availability and Secure Design

Security controls that create a single point of failure can reduce availability. Critical networks may use redundant firewalls, switches, power supplies, links and Internet providers. High-availability pairs commonly exchange state and use a virtual address so that a standby device can assume service after failure.

Redundancy must be tested. A second device that has never been patched, monitored or failed over is not reliable redundancy. Designs should consider:

• failure detection and convergence time;
• whether active sessions survive a failover;
• independent power and physical paths;
• configuration synchronisation;
• licensing and support dependencies;
• capacity during failure, not only normal operation; and
• recovery procedures and maintenance windows.

Security and availability may conflict. Deep packet inspection, proxying and encryption inspection can increase latency and consume processing capacity. Conversely, bypassing inspection to improve speed can increase risk. Capacity planning should measure normal and peak traffic, encrypted traffic, logging volume and expected growth.

A useful availability expression for a simple series arrangement is:

where A_i is the availability of component i, assuming independent failures and a series design in which every component must operate. This assumption is not valid for redundant or correlated-failure systems. For two independent components in parallel, where either can provide service, availability is:

For example, two independent firewalls each rated at 0.99 availability give 1 − (0.01 × 0.01) = 0.9999, or 99.99%, under the stated independence and failover assumptions. Real deployments may achieve less because shared power, software defects, configuration errors and common upstream links create correlated failures.

8. Secure Remote Access

Remote access should provide authenticated, authorised and auditable connectivity without extending the entire internal LAN to an untrusted device. Common approaches include client VPNs, browser-based application portals, zero-trust network access and managed virtual desktops.

A sound design includes:

1. strong identity verification, preferably phishing-resistant multi-factor authentication;
2. device posture checks such as encryption, patch status and endpoint protection;
3. least-privilege access to specific applications or zones;
4. encrypted communication using maintained protocols and certificates;
5. session timeout, reauthentication and revocation;
6. central logging and alerting; and
7. separate administrative access paths for privileged operations.

Full-tunnel VPNs route all client traffic through the organisation and simplify monitoring, but they require more bandwidth and may affect performance. Split tunnelling can improve user experience and reduce central bandwidth, but it allows simultaneous access to the Internet and internal resources and may complicate inspection. The decision should reflect risk, endpoint management and application requirements.

Remote access gateways should be placed at an appropriate boundary, patched promptly and protected against password spraying, denial-of-service and stolen-token attacks. VPN credentials alone should not be treated as proof that a device is trustworthy.

9. Design Method and Worked Application

A practical design sequence is:

1. Inventory assets, users, services and dependencies.
2. Classify systems by sensitivity and operational importance.
3. Identify required communication flows, including direction and ports.
4. Define zones and assign each asset to a zone.
5. Select VLANs, subnets, routing points and enforcement devices.
6. Write deny-by-default policies with explicit exceptions.
7. Add secure administrative and remote-access paths.
8. Add monitoring, logging, backup and recovery controls.
9. Check capacity, redundancy and failure behaviour.
10. Test, document and review the design.

Worked application: a college network

An illustrative college has 120 staff and students in an administration building. It requires staff access, student Wi-Fi, guest Wi-Fi, a learning-management system, a finance application, network management and public web access.

The designer creates these zones:

The /23 student subnet provides 2^(32−23) − 2 = 510 conventional usable IPv4 addresses, allowing for growth. The /27 DMZ provides 30 conventional usable addresses, more than sufficient for a small set of public services while limiting the address space.

The learning-management reverse proxy accepts HTTPS from the Internet and forwards only approved application traffic to the internal application tier. The application tier may connect to the database on its documented database port; the reverse proxy cannot connect directly to the database. Guest devices receive DNS and Internet access but cannot route to staff, server or management subnets. Management interfaces accept connections only from the management subnet and the bastion host.

The firewall logs denied traffic at zone boundaries, successful administrative connections and unusual outbound activity. The college tests whether a student device can reach a finance server, whether a compromised DMZ host can reach the database, and whether remote staff can access only approved services. The design is reviewed after application changes rather than assumed to remain correct indefinitely.

10. Validation, Monitoring and Governance

Segmentation must be demonstrated, not merely documented. Useful validation activities include configuration review, port and service discovery, controlled vulnerability scanning, firewall rule testing, route-table inspection, wireless isolation testing and failover exercises. Testing should be authorised and conducted safely, especially on production systems.

Monitoring should collect firewall decisions, VPN authentication events, privileged sessions, endpoint alerts, DNS activity and significant east–west flows. Logs need accurate time, adequate retention, access protection and a defined response process. Logging everything without storage, analysis or ownership produces little value.

Governance includes change control, rule ownership, periodic access reviews, exception expiry and incident response. Network diagrams should identify trust boundaries and enforcement points, while inventories should record asset owners and data classifications. Privacy principles require that monitoring be proportionate, protected from misuse and communicated according to applicable law and institutional policy.

Segmentation can support regulatory objectives such as limiting the scope of payment-card or personal-data environments, but it does not itself establish compliance. Compliance depends on the complete set of technical, organisational and evidential controls required by the applicable framework.

11. Challenges and Contemporary Developments

Common failure modes include flat networks, undocumented firewall exceptions, shared administrative accounts, unmanaged switches, unrestricted outbound access and reliance on VLANs as if they were firewalls. Cloud environments add security groups, virtual networks, service endpoints and identity policies, but the same principles remain: define trust boundaries, minimise paths and verify access.

Infrastructure-as-code can make segmentation repeatable and reviewable. Automated policy analysis can detect shadowed rules, overly broad access and unintended paths. Artificial intelligence may assist with anomaly detection and dependency discovery, but it can produce false positives, inherit biased training data or encourage over-automation. Human approval, explainable evidence and change controls remain necessary for high-impact policy decisions.

Encrypted traffic improves confidentiality but can reduce network visibility. Organisations must balance inspection benefits against privacy, legal restrictions, key-management risk and processing cost. Modern designs therefore combine endpoint telemetry, identity signals, application logs and selective network inspection rather than assuming that one control provides complete visibility.

Best-Practice Checklist

• Separate public, user, server, guest, management and restricted assets.
• Use VLANs and subnets for organisation, but enforce policy at Layer 3 or above.
• Start with deny-by-default and document every business exception.
• Restrict east–west traffic, not only Internet traffic.
• Protect management interfaces through a dedicated path and bastion host.
• Use MFA and device checks for remote access.
• Design redundancy without shared failure points where practical.
• Monitor flows, privileged access, denied traffic and configuration changes.
• Test isolation and failover regularly.
• Review rules, diagrams and dependencies after organisational or application changes.

Chapter Summary

Secure network architecture uses zones and trust boundaries to reduce exposure and limit lateral movement. VLANs and subnets provide useful logical separation, but routing and firewall enforcement are required for meaningful policy control. DMZs isolate public services, while microsegmentation applies more granular identity- and workload-aware controls. Bastion hosts reduce direct administrative exposure but must themselves be hardened and monitored.

Availability requires tested redundancy, independent failure paths and capacity during failover. Secure remote access combines strong authentication, device assurance, encryption, least privilege and auditing. Effective designs are based on known communication flows, deny-by-default policy, continuous monitoring and documented governance. The central professional challenge is to balance security with performance, cost, usability and operational resilience.

Key Terms

Security zone: A group of assets governed by a common security policy.

Trust boundary: A point where traffic crosses between different security assumptions.

VLAN: A logical Layer 2 broadcast domain on a switched network.

Subnet: An IP address range defined by a network prefix.

DMZ: A controlled zone for services exposed to less-trusted networks.

Microsegmentation: Fine-grained separation of workloads, users or services.

Least privilege: Granting only the access required for an authorised task.

Lateral movement: An attacker’s movement from one compromised system to others.

Bastion host: A hardened intermediary used for controlled administrative access.

Inter-VLAN routing: Layer 3 communication between VLANs.

Deny by default: Blocking traffic unless a specific rule permits it.

East–west traffic: Traffic moving between internal systems.

North–south traffic: Traffic entering or leaving an organisational network.

High availability: The capability to continue service despite component failure.

Failover: Transfer of service from a failed component to a standby component.

Full-tunnel VPN: A VPN that routes the client’s traffic through the organisation.

Split tunnelling: A VPN arrangement in which some traffic avoids the tunnel.

Zero trust: An approach that does not grant implicit trust based on network location.

Attack surface: Reachable interfaces and services that may be exploited.

Review Questions

Short Answer Questions

1. Why is a VLAN alone insufficient as a complete security boundary?
2. What is the purpose of a DMZ?
3. Define microsegmentation.
4. State two controls that should protect a bastion host.
5. What is the difference between full-tunnel and split-tunnel VPN access?

Long Answer Questions

1. Explain how zones, VLANs, subnets and firewalls work together in a segmented enterprise network.
2. Describe a secure architecture for public web, application and database tiers.
3. Discuss the security and operational trade-offs of microsegmentation.
4. Explain how redundancy can improve availability while introducing complexity.
5. Develop a secure remote-access policy for a college or small business.

Analytical / Application Questions

1. Design zones and permitted traffic flows for an organisation containing staff devices, guest Wi-Fi, public web services, finance servers and network management systems.
2. A company has two independent firewalls rated at 0.99 availability each. Using the parallel availability assumption, calculate the theoretical combined availability and identify two reasons the real result may be lower.
3. A newly deployed application fails after a restrictive firewall rule is introduced. Propose a safe investigation and remediation process that preserves least privilege rather than simply permitting all traffic.

Multiple Choice Questions with Answers

Question 1

Which control most directly enforces policy between two IP subnets?

A. A firewall or controlled Layer 3 access policy

B. A longer Ethernet cable

C. A larger broadcast domain

D. A shared administrator password

Correct Answer: A. A firewall or controlled Layer 3 access policy

Question 2

What is the primary purpose of a DMZ?

A. To store all confidential databases

B. To host controlled services exposed to less-trusted networks

C. To eliminate the need for patching

D. To provide unrestricted access to internal systems

Correct Answer: B. To host controlled services exposed to less-trusted networks

Question 3

How many conventional usable IPv4 addresses does a /27 subnet normally provide?

A. 14

B. 16

C. 30

D. 32

Correct Answer: C. 30

Question 4

Which statement best describes microsegmentation?

A. Replacing all firewalls with switches

B. Applying fine-grained policy to workloads, users or services

C. Combining every VLAN into one LAN

D. Allowing unrestricted east–west traffic

Correct Answer: B. Applying fine-grained policy to workloads, users or services

Question 5

Which practice is most appropriate for a bastion host?

A. Use it for general web browsing

B. Give it unrestricted outbound access

C. Harden it and restrict administrative sessions through it

D. Share one administrator account among all technicians

Correct Answer: C. Harden it and restrict administrative sessions through it

Question 6

For two independent redundant components, which expression represents parallel availability?

A. A₁ × A₂

B. A₁ + A₂

C. 1 − (1 − A₁)(1 − A₂)

D. 1 − A₁A₂

Correct Answer: C. 1 − (1 − A₁)(1 − A₂)

Question 7

Which remote-access design principle best supports least privilege?

A. Grant every VPN user access to the entire LAN

B. Permit access only to approved applications or zones

C. Disable authentication after the first login

D. Use passwords without monitoring

Correct Answer: B. Permit access only to approved applications or zones

Question 8

What is the main security benefit of a guest network?

A. It isolates visitor devices from internal organisational systems

B. It increases access to management interfaces

C. It bypasses firewall inspection

D. It makes endpoint patching unnecessary

Correct Answer: A. It isolates visitor devices from internal organisational systems

Question 9

Why should firewall rules include an owner and review date?

A. To ensure obsolete exceptions can be identified and removed

B. To increase the number of any-to-any rules

C. To prevent all logging

D. To replace authentication

Correct Answer: A. To ensure obsolete exceptions can be identified and removed

Question 10

A /23 subnet has how many conventional usable IPv4 addresses?

A. 254

B. 256

C. 510

D. 512

Correct Answer: C. 510