Segmentation and Observability for Guest and IoT on a Campus
A campus wants to segment guest Wi-Fi, IoT devices (badge readers, cameras, HVAC), and employee traffic. Today everything is in VLAN 10 with a flat subnet and a firewall at the core. The team proposes: guest on its own VLAN with internet-only access; IoT on its own VLAN with access only to a management server; employees on VLAN 10. Observability today is NetFlow exported from the core to a collector. The security team asks for visibility into east-west IoT traffic and wants to detect a compromised IoT device attempting lateral movement. The campus uses CloudVision and Arista switches throughout.
1. Evaluate the proposed segmentation against the security requirement to detect lateral movement among IoT devices.
Read the worked answer
The proposed segmentation places all IoT devices in one VLAN, so east-west IoT traffic is switched locally and never crosses the core firewall. NetFlow exported from the core will not see intra-VLAN IoT traffic, so lateral movement between IoT devices is invisible. Guest and employee segmentation is reasonable, but IoT is under-segmented for the stated detection goal.
Judgement: to detect lateral movement among IoT, either (a) further segment IoT into smaller VLANs/subnets so traffic crosses an inspection point, or (b) enable flow telemetry at the access layer (where IoT devices attach) or use switch-local telemetry/ACL logging to capture east-west flows. Relying solely on core NetFlow is insufficient.
2. Recommend where to collect telemetry and how to combine segmentation with observability to meet the detection goal.
Read the worked answer
Collect telemetry at the access layer: enable flow export or sFlow/telemetry on the Cognitive Campus access switches where IoT devices connect, so intra-VLAN flows are captured before they are switched locally. Alternatively, segment IoT into per-function VLANs (badge, cameras, HVAC) with inter-VLAN routing at a policy point that exports flows, so east-west traffic crosses an inspected boundary.
Combine with segmentation policy: ACLs or group-based policy restricting IoT-to-IoT and IoT-to-other subnets to only required flows (e.g., badge readers to management server), with logging on denies. Detection then combines: (1) flow telemetry showing unexpected IoT-to-IoT conversations, (2) denied-flow logs showing blocked lateral attempts. Use CloudVision for consistent config deployment and to correlate device state with alerts.
Judgement: segmentation without access-layer telemetry cannot detect east-west IoT movement; the two must be designed together.