Segmentation for PCI and IoT
A hotel with 300 rooms runs guest Wi-Fi, a POS system for restaurants and the front desk, IP cameras, door locks, and a property management system (PMS). All devices currently share one flat VLAN and one /16 subnet. A PCI assessment flags that POS traffic is visible to guest devices. The hotel has one firewall at the edge and a single core switch stack. Management wants segmentation without a major hardware refresh.
1. Propose a segmentation model using the existing core and firewall, and explain enforcement points.
Read the worked answer
Model - role-based VLANs with firewall-enforced policy:
- Guest (isolated, internet-only, client isolation on).
- POS (PCI scope): restricted to POS servers and payment processors only.
- IoT (cameras, locks): outbound to management only; no lateral movement.
- Corporate/PMS: restricted to PMS servers and approved services.
- Management: network devices only.
Enforcement: the core switch stack carries VLANs via 802.1Q trunks; inter-VLAN routing is moved to the firewall (or a firewall-on-a-stick subinterface) so all inter-segment traffic is inspected. If the core must route for performance, apply ACLs on the core and send POS-to-server flows through the firewall for logging. Wireless: map SSIDs to VLANs and enable client isolation on guest.
PCI: place POS in its own VLAN, restrict inbound to POS servers, log all denied flows, and document the CDE boundary. No hardware refresh needed - only VLAN and policy changes.
2. The door-lock vendor requires layer-2 broadcast for discovery. How do you accommodate that without breaking segmentation?
Read the worked answer
Keep all locks in a single IoT VLAN so their broadcast discovery domain is intact, and do not route discovery across VLANs. If locks and cameras must be separated, give locks their own VLAN (one broadcast domain) and permit only the specific discovery protocol (e.g., UDP broadcast) within that VLAN.
Controls:
- Apply an ACL on the IoT VLAN blocking inter-VLAN traffic except to the lock controller.
- Rate-limit broadcast/multicast on the IoT VLAN to prevent storms.
- If discovery must cross a router, use a broadcast relay/helper rather than flattening the network.
This preserves vendor requirements while keeping IoT isolated from POS and guest.