PCI Segmentation and Firewall Service Insertion Across 150 Clinics
A healthcare payer has 150 clinics. Each clinic has a single ISR1100, 50 Mbps MPLS, and 200 Mbps broadband. Card-payment traffic from clinic kiosks must be segmented and inspected by a firewall before reaching the payment gateway. Guest Wi-Fi must never reach the corporate VPN. Corporate SaaS should use local internet, inspected by cloud security. The data center has Palo Alto firewalls at 70% capacity; backhauling all clinic internet traffic would exceed capacity and add latency. Twenty large clinics already have FTD firewalls; the other 130 do not. The company wants service insertion without deploying a firewall at every small clinic, and it needs a clear fail-open/fail-close decision for PCI and guest traffic. The security team is concerned about asymmetric routing when a firewall is inserted, and operations wants to know what happens when the service chain is unreachable.
1. Design the VPN segmentation for PCI, guest, corporate, and transport traffic.
Read the worked answer
Use separate service VPNs: VPN 0 for transport, VPN 1 for corporate, VPN 2 for guest, and VPN 5 for PCI. Put kiosks in VPN 5 with a default route only toward the payment-gateway service chain; do not leak VPN 1 routes into VPN 5. Put guest Wi-Fi in VPN 2 with local internet only and no route to VPN 1. Corporate endpoints stay in VPN 1 with local SaaS breakout.
The key judgement is preventing route leakage. Use VPN membership and route policies so guest and PCI prefixes are not advertised into corporate, and corporate prefixes are not advertised into guest. On the LAN, use separate VRFs or subinterfaces with zone-based policy. The ISR1100 must have enough throughput for inspection? It is not doing firewall inspection in the small clinics; it is just separating VRFs and steering PCI to the service chain. Confirm that the platform supports the required crypto and service-insertion scale.
2. What service-insertion placement would you choose for PCI, guest, and SaaS, given the DC firewall at 70% capacity?
Read the worked answer
PCI traffic is low-volume authorization traffic, so backhauling only PCI from the 130 small clinics to the DC Palo Alto is feasible and preserves local internet capacity. Use a service-insertion policy in VPN 5 that steers PCI traffic to the DC firewall service VPN, with tracking. For the 20 large clinics that already have FTDs, use local service insertion for PCI and any local inspection; that avoids unnecessary backhaul and uses existing assets. Do not backhaul guest or general SaaS to the DC; that would overload the 70% firewalls and add latency.
Guest and corporate SaaS should use local internet breakout with cloud-delivered security (SIG/Umbrella) at the branch. If the security team insists on the DC firewall for SaaS, breakout only selected high-risk SaaS, not all internet. Model the PCI load: 150 clinics times a few Mbps of authorization traffic is far below the 2 Gbps class, but confirm the Palo Alto's inspected throughput, not just interface speed. For asymmetric routing, insert the service at one point and ensure return traffic uses the same firewall/VRF.
3. What fail-open or fail-close behavior would you configure for PCI and guest, and how would you test it?
Read the worked answer
PCI should be fail-close: if the service chain or firewall is unreachable, payment traffic must drop, not bypass inspection. Guest should also be fail-close if the requirement is that guest traffic never reaches corporate; an outage is preferable to a leak. Corporate SaaS can be fail-open with an alert only if security accepts the risk; otherwise fail-close. Configure the service-insertion policy with the appropriate fail-open/fail-close setting per service and enable tracking/keepalives so the branch detects an unreachable firewall quickly.
Test by disabling the firewall or breaking the service VPN on a pilot clinic. Verify PCI drops, guest does not leak to VPN 1, and corporate behavior matches the documented decision. Also test asymmetric routing: send traffic through the firewall and confirm the return path is symmetric. If fail-open is used for PCI, that is a finding, not a convenience.