Network Security Design
This domain covers segmentation and zoning, enforcement point placement, identity-based access control, and control/management plane protection.
Segmentation and zones
Define zones by trust and function rather than by convenience: untrusted Internet, DMZ for externally reachable services, internal user tiers, data/PCI scope, management, and IoT/OT. Segmentation reduces blast radius and regulatory scope - shrinking the cardholder data environment to a handful of segments is a design deliverable, not a compliance afterthought. Modern segmentation follows identity (user, device, tag) rather than subnet, using Security Group Tags, trustsec-style metadata, or host-based microsegmentation.
Enforcement point placement
A routed firewall is an L3 hop with zones, NAT and full policy; a transparent firewall is a bump in the wire that preserves addressing and can filter where re-addressing is impossible. Place enforcement where policy changes and where traffic actually crosses: Internet edge, data center core, and increasingly east-west inside the DC. Stateful devices break under asymmetric routing, so design symmetric paths or use active/standby clustering rather than active/active. Inline IPS sees and can drop; tap-mode IPS only alerts.
Access control and planes
802.1X with EAP-TLS is the target state; MAB is the fallback for devices without supplicants and must be paired with tight ACLs. Combine with downloadable ACLs or tags, posture assessment, and a guest portal on an isolated VLAN. Protect the control plane with CoPP so a data-plane flood cannot starve routing protocols; protect the management plane with out-of-band access, TACACS+/RADIUS with command authorization, SSH only, and no management reachable from untrusted zones.
Worked example
A hospital must stop flat-network lateral movement from medical devices that run static IPs and cannot host an 802.1X supplicant. Design: profile the devices by MAC OUI and LLDP, place them on an IoT segment via MAB, apply a downloadable ACL permitting only the imaging server, and enforce at the firewall using Security Group Tags so policy follows the device tag rather than the IP address. Justify: static addressing and no supplicant make identity-by-IP fragile; tags survive re-addressing and let the same policy apply at every enforcement point.
Traps that cost marks
- Firewalling only the Internet edge while east-west traffic between servers is uninspected.
- Ignoring return traffic and state timeouts, which silently drops asymmetric flows.
- Treating encryption as segmentation; a VPN still delivers an attacker into the flat network.
- Leaving management access reachable from user VLANs, undoing the entire segmentation model.