Flat Branch Network with Guest Wi-Fi and Split-Tunnel VPN
A 60-person branch office uses one flat /24 subnet for point-of-sale terminals, VoIP phones, employee laptops, and a guest Wi-Fi network. The guest Wi-Fi password is posted at reception and has not changed in two years. The internal firewall rule is any-to-any. Remote workers use a VPN with split tunneling so personal streaming traffic bypasses the tunnel. The branch has no 802.1X, and the main office routes to the branch over a site-to-site tunnel. A recent scan found an unmanaged laptop offering file-sharing services on the same subnet as the POS terminals. Management wants guest Wi-Fi to remain simple for visitors and does not want to buy new hardware.
1. What segmentation plan is realistic without new hardware, and in what order should it be implemented?
Read the worked answer
Use the existing firewall and switch VLAN capabilities. First, move guest Wi-Fi to its own VLAN with a firewall policy that allows only internet access and blocks RFC1918 addresses and the branch subnet. Second, separate POS terminals and VoIP into their own VLANs with least-privilege rules: POS to payment processor only, phones to PBX or provider only, and employee laptops to file and print services as needed. Third, remove the any-to-any internal rule and replace it with documented flows. Fourth, address the unmanaged laptop by port security or 802.1X if supported; if not, use DHCP reservations and switch-port access lists as compensating controls. Order by risk: guest isolation and POS separation first, because those reduce the most likely lateral paths.
2. How should remote-access split tunneling be judged?
Read the worked answer
Split tunneling is not automatically wrong; it is a tradeoff between VPN capacity and security visibility. With personal streaming bypassing the tunnel, the endpoint may be exposed to untrusted networks while still reaching internal resources, and malware can use the direct internet path. For a branch with limited bandwidth, keep split tunneling only for low-risk, explicitly listed destinations, and route all corporate applications through the tunnel. Require endpoint protection and patching on VPN clients, and use DNS filtering. If the organization cannot inspect split-tunnel traffic, restrict VPN access to specific internal hosts rather than the whole subnet. Document the risk acceptance if split tunneling remains.
3. What compensating controls should be applied until 802.1X is available?
Read the worked answer
Compensate with port security limiting MAC addresses per switch port, disabling unused ports, and placing access ports in the correct VLAN rather than a default flat VLAN. Use DHCP snooping and dynamic ARP inspection where the switches support them. Restrict inter-VLAN routing with firewall rules and log denied traffic. For guest access, use captive portal with a rotating password or sponsor approval, and isolate clients from each other. Scan the branch subnet regularly for unauthorized services and compare results to an asset inventory. These controls do not replace 802.1X but reduce the chance that an unmanaged device can reach POS systems.