St. Alder Hospital: Segmenting 6,800 Medical and IoT Devices Without Stopping Care
St. Alder Regional Hospital has 2,400 staff endpoints and about 6,800 connected medical and IoT devices - infusion pumps, nurse call, badge readers, and two imaging suites - sharing a flat /16 VLAN with clinical workstations. An SRX1500 sits at the core, EX4600 distribution switches serve six floors, and Mist APs provide clinical Wi-Fi. HIPAA requires access control and audit, and a peer hospital suffered ransomware through an unmanaged imaging device last quarter. The CISO wants microsegmentation within 12 months. Clinical engineering says many devices cannot do 802.1X, vendor support contracts forbid agent installation, and imaging downtime must be zero. Change windows are two hours once a month. Nursing leadership will not accept a workflow regression. You are asked for a segmentation design that improves containment without breaking clinical operations.
1. Where do you enforce segmentation - SRX zones, EX firewall filters, or both - and how do you decide?
Read the worked answer
Use both, but for different jobs. The SRX1500 is the policy chokepoint between clinical zones - medical devices, clinical workstations, guest, and management - and provides stateful inspection, IPS, and logging. EX4600 firewall filters enforce intra-zone and east-west rules where traffic never crosses the SRX, but they are stateless and harder to audit, so keep them narrow: block inter-VLAN transit, protect management, and isolate device groups.
Place enforcement as close to the source as operationally possible. Hairpinning 6,800 devices through one SRX1500 creates a throughput and failure-domain problem. Use centralized policy intent, for example through Security Director, even when enforcement is distributed. For HIPAA, log both enforcement points to the same collector and test that denied flows are visible. Document which controls are stateful versus stateless so auditors understand coverage and so operations know what to troubleshoot.
2. How do you authenticate and contain devices that cannot run 802.1X or an agent?
Read the worked answer
Non-authenticating devices need identity by other means. Build a device inventory from switch MAC tables and Mist; profile by OUI, DHCP fingerprint, and traffic behavior. Put each device class in a dedicated VLAN or group, assign static IP reservations, and use MAC authentication bypass or Mist Access Assurance where the device supports it. Where it does not, use per-port configuration - sticky MAC, restricted VLAN, ACL - plus physical control.
Never put unknown devices in the clinical workstation VLAN. Create a quarantine VLAN with deny-all and a help-desk workflow. For imaging, use dedicated ports with a fixed policy and no 802.1X, compensating with port security and network monitoring. Review exceptions quarterly. Exceptions are risk acceptance, not design, and they need an owner and an expiry date.
3. Sequence a phased rollout that protects imaging uptime and preserves clinical workflow.
Read the worked answer
Phase by risk and reversibility. Phase 0 is discovery only, with no enforcement, for 30 days to build the inventory and baseline flows. Phase 1 enforces guest and management segmentation, which has low clinical impact. Phase 2 enforces medical-device groups that are already isolated by VLAN. Phase 3 enforces clinical-workstation-to-server rules in monitor-only, then block. Phase 4 handles imaging in a scheduled window with vendor engineers on the call and a tested rollback.
Use the two-hour monthly window for policy pushes, not architecture changes. Require a pre-change flow capture and a post-change verification checklist. If a clinical flow breaks, revert that group to monitor-only and investigate; do not widen policy globally. Publish a weekly exception report to nursing and clinical engineering so workflow regressions surface before they become incidents.