Network segmentation
A flat network is a single room where everyone can reach everyone and it is the condition that turns one compromised laptop into a compromised estate. The intrusion almost never lands where the valuable thing is; it lands on a user machine and then moves, to the file server, the database, the domain controller, because nothing on a flat network says no. Segmentation is the practice of adding walls so that a foothold buys the attacker one room rather than the building and the honest version of it is more than drawing VLANs: it is making the VLANs real with filtering between them and hardening the layer-2 tricks that otherwise walk straight through.
Zones, not one broadcast domain
The first move is to stop running the organisation as one subnet. Split it into zones by trust and function, each its own VLAN and subnet, with routing between them that passes through a firewall rather than a permissive router:
VLAN 10 users 10.10.0.0/16
VLAN 20 servers 10.20.0.0/16
VLAN 30 databases 10.30.0.0/16 (reached only from the app tier)
VLAN 40 management 10.40.0.0/16 (admin access only)
VLAN 50 DMZ 10.50.0.0/24 (public-facing, trusts nothing inward)
The zones only mean something if the traffic between them is filtered by default-deny, which is why the inter-VLAN gateway should be a firewall, not a router that forwards everything. A user VLAN has no reason to reach the database VLAN directly; the app tier does, on one port. Write those allows explicitly and drop the rest and a compromised workstation can no longer open a socket to the database just because they share a building.
The management VLAN is the one to treat most strictly, because it reaches the control surfaces of everything, the hypervisors, the switches, the iDRACs. It is reachable from admin workstations or a bastion and from nowhere else and it never shares a wire with user or guest traffic.
VLANs are not a boundary until you harden layer 2
Here is where naive segmentation fails: a VLAN tag is an honour system and the switch defaults undermine it. Three layer-2 attacks turn “separate VLANs” back into a flat network and all three were in the yersinia toolkit a decade ago and still work on an untouched switch.
Dynamic Trunking Protocol lets an access port be negotiated into a trunk, at which point the attacker sees every VLAN; disable it. The native VLAN, left as 1, enables double-tagging, where a frame with two tags has its outer (native) tag stripped by the first switch and the inner tag delivered into the target VLAN; change the native VLAN to an unused, empty one and do not carry it. And unused ports left in the default VLAN are an open door; shut them and park them in a black-hole VLAN. On Cisco the defensive baseline is short:
interface range Gi0/1-48
switchport mode access ! never 'dynamic', kills DTP negotiation
switchport access vlan 10
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
vlan 999
name blackhole
! set the native VLAN to an unused id on every trunk, and prune it
Pair that with the DHCP snooping, Dynamic ARP Inspection and port-security covered elsewhere and the VLAN becomes a boundary rather than a suggestion. Skip it and the segmentation diagram is fiction.
Microsegmentation and the honest “zero trust”
“Zero trust” gets sold as a product; what it actually means for a network is that being inside a segment should not by itself grant access to the next thing, so the boundaries get finer and the identity gets checked rather than assumed. In practice that is microsegmentation, host or workload firewalls that restrict east-west traffic between machines in the same zone, so that two servers on the server VLAN only talk on the ports their roles require. It is the same default-deny applied one level down and it is what stops lateral movement within a zone once an attacker is past the zone wall. The point worth holding onto is that it is additive, not magic: it is segmentation plus authentication plus default-deny, carried closer to the workload and it stands or falls on the same discipline as the zones above it.
Separate the control traffic too
The management plane is not only a VLAN to restrict, it is traffic to isolate. Switch management, out-of-band interfaces (iDRAC, iLO, IPMI), cluster heartbeat and storage replication each want their own segment, both because they are sensitive and because mixing them with workload traffic creates failure modes, a congested link causing a cluster to fence, out-of-band management reachable from a user VLAN being a direct path to the hardware below the OS. The out-of-band interfaces in particular have a long history of weak firmware and default credentials, so they live on an isolated management network reached only through a bastion, never on the general network and never, ever on the internet.
Where to land
Split the flat network into zones by trust and function and filter between them with a firewall that defaults to deny so a foothold in one zone is not access to the next. Harden layer 2 so the VLANs are real: no DTP, a changed and unused native VLAN, unused ports disabled, plus DHCP snooping and DAI, because a VLAN without those is a label, not a wall. Carry the same default-deny down to east-west traffic with host or workload firewalls where lateral movement is the concern. And isolate the management and out-of-band networks hardest of all, reachable only through a bastion, because they sit below everything else you are trying to protect. The whole discipline comes down to one habit: every boundary denies by default and you add the specific holes the work requires, rather than starting open and hoping to close enough.
[edit: 2026] The Ansible implementation of all this: the nftables role .