Windows Infrastructure Network Segmentation

๐Ÿ”’ Secure Bits ๐Ÿ’ก
๐—ฆ๐˜๐—ถ๐—น๐—น ๐˜‚๐˜€๐—ถ๐—ป๐—ด ๐—ท๐˜‚๐˜€๐˜ ๐˜๐˜„๐—ผ ๐—ฉ๐—Ÿ๐—”๐—ก๐˜€ย โ€” one for servers, one for clients?
Thatโ€™s not security. Thatโ€™s a ๐—ณ๐—น๐—ฎ๐˜ ๐—ป๐—ฒ๐˜๐˜„๐—ผ๐—ฟ๐—ธ.

Even a very basic Active Directory environment needs more segmentation than two VLANs – I see this way too often, so ๐—น๐—ฒ๐˜’๐˜€ ๐—ด๐—ฒ๐˜ ๐—ฟ๐—ถ๐—ฑ ๐—ผ๐—ณ ๐˜๐—ต๐—ถ๐˜€.

๐—›๐—ฒ๐—ฟ๐—ฒโ€™๐˜€ ๐˜„๐—ต๐—ฒ๐—ฟ๐—ฒ ๐˜†๐—ผ๐˜‚ ๐˜€๐—ต๐—ผ๐˜‚๐—น๐—ฑ ๐˜€๐˜๐—ฎ๐—ฟ๐˜:
๐Ÿ”น ๐——๐—ผ๐—บ๐—ฎ๐—ถ๐—ป ๐—–๐—ผ๐—ป๐˜๐—ฟ๐—ผ๐—น๐—น๐—ฒ๐—ฟ๐˜€ โ€” isolated in their own VLAN(s)
๐Ÿ”น ๐—”๐—ฑ๐—บ๐—ถ๐—ป ๐—ช๐—ผ๐—ฟ๐—ธ๐˜€๐˜๐—ฎ๐˜๐—ถ๐—ผ๐—ป๐˜€ (๐—ฃ๐—”๐—ช๐˜€) โ€” separate VLANs for each tier
๐Ÿ”น ๐—ฆ๐—ฒ๐—ฟ๐˜ƒ๐—ฒ๐—ฟ๐˜€ โ€” grouped by security tiers and also roles (e.g., WSUS and Entra Connect need to access the internet โ€” separate them from other tier 0 devices)
๐Ÿ”น ๐—–๐—น๐—ถ๐—ฒ๐—ป๐˜๐˜€ โ€” likely need multiple VLANs within Tier 2

๐Ÿ’ก You can go even further with ๐—บ๐—ถ๐—ฐ๐—ฟ๐—ผ๐˜€๐—ฒ๐—ด๐—บ๐—ฒ๐—ป๐˜๐—ฎ๐˜๐—ถ๐—ผ๐—ปย โ€” controlling traffic per host or per app.

๐—ง๐—ต๐—ถ๐—ป๐—ธ ๐—ผ๐—ณ ๐—ถ๐˜ ๐˜๐—ต๐—ถ๐˜€ ๐˜„๐—ฎ๐˜†:
โžก๏ธ Tiering Model protects authentication
โžก๏ธ Network segmentation protects communication

They go ๐—ต๐—ฎ๐—ป๐—ฑ ๐—ถ๐—ป ๐—ต๐—ฎ๐—ป๐—ฑ.

Need help planning traffic rules between roles?
๐Ÿ“˜๐—–๐—ต๐—ฒ๐—ฐ๐—ธ ๐—ผ๐˜‚๐˜ ๐˜๐—ต๐—ฒ ๐—ณ๐—ฟ๐—ฒ๐—ฒ ๐—ด๐˜‚๐—ถ๐—ฑ๐—ฒ:
https://academy.horizon-secured.com/p/windows-infrastructure-security-guides

๐—›๐—ผ๐˜„ ๐˜€๐—ฒ๐—ด๐—บ๐—ฒ๐—ป๐˜๐—ฒ๐—ฑ ๐—ถ๐˜€ ๐˜†๐—ผ๐˜‚๐—ฟ ๐—ฒ๐—ป๐˜ƒ๐—ถ๐—ฟ๐—ผ๐—ป๐—บ๐—ฒ๐—ป๐˜?