How to Segment Your Network with VLANs & Microsegmentation

For years, enterprise networks were built on a simple assumption: once a device was “inside” the network, it could be trusted. That assumption no longer holds.

Modern attacks rarely stop at the initial compromise. Instead, attackers pivot—moving laterally across flat internal networks until they reach high-value targets like domain controllers, databases, or cloud sync services. In incident response engagements, lateral movement is often where the real damage occurs.

Network segmentation is the single most effective control for limiting that blast radius.

Two techniques dominate modern segmentation strategies:

• VLANs, which provide logical separation at the network layer
• Microsegmentation, which enforces fine-grained controls at the workload and application level

Used together, they form a layered, practical defence aligned with Zero Trust principles.

Why Network Segmentation Matters in the Real World

From hands-on experience managing enterprise and hybrid networks, segmentation delivers benefits well beyond security:

• Limits attacker lateral movement
• Contains malware outbreaks
• Reduces accidental exposure from misconfigurations
• Simplifies compliance audits (PCI-DSS, ISO 27001, HIPAA)
• Improves visibility into east-west traffic
• Makes troubleshooting easier by defining traffic boundaries

Flat networks may be easy to build—but they are difficult to defend and even harder to recover after an incident.

Part 1: Network Segmentation with VLANs

What VLANs Actually Do

A Virtual LAN (VLAN) is a logical separation at Layer 2 that allows devices to behave as if they’re on different physical networks—even when connected to the same switches.

VLANs don’t inherently enforce security. They create boundaries. Security comes from how traffic is allowed to cross those boundaries.

Where VLANs Work Best

VLANs are ideal for:

• Separating users, servers, and infrastructure
• Isolating guest and unmanaged devices
• Reducing broadcast traffic
• Enforcing coarse access control through firewalls or Layer 3 routing

In practice, VLANs are the foundation layer of segmentation.

Real-World VLAN Design Best Practices

1. Segment by Function, Not Convenience

Avoid designs like “VLAN per floor” or “VLAN per switch.” Instead, group systems by risk and purpose.

Example structure:

• VLAN 10 – User Workstations
• VLAN 20 – Server Infrastructure
• VLAN 30 – VoIP Phones
• VLAN 40 – Guest Wi-Fi
• VLAN 50 – Network Management
• VLAN 60 – IoT and Printers

This aligns security boundaries with real attack paths.

2. Enforce Inter-VLAN Access with Firewalls

Routing VLANs together without controls defeats the purpose.

Best practice:

• Route VLAN traffic through a firewall or Layer 3 device
• Apply explicit allow rules
• Default deny everything else

In real environments, most breaches succeed because inter-VLAN traffic was implicitly trusted.

3. Isolate Management Planes

Switches, firewalls, hypervisors, and IPMI interfaces should never be accessible from user VLANs.

Create a dedicated management VLAN:

• Restrict access to admin workstations only
• Require MFA where possible
• Log all access attempts

This single design choice eliminates an entire class of internal attacks.

4. Lock Down Unused Switch Ports

Unused switch ports are an often-ignored risk.

Best practice:

• Disable unused ports
• Assign them to a non-routed “black hole” VLAN
• Enable port security or 802.1X where possible

This prevents rogue devices and accidental loops.

Part 2: Microsegmentation – Where VLANs Stop Being Enough

What Is Microsegmentation?

Microsegmentation enforces workload-level access controls, not just network-level ones. Instead of asking “Which subnet is this traffic coming from?”, microsegmentation asks:

• Which application?
• Which workload?
• Which role?
• Which environment?

Policies are enforced close to the workload—often at the hypervisor, host firewall, or cloud control plane.

Why Microsegmentation Matters Today

In real enterprise environments:

• Applications share VLANs
• IP addresses change
• Cloud workloads scale dynamically
• Containers spin up and down constantly

Microsegmentation solves what VLANs can’t:

• East-west traffic control
• Application-aware policies
• Zero Trust enforcement inside the data centre and cloud

VLANs vs Microsegmentation (Practical Comparison)

They are complementary, not competing.

Microsegmentation Best Practices from the Field

1. Map Traffic Before Enforcing Policy

The biggest mistake teams make is enabling microsegmentation without understanding traffic flows.

Start by observing:

• Which services talk to each other
• On which ports
• How often
• From where

This avoids outages and builds confidence with stakeholders.

2. Group by Application and Risk

Instead of thinking in IPs, think in roles.

Example groupings:

• Web tier
• Application tier
• Database tier
• Management services
• Third-party integrations

Policies should reflect how applications are designed—not how networks are wired.

3. Default Deny Is Non-Negotiable

Microsegmentation only works when:

• All traffic is denied by default
• Explicit allow rules are created

Example:

• Allow: App Server → Database Server (TCP 5432)
• Deny: Everything else

This approach stops lateral movement cold—even after compromise.

4. Use Labels, Tags, and Identity (Not IPs)

Modern environments change constantly.

Use:

• Environment tags (Prod, Dev, Test)
• Application labels
• Tier identifiers

This ensures policies scale and survive infrastructure changes.

5. Continuously Monitor and Adjust

Applications evolve. Policies must follow.

Regularly:

• Review blocked traffic
• Remove unused rules
• Validate that policies still reflect business reality

Microsegmentation is not “set and forget”—it’s living security.

Combining VLANs and Microsegmentation (The Right Way)

The most effective architectures use both:

• VLANs provide coarse isolation
• Microsegmentation provides fine-grained enforcement

Example:

• VLAN 100 – Web Servers
  • Microsegmentation: Only allow HTTPS to load balancer
• VLAN 200 – App Servers
  • Microsegmentation: Only allow app-to-DB traffic
• VLAN 300 – Users
  • Microsegmentation: Enforce device posture and identity

This layered approach aligns perfectly with Zero Trust principles.

Common Segmentation Mistakes to Avoid

From real incident reviews, these errors appear repeatedly:

• Assuming VLANs alone equal security
• Allow-all rules between “trusted” VLANs
• Mixing users, servers, and IoT devices
• Hard-coding IP-based microsegmentation rules
• Skipping traffic discovery and testing

Most breaches exploit over-trust, not technical complexity.

Conclusion: Segmentation Is a Security Force Multiplier

Network segmentation is no longer optional. VLANs give you structure. Microsegmentation gives you precision. Together, they create an environment where attackers struggle to move, mistakes are contained, and visibility improves dramatically.

The goal isn’t complexity—it’s controlled access, enforced everywhere.

When implemented thoughtfully, segmentation doesn’t just improve security—it makes your entire network easier to manage, audit, and scale.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.