Why Is Segmentation Recommended For Network Design?
Introduction
Segmentation is recommended when you need to keep your network separated for security, organizational or performance reasons. It’s the practice of dividing one physical network into smaller logical networks in order to reduce broadcast domains, improve manageability and enhance the overall performance of the network.
Segmentation, when applied to the network, is always a good idea. Even if you have only one user and one IP address to connect your PC/laptop to the router, create a VLAN for that single device. It may not be a production network but it will still provide you with a mechanism of logically segmenting your network into smaller networks via virtual LANs (VLAN).
Example
For example, an organization might segment its production servers from its administrative servers so that if there is a server issue, only the problematic machine is impacted without taking down other servers or devices. Or, an organization may choose to segment by departmental boundaries so that certain machines can be accessed only by employees in that group. If different departments have very different data-access requirements then it makes sense to create separate VLANs for each department if they are on the same subnet (which is called micro segmentation).
Since VLANs allow network administrators to create separate broadcast domains, the term “VLAN segmentation” or “VLAN trunking” can sometimes be used interchangeably with “network segmentation”. Using either of these methods results in separate broadcast domains. However VLAN’s are sometimes considered a security enhancement whereas using router-to-router connections provides both security and ease of management benefits.
What Is The Difference Between Segmentation And Isolation?
If you want your Layer 2 segments to communicate with each other but not share any resources then this would be isolation rather than segmentation. For example, you might choose to isolate server ‘A’ on logical switch ‘A’ from server ‘B’ on logical switch ‘B’. There are no resources shared between these two VLANs beyond the hardware. The problem with this type of design is that it becomes more complex to manage, which is where using routers for inter-VLAN communication comes in very handy.
Why Network Segmentation is Recommended
There are a number of reasons why network segmentation is recommended.
Reduce broadcast traffic on your network by removing the need for every device to receive broadcasts from every other device on the subnet;
Ensure that traffic between VLANs will only ever traverse through permitted routers, so it adds security by restricting inter-VLAN communication to specific points; and permit sensitive resources (like finance or personnel records) to be accessible only by authorized users. For example, you might want user accounts in one VLAN/subnet to have access to HR data but not finance data. This type of design would also allow the IT team easy administration over the entire environment because they don’t have to jump from VLAN-to-VLAN to make changes.
When Not To Use Network Segmentation
Network segmentation is not recommended when you don’t need to keep your network separated for security, organizational or performance reasons. For example, if it’s just two people on one subnet then there’s no need to separate their VLAN’s into physically disparate networks. That will just add an unnecessary level of complexity and cost. It all comes down to understanding what the risks are in your environment and planning accordingly. If you feel that the benefits of segmentation outweigh the management overhead, then go ahead and implement them.
What You Should Know About Segmentation
Segmentation is easier than the alternative option of having every device on your network passing traffic between each other, so you need to consider whether there are good reasons for needing this type of design. Network segmentation requires more hardware than simply connecting all of your devices together, so it’s more expensive and may not be justifiable if you only have a small number of servers/workstations on each physical segment. For example, you will need more access points (AP) and switches to facilitate the increase in network segments. To manage larger numbers of smaller networks can also become time consuming as well as potentially more complex.
Finally, segmentation provides another layer of security by restricting inter-VLAN communication to specific points (i.e. routers). If you currently don’t use network segmentation in your environment, it would be worth considering whether it can provide some benefits to you and your business. With the right hardware and software solutions in place it will make life easier for IT administrators trying to manage their network infrastructure which helps them to save time and money.
Conclusion
Network Segmentation is one of the ways to create logical divisions between devices connected to your network. The benefits are security, administrative control and performance. However, it requires more hardware than simply connecting all of your devices together so it’s more expensive and may not be justifiable if you only have a small number of servers/workstations on each physical segment.
Network segmentation provides another layer of security by restricting inter-VLAN communication to specific points (i.e. routers). If you currently don’t use network segmentation in your environment, it would be worth considering whether it can provide some benefits to you and your business.
