3.4 Building the Boundaries: Identifying Segmentation Security

Segmenting a LAN is like putting walls inside a building: it keeps the finance team's traffic away from the guest Wi-Fi and stops one infected laptop from taking down everything. But walls only work if they're built right. This topic covers what goes wrong when segmentation is weak, which security controls actually fix those problems, and how to build subnets that carve your network into clean, non-overlapping pieces.

Threats and Vulnerabilities in a Segmented LAN

Even after you've split a network into segments, things can still go wrong. The most common problems fall into a few buckets: unauthorized access, connections from unverified devices, and data exposure. These are the risks that push network admins to care about confidentiality, integrity, and availability (the CIA triad) when designing access controls.

Weak or Missing Access Controls

When access controls don't properly separate user groups, devices, or resources, people who shouldn't be there can reach places they shouldn't. Think of a guest on the Wi-Fi who can suddenly browse the admin login page for the school's grade system. That's a segmentation failure.

Missing segmentation can also hurt in less dramatic ways. If every device shares the same broadcast domain, a flood of traffic from one group can slow shared resources (like a file server or printer) for everyone else. That drops productivity even when no attacker is involved.

Weak Wireless Security

Wireless is often the easiest way in because the signal doesn't stop at the wall. If a network uses weak wireless protection, attackers nearby can grab sensitive data or jump onto internal resources. Weak protection includes:

• Simple or default passwords (like admin123)
• Outdated encryption such as WEP, which can be cracked in minutes
• No encryption at all (an open network)

Once an attacker is on the wireless segment, they're inside the perimeter and can start poking at anything the segment can reach.

Unknown or Unverified Devices

Letting random devices connect is risky. An unverified device might be a personal laptop with malware, a rogue access point, or a packet sniffer plugged into a wall jack. These devices can:

• Intercept traffic between legitimate users
• Spread malware across the segment
• Bypass internal security tools that only watch known endpoints

Misconfigured Firewall Rules

Firewalls between segments are supposed to keep traffic contained. When those rules are weak or misconfigured (say, an "allow all" rule that got left in during testing), an attacker who compromises one machine can perform lateral movement: hopping from one system to another across multiple segments. A breach that should have been isolated to the guest VLAN ends up reaching the server room.

Security Controls That Reduce the Damage

Every control below should follow the principle of least privilege: users and devices get only the minimum access they need to do their job. Nothing more.

Controls Against Unauthorized Access

• Isolated guest wireless networks kept completely separate from the internal network. Guests get internet, nothing else.
• Separate IP address ranges or DHCP pools for each group of devices. Students on one range, staff on another, IoT devices on a third.
• Physical separation using different switches or routers for sensitive groups. If two networks don't share hardware, they can't accidentally share traffic.

Controls Against Weak Wireless Security

• Give the wireless segment its own unique SSID so it's clearly labeled and separated.
• Require strong passwords (long, mixed characters, not reused).
• Use WPA2 or WPA3 encryption. These are the current standards. Never WEP.

Controls Against Unknown Devices

• MAC address filtering: only approved MAC addresses are allowed to connect. Everything else gets blocked at the switch.
• Disable unused ports by putting them into a down state. An open port in an empty classroom is an open invitation.
• DHCP reservations: the DHCP server only hands out IP addresses to devices it recognizes. Unknown devices don't get an address, so they can't talk on the network.

Controls Against Lateral Movement

• Allow only essential services to cross between segments. For example, a print service might be the one thing permitted to reach across so that staff can send jobs to a shared printer. Everything else stays local.
• Use deny-by-default firewall or access policies. The rule is: block everything, then open specific holes only for the traffic you actually need. This is the opposite of "allow everything, then block known bad stuff," which always leaves gaps.

The common thread: each control shrinks what an attacker can reach, even if they do get in.

Subnetting: Splitting a Network into Segments

Subnetting is a form of network segmentation that breaks one network into smaller pieces called subnets. Beyond security, subnetting eases congestion (smaller broadcast domains) and makes networks easier to manage.

How Subnet Masks Work

A subnet mask tells you which bits of an IP address identify the network and which identify the host. When you subnet, you take some host bits and reassign them to act as network bits. That gives you more subnets but fewer hosts per subnet.

The formula for usable hosts in a subnet is:

$2^n - 2$

where n is the number of host bits. You subtract 2 because the first address in any subnet is reserved as the network address (identifies the subnet) and the last address is the broadcast address (used to send a message to every device on that subnet). Neither can be assigned to a host. The addresses in between form the usable host range.

Picking the Right Subnet Size

The fitting size for a subnet is the smallest one that still holds every host you need, plus those two reserved addresses. You round up to the nearest power of 2.

Subnet A example: You need to fit 27 hosts.

• 27 hosts + 2 reserved = 29 addresses needed
• Round up to the next power of 2: 32
• $2^5 = 32$, so you need 5 host bits
• Usable hosts: $2^5 - 2 = 30$ ✓

Subnet B example: You need to fit 12 hosts.

• 12 hosts + 2 reserved = 14 addresses needed
• Round up to the next power of 2: 16
• $2^4 = 16$, so you need 4 host bits
• Usable hosts: $2^4 - 2 = 14$ ✓

Walking Through a Subnet Split

Start with the network 192.168.1.0 using mask 255.255.255.0. That's 8 host bits, so $2^8 = 256$ total addresses and 254 usable hosts.

Now change the mask to 255.255.255.128. You just borrowed one host bit for the network. That splits the original network into two halves:

• Subnet 1: 192.168.1.0 to 192.168.1.127
  • Network address: 192.168.1.0
  • Broadcast address: 192.168.1.127
  • Usable range: 192.168.1.1 to 192.168.1.126 (126 hosts)
• Subnet 2: 192.168.1.128 to 192.168.1.255
  • Network address: 192.168.1.128
  • Broadcast address: 192.168.1.255
  • Usable range: 192.168.1.129 to 192.168.1.254 (126 hosts)

Each subnet now has 7 host bits: $2^7 - 2 = 126$ usable hosts. Together they give you two separate segments you can treat as different security zones.

Assigning Subnets to VLANs and Segments

Once your subnets exist, you assign each one to a different VLAN or segment. That keeps traffic isolated at both the IP layer and the switching layer. Every subnet needs:

• Its own subnet mask
• An IP address range that doesn't overlap with any other subnet

Overlapping ranges cause routing chaos. Devices won't know where to send traffic, and some addresses may belong to two subnets at once.

Configuring and Verifying Subnets

You push the subnet configuration to routers or switches either through a web interface or the CLI (command line interface). A simplified example of what that might look like on a router interface:

</>Code
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.128
 no shutdown

After the subnets are configured, check that devices in the same subnet can actually talk to each other. A quick ping between two hosts on the same subnet confirms the mask and address range are set correctly. If devices on the same subnet can't reach each other, something is off: wrong mask, wrong gateway, or an address outside the usable range.

Putting It All Together

Good segmentation is subnetting plus controls working together. The subnet carves out the space. The VLAN enforces the boundary at the switch. The firewall decides what crosses between segments. The wireless settings lock down who gets on in the first place. MAC filtering, DHCP reservations, and disabled ports catch unverified devices before they reach anything important. Each piece covers a different weakness, and together they make it much harder for a single mistake to turn into a network-wide breach.