3.5 Network Segmentation, DMZ & Access Control Lists

3.5 Network Segmentation, DMZ & Access Control Lists

Quick Summary: Logical and physical network segmentation insulates sensitive enterprise resources. Demilitarized Zones (DMZs) isolate public-facing servers between perimeter and internal firewalls. Virtual Local Area Networks (VLANs) and switch port security enforce Layer 2 boundaries. Cisco Access Control Lists (ACLs) filter Layer 3/4 traffic top-down ending in an Implicit Deny, while Network Address Translation (NAT/PAT) hides internal private IP structures.

Monolithic "flat" networks present catastrophic security risks: if an attacker compromises a single endpoint, they can freely scan, exploit, and pivot laterally across the entire organization. Effective security architecture requires dividing networks into isolated security zones governed by strict access controls.

---

1. Demilitarized Zones (DMZs) & Perimeter Isolation

A Demilitarized Zone (DMZ)—also known as a Screened Subnet—is a physical or logical subnetwork that exposes an organization's public-facing services (e.g., Web servers, Mail relays, DNS servers, Reverse Proxies) to an untrusted network like the Internet, while keeping the internal local area network (LAN) isolated.

Primary Architectural Objectives of a DMZ

• Containment of Compromise: If an attacker successfully exploits a vulnerability in a public web server, the DMZ architecture prevents the attacker from directly accessing internal Active Directory domain controllers, internal databases, or user workstations.
• Strict Traffic Directionality: Firewalls permitting DMZ zones allow incoming Internet connections only to specific DMZ hosts on dedicated ports (e.g., TCP 443 for HTTPS). Traffic originating from the DMZ toward the internal LAN is strictly prohibited or restricted to heavily authenticated, encrypted channels.

DMZ Design Topologies

1. Dual-Firewall DMZ (Screened Subnet - Recommended): Uses two distinct firewalls (often from different vendors to avoid single-vendor zero-day vulnerability exploitation):
   • External Perimeter Firewall: Sits between the Internet and the DMZ. Allows public traffic to reach DMZ services on specified ports.
   • Internal Firewall: Sits between the DMZ and the internal LAN. Enforces strict rules preventing DMZ systems from initiating connections into internal networks.
2. Three-Legged Firewall DMZ (Single Firewall): Uses a single security appliance with three distinct interfaces: Interface 1 (Internet/Untrusted), Interface 2 (DMZ/Semi-trusted), and Interface 3 (Internal LAN/Trusted).

2. Network Segmentation, VLANs, and Port Security

Logical segmentation divides a monolithic flat network into smaller, isolated sub-networks to reduce broadcast traffic, enforce access controls, and contain ransomware lateral movement.

Virtual Local Area Networks (VLANs) & IEEE 802.1Q

A VLAN groups network nodes logically regardless of their physical switch location. Switches use IEEE 802.1Q to insert a 4-byte VLAN tag into Ethernet frame headers across inter-switch trunk links.

• Access Ports: Assigned to a single specific VLAN for end-user endpoints (workstations, printers).
• Trunk Ports: Carry traffic for multiple VLANs simultaneously between switches or routers.
• Native VLAN: An 802.1Q trunk port setting where untagged frames are assigned. Default is VLAN 1.

VLAN Security Attacks & Mitigations

• VLAN Hopping (Switch Spoofing): Attacker sends Dynamic Trunking Protocol (DTP) signals to negotiate an unapproved trunk link. Mitigation: Disable DTP on access ports (switchport nonegotiate or switchport mode access).
• VLAN Hopping (Double Tagging): Attacker sends a frame with two 802.1Q tags (Outer tag = Native VLAN 1, Inner tag = Victim Target VLAN 10). Mitigation: Change Native VLAN from default VLAN 1 to an unused VLAN ID (e.g., VLAN 999).
• DHCP Starvation / Spoofing: Attacker floods switch with fake MAC addresses to exhaust DHCP pool. Mitigation: Enable DHCP Snooping on switch ports.

Switch Port Security Violation Modes

Cisco Port Security limits allowed MAC addresses on access ports (Static, Dynamic, or sticky). When an unauthorized MAC address connects, the switch executes a violation action:

1. Protect: Drops frames from unauthorized MACs silently. No Syslog alerts; no counter increment.
2. Restrict: Drops unauthorized frames, increments violation counter, and sends Syslog alerts.
3. Shutdown (Default): Immediately disables the physical port, placing it into an err-disable state requiring administrative recovery.

3. Cisco Access Control Lists (ACLs) & NAT/PAT

An Access Control List (ACL) is a sequential collection of permit and deny conditions applied to router or firewall interfaces.

ACL Types & Placement Rules

Sequential Evaluation Mechanics

1. Top-Down Processing: Packets are evaluated against ACL rules sequentially from top to bottom.
2. First-Match Action: Once a packet matches a rule's criteria, the router executes the action (permit or deny) immediately and ceases further evaluation.
3. Implicit Deny Any: The final rule of every Cisco ACL is an invisible deny ip any any. Packets matching no explicit rule are silently dropped.

Wildcard Masks Explained

Cisco ACLs use Wildcard Masks (inverse masks):

• Binary 0 (0): "Match this exact bit value."
• Binary 1 (1): "Ignore this bit value (wildcard)."
• Example: Single host 192.168.10.50 requires wildcard 0.0.0.0 (or host 192.168.10.50). Entire /24 subnet 192.168.10.0/24 requires wildcard 0.0.0.255.

Network Address Translation (NAT) & Port Address Translation (PAT)

• RFC 1918 Private Ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (non-routable on public Internet).
• Static NAT (1:1): Maps 1 private IP to 1 public IP for DMZ servers.
• PAT / Overload (1:Many): Maps thousands of internal private IP hosts to a single public IP address by assigning dynamic high-numbered Layer 4 source ports (ephemeral ports 49152 - 65535).
• Air-Gapping & Bastion Hosts: Physical air-gapping isolates SCADA/ICS OT environments. Jump Boxes (Bastion Hosts) enforce MFA and session recording for remote administrative access.

---

4. CIDR Notation and Why Address Boundaries Are Security Boundaries

Blueprint sub-topic 2.2 asks how network addresses impact network security, and names CIDR notation explicitly. Classless Inter-Domain Routing (CIDR) notation writes a network as an address followed by a slash and the number of bits fixed as the network portion — 192.168.10.0/24 means the first 24 bits identify the network and the remaining 8 bits identify hosts.

CIDR matters for security work because every segmentation decision, every ACL entry, and every firewall rule is expressed as a prefix. Getting the prefix length wrong by a single bit doubles or halves the number of hosts a rule affects.

Prefix reference

Two addresses in each ordinary subnet are unusable for hosts: the network address (all host bits 0) and the broadcast address (all host bits 1). Hence "usable hosts = total − 2".

CIDR and wildcard masks

Cisco ACLs use wildcard masks, which are the bitwise inverse of the subnet mask. Converting between the two is a routine exam task:

Worked example: to permit only the finance VLAN 10.20.30.0/26 toward a server, the wildcard is 0.0.0.63 (64 addresses − 1), so the rule reads permit ip 10.20.30.0 0.0.0.63 host 10.50.1.10. Writing 0.0.0.255 instead would silently admit four times as many hosts — the kind of one-character error that turns a segmentation control into a hole.

Public vs. private addressing

RFC 1918 private ranges — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — are not routable across the public internet. That gives a modest, incidental security benefit: an internal host using a private address cannot be reached directly from the internet without an explicit NAT or port-forwarding rule. This is not a security control in itself. NAT is an address-conservation mechanism that happens to obscure internal topology; it does not inspect traffic, and it provides no protection against malware that initiates an outbound connection, which is exactly what modern command-and-control does.

IPv6 removes the address-scarcity motivation for NAT entirely, since hosts can hold globally routable addresses. Security therefore has to come from firewall policy rather than from accidental unreachability. Two IPv6 specifics worth knowing: link-local addresses (fe80::/10) are present on every interface, and unique local addresses (fc00::/7) are the rough IPv6 analogue of RFC 1918 space. A frequent real-world failure is a network hardened carefully for IPv4 while IPv6 remains enabled and unfiltered, leaving an unmonitored parallel path into the same hosts.

---

5. Honeypots and Deception Technology

Blueprint sub-topic 2.3 lists the honeypot alongside the DMZ, proxy server, IDS, and IPS as network infrastructure a technician should recognise.

A honeypot is a decoy system deliberately made to look like an attractive target — an unpatched server, an exposed database, a file share named HR_Salaries — that has no legitimate business function. Because no authorised user has any reason to touch it, any interaction with a honeypot is suspicious by definition. That property is what makes it valuable: it produces very high-fidelity alerts with almost no false positives, in contrast to an IDS that must distinguish malicious traffic from a large volume of legitimate traffic.

Purposes

1. Early warning. A honeypot touched during internal reconnaissance reveals an intruder who has already breached the perimeter, often before they reach anything of value.
2. Threat intelligence. Observing which exploits, credentials, and tooling an attacker uses informs detection rules elsewhere.
3. Diversion and delay. Time spent on a decoy is time not spent on production systems, and it extends the defender's window to respond.

Classification

Deployment and cautions

A honeypot is normally placed inside a tightly controlled segment — frequently near or within the DMZ, or on an isolated internal VLAN — with strict egress filtering so it cannot originate outbound connections. Two cautions the exam may probe:

• A high-interaction honeypot is a real, deliberately vulnerable machine. If it is not isolated, an attacker who compromises it gains a foothold inside your network. Containment design is not optional.
• A honeypot is a detection and intelligence tool, not a protective control. It does not defend the production systems around it. If an exam option proposes a honeypot as the remedy for an unpatched public server, that option is wrong — patching is.