Network Segmentation

This page is flagged for revision (inc questions).

What is Network Segmentation?

Network segmentation is the process of dividing a network into smaller sections to improve performance, security, and resource management.

By segmenting networks, administrators can reduce congestion, enhance security, and optimise network traffic flow.

Segmenting

Description: Segmenting splits a network into smaller logical groups or zones. Devices in each zone communicate freely within their group, but access to other zones can be controlled.

How it's done: Routers and firewalls are used to define boundaries between zones. Rules control which devices or services can cross those boundaries.

Example: A company separates its guest Wi-Fi from the internal network. Guests can browse the internet, but can’t access office printers or shared folders.

Segmenting

Subnetting

Description: Subnetting breaks a large IP network into smaller sub-networks. Each subnet has its own address range and acts like a mini network.

How it's done: An IP address block (e.g. 192.168.0.0/24) is divided into smaller chunks (e.g. 192.168.0.0/26, 192.168.0.64/26). Each department or building gets its own range.

Example: In a school, one subnet is used for the science labs, another for administration, and another for the library. This helps organise traffic and makes it easier to track problems.

Subnet Masks

What they are: A subnet mask marks which bits of an IP address identify the network and which bits identify the host. In dotted-decimal form (e.g. 255.255.255.192) the 1-bits (255s and the left part of the last octet) mark the network portion; the 0-bits mark the host portion. The CIDR form (e.g. /26) simply tells you how many leading 1-bits the mask has.

What they achieve: By separating network bits from host bits, subnet masks let you: (1) find the network address of any IP (all host bits set to 0), (2) find the broadcast address (all host bits set to 1), (3) count usable hosts per subnet (2h − 2, where h = number of host bits).

Quick rules:

  • CIDR → mask: /24 = 255.255.255.0; /25 = 255.255.255.128; /26 = 255.255.255.192; /27 = 255.255.255.224; /28 = 255.255.255.240.
  • Block size trick (IPv4): For the octet where the mask isn’t 255 or 0, compute 256 − mask_octet. That’s the subnet “step”. Networks start at multiples of that step.
  • Bitwise AND: IP AND mask = network address. Broadcast = next network − 1.

Worked Example 1 — Identify network, broadcast, usable range

Given: IP 192.168.0.130 with mask /26 (255.255.255.192).

  1. Block size: 256 − 192 = 64 ⇒ subnets in the last octet start at .0, .64, .128, .192.
  2. Which subnet? .130 sits between .128 and .191 ⇒ network 192.168.0.128, broadcast 192.168.0.191.
  3. Usable host range: 192.168.0.129 to 192.168.0.190 (62 hosts, since 26 − 2 = 62).

Check (bitwise): 192.168.0.130 AND 255.255.255.192 = 192.168.0.128 (network).

Worked Example 2 — Design subnets for a host requirement

Task: From 172.16.4.0/24, create subnets that each support at least 50 hosts.

  1. Choose host bits: We need ≥50 ⇒ smallest power of two ≥52 (including network/broadcast) is 64 ⇒ host bits h = 6.
  2. Subnet mask: IPv4 has 32 bits ⇒ / (32 − h) = /26 ⇒ mask 255.255.255.192. Usable hosts per subnet = 26 − 2 = 62.
  3. List the /26 ranges inside 172.16.4.0/24: Step = 256 − 192 = 64.
Subnet (CIDR)NetworkUsable RangeBroadcastUsable Hosts
172.16.4.0/26172.16.4.0172.16.4.1 – 172.16.4.62172.16.4.6362
172.16.4.64/26172.16.4.64172.16.4.65 – 172.16.4.126172.16.4.12762
172.16.4.128/26172.16.4.128172.16.4.129 – 172.16.4.190172.16.4.19162
172.16.4.192/26172.16.4.192172.16.4.193 – 172.16.4.254172.16.4.25562

Exam tip: For quick subnet ranges, use the block size trick; for verification, use bitwise AND. Always exclude the network and broadcast addresses from the usable host range.

Subnetting

Virtual LANs (VLANs)

Description: VLANs allow administrators to group devices together logically even if they are not physically connected to the same switch.

How it's done: Managed switches assign ports or devices to VLAN IDs. VLAN-aware routers or switches keep traffic from different VLANs separated, unless explicitly allowed.

Example: In an office, all VoIP phones are assigned to VLAN 10 and all computers to VLAN 20. This keeps voice traffic isolated for better quality and security.

VLAN

Comparison of Segmentation Techniques

Type Purpose Common Usage Key Benefits
Segmenting Separates devices for control and traffic management Office networks, data centres Improved security and better traffic isolation
Subnetting Divides IP ranges into logical groups Large corporate networks Efficient IP address management
VLANs Creates logical network groups Enterprises, universities, ISPs Increased flexibility and traffic performance

Real-World Applications of Network Segmentation

Enterprise Networks Using VLANs

In a medium-to-large enterprise, the internal network must accommodate multiple departments such as Human Resources (HR), Finance, IT, and Sales. Each department has specific requirements, permissions, and levels of sensitive data. Using Virtual Local Area Networks (VLANs) allows the network administrator to logically segment the network without additional physical infrastructure.

Users, Roles, and Permissions

  • HR Department: Users include HR staff and managers. Permissions allow access to employee records and payroll systems, but restrict access to finance or IT systems.
  • Finance Department: Users are accountants and finance managers. Permissions focus on accounting systems and sensitive financial data, isolated from other departments.
  • IT Department: IT staff manage network infrastructure. They have broader access but restricted permissions to personal employee data, protecting privacy.

IP Address Allocation

Each VLAN is assigned a unique subnet, e.g. HR VLAN uses 192.168.10.0/24, Finance VLAN uses 192.168.20.0/24, and IT VLAN uses 192.168.30.0/24. Devices are allocated IP addresses either statically for servers or dynamically via DHCP for client machines. VLAN tagging ensures traffic from each VLAN remains isolated even on shared physical switches.

Why VLANs Are Suitable

VLANs provide logical separation without the cost of additional physical switches. They reduce broadcast traffic, enhance security by isolating sensitive data, and simplify network management. In this scenario, HR and Finance remain protected from general network users while IT can oversee network operations safely.

Data Centres Using Subnetting

Data centres host hundreds or thousands of servers supporting web services, databases, and cloud applications. To efficiently manage traffic and enhance security, subnetting is used to divide the network into logical segments.

Users, Roles, and Permissions

  • Server Administrators: Responsible for server maintenance and monitoring. Permissions include SSH access to servers in their subnet, but no access to unrelated subnets.
  • Network Operators: Manage routing, firewalls, and traffic flow. Permissions cover the overall network but restrict server-specific changes unless authorized.
  • Application Teams: Deploy and manage applications. Access is restricted to the relevant application subnet, protecting other servers and sensitive data.

IP Address Allocation

The data centre uses a 10.0.0.0/16 network divided into multiple /24 subnets. For example, web servers may use 10.0.1.0/24, database servers 10.0.2.0/24, and internal management servers 10.0.3.0/24. Each server receives a static IP, while DHCP is used for temporary VM instances. Subnetting improves traffic management and simplifies access control lists (ACLs) for security.

Why Subnetting Is Suitable

Subnetting allows administrators to segment networks logically based on server roles, reducing congestion and improving security. By isolating traffic within subnets, sensitive data (e.g. databases) is protected from less-secure areas like public-facing web servers. It also facilitates IP management in large-scale environments.

Universities Using a Hybrid Approach (VLAN + Segmentation)

Universities need to support students, academic staff, administration, and research labs on the same physical network. A hybrid approach combines VLANs with subnetting to logically separate users and resources while maintaining flexibility.

Users, Roles, and Permissions

  • Students: Access to campus Wi-Fi, e-learning platforms, and lab PCs. Permissions restrict access to staff-only systems.
  • Academic Staff: Access to grading systems, academic software, and research servers. Staff VLANs restrict students from sensitive academic data.
  • Administration: Access to HR, finance, and scheduling systems. Permissions ensure administrative data remains isolated.
  • Research Labs: Access to lab-specific servers and high-performance computing clusters. VLANs and firewalls prevent unintended student access.

IP Address Allocation

The university network might use a 172.16.0.0/16 private network, divided as follows:

  • Students: 172.16.10.0/24 – dynamic IPs via DHCP for laptops and devices.
  • Staff: 172.16.20.0/24 – mostly static IPs for desktops and academic servers.
  • Administration: 172.16.30.0/24 – static IPs for administrative machines.
  • Research Labs: 172.16.40.0/24 – static IPs for lab servers and high-performance nodes.

VLAN tagging ensures that even on shared switches, traffic is logically separated. Inter-VLAN routing is carefully controlled via firewalls.

Why Hybrid Approach Is Suitable

This approach allows universities to scale efficiently, support diverse users, and maintain security boundaries. VLANs isolate traffic on the same physical infrastructure, while subnetting provides structured IP management and simplifies access control. It balances flexibility, performance, and security, making it ideal for complex campus networks.

Why Is Network Segmentation Important?

  • Security: Limits access to sensitive areas of the network. Isolates critical systems from threats.
  • Efficiency: Reduces unnecessary traffic across the network. Limits excessive data traffic to one segment.
  • Control: Enables prioritisation of important services and users.
  • Scalability: Makes growing networks more manageable.

 Key Takeaways

  • Network segmentation improves security, performance, and scalability.
  • Techniques include segmenting, subnetting, and VLANs, each serving different goals.
  • Effective in environments like corporate offices, schools, and data centres.
  • Segmentation supports traffic isolation, IP address management, and access control.