VLANs and Network Segmentation

Here you will divide a network into segments and justify which traffic should be allowed to pass through. You need an address, prefix, gateway, and port from IP, subnets, and default gateway and network protocols.

Start with the VLAN example, Task 1, and the firewall exercise. The core path is an access plan detailing expected allowed and blocked traffic. Practical changes require a separate, approved testing environment and a rollback method to the previous configuration. Without such access, use the example for planning purposes only; do not modify the school’s network. Subnet calculation and DHCP setup are optional extensions.

Why Segment?

Segmentation divides the network into smaller parts. VLAN separates traffic at layer 2. A router or layer-3 switch can still forward traffic between them; firewalls or access rules determine what is actually allowed.

What is a VLAN?

A virtual local area network (VLAN) divides a physical switch into logical networks. The VLAN ID indicates which VLAN the traffic belongs to. Access between VLANs must additionally be controlled.

Video: How a VLAN segments a physical network

The video explains how a VLAN divides one physical network into multiple logical networks and separates traffic between them.

In this example, each VLAN uses its own IPv4 subnet:

Tagged vs. untagged traffic

For VLANs to function across multiple switches (or between a switch and router), tagging is used:

A regular PC is typically connected to an access port without itself marking the traffic with a VLAN ID. A trunk can carry multiple allowed VLANs, not necessarily all of them. A trunk can also have an untagged, so-called native VLAN. Read the actual configuration in the port profile before interpreting the traffic path.

Task 1 - See VLANs in practice

If you have permission to read the network setup in UniFi or another tool, investigate without making any changes:

• Look at which VLANs are configured
• Which ports are set as access, and which as trunk?
• Compare the PC’s IP configuration with the subnet and port profile. The IP address alone does not confirm VLAN membership.

Without administrative access: Use the example table. A client has the address 10.0.30.10/24 and gateway 10.0.30.1. Which of the subnets in the example does it fit into, and what type of port would you choose for a standard PC? The expected answer is the student subnet and an access port in VLAN 30. This is an interpretation of the example, not a measurement of your own network.

Firewall rules between VLANs

First, describe who should initiate a connection, to which destination and on which protocol/port. A generic label such as “employees to servers” is too coarse-grained to configure directly. The table below is an example policy that needs to be specified:

Return traffic does not mean that the server should be able to initiate new connections to everyone. Rules for established/related and the order of rules must match the firewall. Traffic between devices in the same VLAN usually does not go through the firewall that controls routing between VLANs.

This is the desired final policy, not a message to enable broad blocking first in an active network. Retain necessary administration, DNS, and DHCP while a scoped test setup is modified.

Exercise: Client via proxy, not directly to the app

Use these example roles or equivalent known values from a test environment:

The client should access the application through the proxy but not directly on the application port. Docker Level 3 shows how the proxy and app are set up and controlled. Write the plan in a separate document:

In this example, the proxy and the app reside in the same VLAN. The connection between them is tested directly but is not governed by these inter-VLAN rules. A successful test via the proxy demonstrates that the app was accessible through that path; however, a failed direct test alone does not prove that the firewall blocked it correctly.

Practical exam in an approved test environment

Use an already functioning proxy/app setup. Note the default state and current rules, and retain console access or another administrative path so that changes can be rolled back. Verify source, destination, port, direction, and rule order before modifying a single scoped rule.

From the client, test the application name through the proxy. For direct app access you can use:

curl --fail --show-error --connect-timeout 5 --max-time 10 http://10.0.50.20:5000/status

The address is from the example; replace it with the test environment’s application address. After blocking, this client should not be able to establish an HTTP connection. A timeout may have other causes; compare the result with the firewall log or rule counter when provided by the tool, and also verify that the application still responds through the proxy. An HTTP 404 or 500 from the application port indicates that the HTTP connection was established, even though curl --fail exits with an error.

Checkpoint: Planned vs. Actual Access

Display both tests with source, destination, expected result, and actual result. Explain the rule and what the tests verify. In case of a deviation, investigate one rule or one traffic path at a time and repeat the check. Roll back if the change breaks necessary access.

If you have only used the example, mark the results as expected and explain which tests remain. The plan is then complete, but implementation and actual effect are not demonstrated. Subnet calculation and DHCP below are optional extensions following this checkpoint.

Subnetting

Re-election: Use [[Protocols Level 3 - IP, subnets and default gateway|IP and subnets]] when selecting a different address range. The numbers below apply to common IPv4 subnets and show the number of host addresses after the network and broadcast addresses:

Task 2 - Calculate a Subnet

Optional calculation exercise: Use the method from the IP lookup or a subnet calculator, for example subnet-calculator.com:

• Enter 10.0.60.0 with mask /24. How many addresses do you get?
• What happens if you change it to /25? Or /23?
• Which one would you choose for a classroom with 30 students?

Check: /24 gives 254 host addresses, /25 gives 126 and /23 gives 510. Justify your choice based on all devices that need an address, including the gateway and other equipment; the number of students is not the entire address requirement.

Per-VLAN DHCP

Optional lookup: Clients that require automatic IP configuration need a DHCP service to provide the correct settings for the subnet. Static addresses do not require DHCP. [[Protocols Layer 2 - Network services and server roles|Network services and server roles]] explains DHCP and reservations.

Example for the Student VLAN:

Summary

• Segmentation divides the network into parts where traffic can be controlled
• A VLAN is a virtual network on the same physical switch
• Access ports connect devices to one VLAN; trunk ports carry multiple VLANs
• Firewall rules determine what is allowed between VLANs
• In the example, each VLAN has its own subnet; DHCP is relevant when addresses are assigned automatically
• Final policy: block unnecessary traffic and allow the agreed-upon services

Sources: UniFi: access rules and response traffic and access/trunk ports.