A2.2.4 — Network Segmentation

← Back to A2.2 overview

What is Network Segmentation?

Dividing a computer network into smaller, distinct segments or subnetworks. Primarily enhances performance and security by allowing more controlled access, reduced congestion, and tailored security policies.

  • Security: Only allowed traffic can access resources within each segment. Devices in one segment cannot cross into another (e.g. guest Wi-Fi cannot access internal servers).
  • Performance: Reduces congestion — heavy traffic in one segment does not affect others. Administrators can upgrade specific segments without overhauling the entire network.
  • Scalability: New segments can be added without disrupting existing configurations.
  • Management: Traffic monitored and managed more effectively within segments — quicker identification and resolution of issues.

Subnetting

Dividing a larger IP network into smaller, logically segmented networks called subnets. The subnet mask dictates how the IP address space is divided.

  • Host address: The actual IP address assigned to a device on the network. Must be within the range of the network address and broadcast address.
  • Network portion: The part of the IP address identifying the network.
  • Host (device) portion: The part identifying the specific device on that network.
  • The subnet mask distinguishes between the two : 1s = network portion, 0s = host portion.

How subnetting works

To find the network address, perform a bitwise AND operation between the IP address and the subnet mask. Compare each bit: if both bits are 1 → result is 1. If either bit is 0 → result is 0.

Example: IP 192.168.1.10, Subnet mask 255.255.255.0

255 in binary = 11111111. The first three octets are the network portion (all 1s in subnet mask). The last octet is the host portion (all 0s). So the network address is 192.168.1.0 and the host is device .10.

Benefits of subnetting

  • Improves routing efficiency — routers store routes to subnets rather than individual IPs.
  • Better management of IP address space across departments or locations.
  • Isolates network segments — limits broadcast traffic, improves security via ACLs.

Access Control Lists (ACLs)

A set of rules specifying which users or system processes are granted access to objects, and what operations are allowed. Each entry specifies a subject and an operation.

  • Objects: Resources such as files, directories, or devices requiring access control.
  • Subjects: Users, groups, or system processes attempting access.
  • Operations: Actions such as read, write, execute, or delete.

VLANs (Virtual Local Area Networks)

Enable segmentation of a physical network into multiple logical networks. Devices can be grouped together even if not connected to the same physical switch. Traffic is managed independently of physical location.

  • Group devices by function, department, or application — not physical location.
  • Sensitive data can be kept separate from other traffic — reduces risk of data breaches.
  • Inter-VLAN routing rules further enhance security by controlling which VLANs can communicate.
  • VLANs limit broadcast domains — reduces unnecessary broadcast traffic, improving performance.

CIDR — Classless Inter-Domain Routing

A method for specifying IP addresses and their associated routing prefix. Replaces the older class-based system (Classes A, B, C). Provides a compact and flexible way to define IP networks and their sizes.

  • Format: IP address + slash + prefix length. Example: 192.168.1.0/24
  • /24 means the first 24 bits are the network portion — corresponds to subnet mask 255.255.255.0 (which is 11111111.11111111.11111111.00000000 in binary).
  • 192.168.1.0/24 = IP address is the network, /24 indicates first 24 bits are network portion.
  • Subnet mask = the number after the slash (/) represents bits set to 1 in the subnet mask.
  • Flexibility (VLSM): CIDR allows variable-length subnet masking — more efficient IP address allocation, avoids wasting large address ranges.
Summary: