Network Perimeter Protection · Topic 3 of 6
Segmentation, Security Solutions, Router and Switch Security and Zero Trust
Learn how segmentation limits attacks, which security solutions guard a network, how to harden routers and switches, and how SDP applies zero trust.
- 5 min
- Segmentation contains attacks and reduces compliance scope.
- Port security, DHCP snooping, dynamic ARP inspection and BPDU guard are switch protections.
- Use SSH, SNMPv3 and AAA for device management, and disable unused ports and services.
What it is
Segmentation divides a network into smaller zones so that a problem in one zone cannot spread freely. Security solutions are the devices and services placed in and between the zones. Routers and switches are part of the defense and must be hardened too. Zero trust and the software defined perimeter (SDP) drop the idea that the inside network is safe.
The exam asks for the benefit of each technique, the right tool for a need, and the key idea of SDP.
How it works
Network segmentation
| Technique | How it divides | Security benefit |
|---|---|---|
| Physical separation | Separate hardware and cabling | Strongest isolation. An air gap has no connection at all. |
| Subnets and routing | Different IP ranges with ACLs between them | Controls traffic between groups |
| VLANs (802.1Q) | Logical groups on shared switches | Limits broadcasts and contains lateral movement |
| DMZ (screened subnet) | A buffer zone for public servers | Keeps internet facing servers away from the internal network |
| Microsegmentation | Rules per workload or host | Blocks east west movement inside a data center |
| Virtual routing (VRF) | Separate routing tables | Isolates tenants or functions |
Benefits are a smaller attack surface, containment of malware and attackers, easier monitoring, simpler compliance scope (for example a separate card data zone) and better performance. Traffic between segments passes a firewall or ACL, where it can be inspected.
Essential network security solutions
| Solution | Purpose |
|---|---|
| Firewall and next generation firewall | Filter traffic by rule |
| IDS / IPS | Detect and block attacks |
| Proxy and web filter | Control and inspect outbound web use |
| Web application firewall (WAF) | Protect web applications |
| VPN | Encrypted remote or site to site connectivity |
| Network access control (NAC) | Check device identity and health before allowing a connection |
| Unified threat management (UTM) | Several functions in one appliance |
| Data loss prevention (DLP) | Stops sensitive data from leaving |
| SIEM | Collects and correlates logs |
| Antimalware and EDR | Protect endpoints |
| Honeypot | A decoy that attracts and studies attackers |
| Vulnerability scanner | Finds weaknesses before attackers do |
Router and switch security
Routers and switches move all traffic, so their compromise is serious.
General device hardening
- Change default passwords and use strong, unique credentials.
- Use SSH, not Telnet, and restrict management access to a management network.
- Use AAA with TACACS+ or RADIUS and keep device logs on a central server.
- Disable unused services and interfaces.
- Keep firmware patched and back up configurations.
- Use SNMPv3 and avoid default community strings.
- Show a legal warning banner.
Router measures: access control lists, ingress and egress filtering, blocking spoofed source addresses, unicast reverse path forwarding, secured routing protocols with authentication, and disabling source routing.
Switch measures
| Threat | Countermeasure |
|---|---|
| MAC flooding | Port security limits MAC addresses per port |
| Rogue DHCP server | DHCP snooping trusts only chosen ports |
| ARP poisoning | Dynamic ARP inspection |
| IP spoofing | IP source guard |
| Rogue root bridge | BPDU guard and root guard (spanning tree protection) |
| VLAN hopping | Disable trunk negotiation, set the native VLAN to an unused one |
| Unused ports | Shut them down and place them in an unused VLAN |
Zero trust and the software defined perimeter
Zero trust means "never trust, always verify". No user or device is trusted because of its network location. Every request is authenticated, authorized and evaluated against policy. NIST SP 800-207 describes the logical parts: a policy engine and policy administrator that decide, and a policy enforcement point that allows or blocks.
A software defined perimeter (SDP) applies zero trust to network access. The protected resources are hidden, so they cannot be scanned.
| SDP component | Role |
|---|---|
| Initiating host | The client device that asks for access |
| SDP controller | Authenticates the user and device and decides the policy |
| Accepting host (gateway) | Receives connections only after the controller approves |
The flow is: the client authenticates to the controller first, the controller checks identity and device posture, and only then is the gateway told to accept a connection from that client. Before that, the services show nothing to an unauthorized scanner, which is sometimes described as a "dark" network. Single packet authorization is one method used to open the path.
A worked example
A retailer's point of sale terminals, office PCs and public web servers shared one flat network. After a malware infection on a PC reached the terminals, the team created separate VLANs, put the web servers in a DMZ and applied firewall rules between zones.
They also enabled port security and DHCP snooping on access switches, and moved remote administrators to an SDP gateway with MFA so the admin interfaces are no longer exposed to the internet.
How the exam asks about this
- "Which control stops a rogue DHCP server on a switch?" → DHCP snooping.
- "Which network zone holds internet facing servers separate from the internal network?" → The DMZ or screened subnet.
- "In an SDP, which component authenticates the client before the gateway accepts a connection?" → The SDP controller.
What to remember for the exam
- Segmentation contains attacks and reduces compliance scope.
- Port security, DHCP snooping, dynamic ARP inspection and BPDU guard are switch protections.
- Use SSH, SNMPv3 and AAA for device management, and disable unused ports and services.
- Zero trust verifies every request regardless of location.
- SDP has an initiating host, a controller and an accepting host.
VLANs separate traffic logically but they are not a security boundary by themselves. Traffic between VLANs must still pass an enforced ACL or firewall.
Common mistakes
Believing a firewall at the edge is enough. Without internal segments an attacker who gets in moves freely.
Leaving default settings on switches. Unused ports, default VLANs and negotiating trunks give easy footholds.
Reading zero trust as a product. It is a model that combines identity, device checks, segmentation and policy.
Check yourself
What is the main security benefit of microsegmentation?
It blocks lateral (east west) movement between workloads.
Which switch feature limits the number of MAC addresses on a port?
Port security.
What does an SDP do before a client can see a protected service?
It authenticates the user and device through the controller and only then lets the gateway accept the connection.
Topic 3 of 6 in Network Perimeter Protection
Test yourself on Network Perimeter Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.