Back to Details

network-segmentation-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Network Segmentation Review

网络分段审查

Verify that intended segmentation boundaries actually hold.
验证预期的分段边界是否真正有效。

1. Understand the Intended Design

1. 了解预期设计

  • Obtain the network diagram: zones (DMZ, internal, production, corporate, OT), trust levels, intended flows
  • Map documented allowed flows vs "everything else should be denied"
  • 获取网络拓扑图：区域（DMZ、内部、生产、企业、OT）、信任级别、预期流量
  • 对照已记录的允许流量与“其他所有流量均应拒绝”原则

2. Verify Layer 2/3 Boundaries

2. 验证 Layer 2/3 边界

  • VLAN hopping: double-tagging, DTP negotiation on user ports, native VLAN mismatches on trunks
  • Inter-VLAN routing: which SVIs exist, ACLs between them
  • Private VLANs / port isolation where host-to-host traffic is unnecessary
  • VLAN hopping：双重标记、用户端口上的 DTP 协商、trunk 上的 native VLAN 不匹配
  • Inter-VLAN 路由：存在哪些 SVI，以及它们之间的 ACL
  • 在不需要主机间通信的场景中，检查 Private VLAN / 端口隔离

3. Firewall and Router Policy

3. 防火墙与路由器策略

  • Rulebase review: any-any rules, overly broad source/destination (any→internal), rules by IP instead of objects
  • Shadowed and unused rules; logging disabled on deny rules
  • Management access: SSH/admin planes reachable from user segments?
  • 规则库审查：any-any 规则、范围过宽的源/目标地址（任意→内部）、按 IP 而非对象定义的规则
  • 被遮蔽和未使用的规则；拒绝规则未启用日志记录
  • 管理访问：SSH/管理平面是否可从用户网段访问？

4. Cloud Boundaries

4. 云边界

  • Security groups: per-role groups, no 
    0.0.0.0/0
    ingress on non-web ports
  • NACLs vs SGs layering; peering/transit gateway route tables leaking broader CIDRs
  • Egress control: can compromised workload reach arbitrary internet (data exfil path)?
  • Security groups：按角色划分安全组，非 Web 端口不得允许 
    0.0.0.0/0
    入站访问
  • NACL 与 SG 的分层叠加；检查 peering/transit gateway 路由表是否暴露范围过宽的 CIDR
  • 出站控制：遭入侵的工作负载能否访问任意互联网资源（数据外泄路径）？

5. Active Validation (authorized testing)

5. 主动验证（经授权的测试）

  • From representative hosts in each zone, attempt connections across boundaries: allowed (should work), denied (should fail and log)
  • Test both directions and return traffic for stateful devices
  • Use 
    nmap -PN -sT -p <port>
    style targeted probes; record device logging the block
  • 从各区域中的代表性主机发起跨边界连接测试：允许的连接应成功，拒绝的连接应失败并产生日志
  • 对有状态设备，同时测试双向流量和返回流量
  • 使用 
    nmap -PN -sT -p <port>
    等方式进行定向探测；记录阻断事件及相关设备日志

Output

输出

A verified flow matrix (source zone × destination zone × port × expected × observed), gaps with device-level evidence, and remediation per boundary.
一份经过验证的流量矩阵（源区域 × 目标区域 × 端口 × 预期结果 × 实际结果）、包含设备级证据的差距清单，以及针对各边界的修复建议。