Micro Segmentation Application#

Micro segmentation is a network security capability intended to prevent lateral movement of security threats. It divides networks into smaller, isolated zones (known as micro segments) and establishes rules to restrict traffic between them. An example of a micro segment defined within an enterprise network is a set of homogeneous devices such as DNS servers, printers, client applications, or server applications.

The use of micro segmentation policies offers various benefits over traditional ACLs or IP filters:

• Abstraction of micro segments independent of networking concepts (IP addressing, VLANs etc).
• Flexible network designs and IP addressing schemes.
• Update the micro segment a host belongs to, without changing the security policy.

To start using micro segmentation policies:

1. create GroupTags to define the micro segments
2. create a GroupTagAssociationPolicy to associate the group tags with interfaces or routes.
3. create a MicroSegmentationPolicy referencing the group tags as source and/or destination

The application provides the following components: