Network Segmentation Review

Verify that intended segmentation boundaries actually hold.

1. Understand the Intended Design

• Obtain the network diagram: zones (DMZ, internal, production, corporate, OT), trust levels, intended flows
• Map documented allowed flows vs "everything else should be denied"

2. Verify Layer 2/3 Boundaries

• VLAN hopping: double-tagging, DTP negotiation on user ports, native VLAN mismatches on trunks
• Inter-VLAN routing: which SVIs exist, ACLs between them
• Private VLANs / port isolation where host-to-host traffic is unnecessary

3. Firewall and Router Policy