Networking
SASE vs SD-WAN: Choosing the Right Network Architecture
SD-WAN modernised the branch network; SASE converges networking and security in the cloud. How they relate, and how to plan the move.
Key takeaways
- Segment by function, sensitivity and trust level.
- Map application flows before enforcing rules.
- NAC ensures only known, compliant devices connect.
- Microsegmentation protects critical workloads in data centres and cloud.
Why segmentation matters
Ransomware and other attacks spread laterally after initial compromise. Segmentation restricts that movement, protects critical systems and reduces the scope of compliance requirements such as PCI DSS.
Segmentation layers
| Layer | Technique |
|---|---|
| Macro | VLANs, VRFs and firewalls between zones |
| User access | NAC with 802.1X and dynamic policy |
| Workload | Microsegmentation with host or hypervisor policy |
| Cloud | Security groups, network policies, private endpoints |
Designing zones
Common zones include users, servers, management, OT, guest, IoT, DMZ and payment environments. Management interfaces of network, storage and virtualization infrastructure deserve their own tightly controlled zone.
Network access control
NAC identifies devices as they connect, checks compliance and assigns them to the right segment — or quarantines them. Profiling helps handle printers, cameras and IoT devices that cannot authenticate with 802.1X.
Implementation approach
- Discover assets and map traffic flows.
- Design zones and policy.
- Deploy in monitor mode and refine.
- Enforce in phases, starting with high-value zones.
- Review rules regularly and remove unused ones.
Microsegmentation for data centres and cloud
Traditional firewalls control traffic between zones, but not between servers in the same zone. Microsegmentation applies policy at the workload level, so a compromised web server cannot reach a database it does not need. Policies are typically defined by labels such as application, environment and role rather than IP addresses, which keeps them manageable as workloads move.
Protecting management planes
Hypervisor consoles, storage controllers, backup servers and network device interfaces are high-value targets. Place them in a dedicated management network reachable only from hardened jump hosts or privileged access workstations, with MFA and session recording.
Common pitfalls
- Enforcing rules without understanding application dependencies
- "Temporary" any-any rules that never get removed
- IoT and OT devices left on user networks
- No owner for firewall rule reviews
Metrics
Track the number of flat segments remaining, the percentage of critical workloads under microsegmentation policy, NAC coverage of wired and wireless ports, and the age of firewall rules.
How NAZZTEC helps
We map traffic flows, design zones and policies, deploy NAC and microsegmentation, and tune enforcement in phases to protect critical systems without disrupting operations.
Next step: explore Networking & Connectivity Solutions.
Frequently asked questions
Is VLAN separation enough?
VLANs separate traffic, but without filtering between them they provide little security. Firewalls or ACLs must enforce policy.
Will segmentation break applications?
Not if flows are mapped and rules tested in monitor mode first.
Does segmentation help with compliance?
Yes — it reduces audit scope for PCI DSS and supports NCA and ISO network security controls.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
