How do you secure east-west traffic in a data center? What is microsegmentation?
Show the answer
Say this first
The perimeter firewall only sees north-south traffic. For east-west I layer two things: coarse segmentation, with VRFs or zones whose traffic must cross a firewall, and microsegmentation, which is per-workload policy written against labels or groups (application, tier, environment) instead of subnets, and enforced as close to the workload as possible: in the hypervisor, on the host or in the fabric. Default deny between groups, built from observed flows.
Go deeper
Enforcement points
| Where | Examples | Strength | Weakness |
|---|---|---|---|
| Firewall between VRFs or zones | Physical or virtual NGFW | Full inspection, IPS | Hairpin and throughput, coarse |
| Hypervisor | VMware NSX distributed firewall | Per VM at the vNIC, follows the VM | Virtual workloads only |
| Host | nftables, Windows Firewall, eBPF (Cilium), central manager | Works anywhere | Agents and policy management at scale |
| Fabric | Cisco ACI EPGs and contracts, group tags (SGT, VXLAN group policy) | Line rate in switch hardware | Vendor-specific |
| Cloud | Security groups | Native | One cloud at a time |
Rolling it out
- Get visibility: flow telemetry or host agents to map who talks to whom.
- Define groups by labels, such as app=payroll, tier=db, env=prod.
- Write allow rules between groups and run them in log-only mode.
- Enforce default deny one application at a time.
- Keep policy in version control with review.
They will ask next
Why labels and not IP addresses?
Workloads scale, move and get new addresses, especially containers. A label follows the workload, so the rule stays correct without edits.
Traps
- Calling VLANs segmentation when traffic between them is routed with no policy point.
How did you do?