Design and Implement Network Segmentation

This skill is expert network architecture specializing in designing and implementing network segmentation strategies that apply defense-in-depth, zero-trust models, and compliance requirements. Its security zone design establishes clear trust boundaries (Internet, DMZ, Internal, Restricted, Management), defaults to deny with explicit allow rules, layers defense-in-depth across multiple technologies, applies microsegmentation at the application level beyond perimeter security, and maps segments to regulatory requirements like PCI DSS, HIPAA, and SOX. It covers four architecture patterns - hub-and-spoke centralized inspection, zero trust (never trust, always verify with identity-based access), software-defined perimeter with dynamic encrypted micro-tunnels, and east-west protection against lateral movement - and a concrete implementation sequence: network discovery via nmap scanning and service enumeration, VLAN segmentation (management, production/dev servers, workstations, guest, IoT, DMZ web/database, and a quarantine VLAN) with trunk port configuration, and firewall ACLs restricting production-to-database traffic, management access, and guest network isolation by explicit port and protocol.

Use this skill when designing or hardening network segmentation for a production environment that needs real trust-boundary enforcement, not a flat network with a single perimeter firewall. It covers advanced segmentation technologies for environments that need it: an OpenFlow SDN controller rule for microsegmentation and an Istio service mesh AuthorizationPolicy plus PeerAuthentication for zero-trust mTLS between services. It structures the rollout as a phased roadmap - Phase 1 discovery and planning (network mapping, asset inventory, risk assessment, compliance gap analysis, weeks 1-2), Phase 2 design and testing (pilot on non-critical systems, traffic analysis, weeks 3-4), Phase 3 production rollout (gradual deployment by criticality, monitoring, documentation, training, weeks 5-8). It is not meant for a rushed, all-at-once cutover - its own roadmap and best practices emphasize pilot testing and gradual, criticality-ordered rollout specifically to avoid breaking legitimate traffic.

### Istio service mesh for microsegmentation
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: database-access-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: database
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/web-service"]
  - to:
    - operation:
        ports: ["5432"]
        methods: ["GET", "POST"]
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: database-mtls
  namespace: production
spec:
  selector:
    matchLabels:
      app: database
  mtls:
    mode: STRICT

Given a network topology, the skill produces a discovery script inventorying live hosts and services, Cisco VLAN and trunk configuration, firewall ACLs scoped to specific source/destination subnets and ports, SDN flow rules for microsegmentation, service-mesh authorization policies like the one above for zero-trust east-west traffic, a phased implementation roadmap with weekly milestones, Netflow-based inter-segment traffic analysis commands, and a Python policy-compliance checker that flags traffic violating the declared segmentation rules.

Network and security architects designing or hardening segmentation for a production environment that needs compliance alignment (PCI DSS, HIPAA, SOX) and real zero-trust enforcement, not just a basic firewall perimeter. It suits teams that want the full stack covered - VLANs and ACLs for traditional segmentation, SDN and service mesh for microsegmentation, plus operational discipline (default-deny access control, change management approval, quarterly audits, automated incident isolation) and a realistic phased rollout that avoids breaking production traffic.