- For many years servers and you know,
different entities in the network
were assigned subnets and VLANs.
And, you know, they were pretty simple,
but they tried to provide
some capabilities of segmentation.
However, they also introduced a lot
of complexities because application segmentation
and policies were physically restricted
to the boundaries of that VLAN,
and specifically the boundaries of a data center
or even in a campus environment.
So in virtual environments, the problem became harder,
because nowadays applications gotta move between servers,
it can move between data centers,
and even between different cloud environments.
So traditional segmentation based
on VLANs will limit you to maintain the policies
of which applications need to talk to, you know,
each other, or who can access those applications.
Right? So this is ineffective because
most traffic in data centers nowadays,
or integrating cloud environments
is east to west traffic.
And a lot of traffic doesn't even leave the physical server
and doesn't even hit a traditional firewall.
But I mentioned, you know, east to west traffic,
and there's another concept called north to south traffic.
So let me define that for you to actually
get an idea, right?
So east to west traffic is network traffic
between servers and it can be between virtual servers
or physical servers, or even containers.
Now, north to south traffic
is the network traffic flowing in and out
of the data center.
Now, many vendors actually have created solutions where
policies are applied to applications
and are independent from the location
or the network that the application reside.
For example, let's suppose that you have
different applications running in separate VMs.
And those applications also need to talk to a database,
as I'm actually showing here, you can actually
need to apply policies to restrict, you know,
different applications.
Let's say application A, if they don't need to actually talk
to application B, you actually can provide some type
of policies, you know, to do this.
And these policies should not be bound to a VLAN or
to an IP subnet of the application.
And especially nowadays that, you know, these VLANs
and subnets are actually dynamically being assigned, right?
So also network traffic should not make multiple trips back
and forth between the applications and, you know
some centralized firewall to be able to actually
enforce policy between them,
and especially because of scalability.
And then to put matters worse, containers
make this a little bit harder because
they move and change more often, right?
So here I'm actually showing a high level representation
of an application running inside
of a container, for example a Docker container.
And in this case, we have to have the ability to
enforce network segmentation in those environment.
And that's what we call, in the industry,
micro-segmentation.
And micro-segmentation is at the VM level,
or at the container level, right?
Basically between containers regardless
of a VLAN or a subnet.
Another thing is micro-segmentation solutions
need to be application-aware.
And that means that the segmentation process starts
and ends with the application itself.
So most micro-segmentation environments apply
a concept called the Zero Trust model.
And this model dictates that users cannot talk
to applications and applications cannot talk
to other applications,
unless there's a defined set of policies
that actually permit them to do so.