Network segmentation at work: VLANs, guests and IoT

In most offices we audit, computers, servers, printers, cameras, IP phones, guest Wi-Fi and the management of the network equipment itself all share a single segment. It’s what’s known as a flat network: it works, it’s easy to maintain, and it’s also the architecture that makes it easiest for a security incident to spread.

Segmenting means dividing the network into zones by each device’s role and trust level, and controlling what traffic can flow between them. This guide describes how to approach it on a business network: which segments to define, how to filter between them, the cases of guests, IoT and management, and the mistakes we come across most often.

1. Why a flat network is a risk

On a flat network, every device has layer 2 and layer 3 visibility of all the others. If one is compromised, whether a laptop with malware, a camera with vulnerable firmware or a visitor’s device, it can discover and attack servers, backups and user devices directly. Lateral movement meets no barrier.

There are operational consequences too: a single broadcast domain amplifies the impact of a loop or a faulty device, traffic can’t be prioritised by type, and any network problem hits the whole organisation at once. Segmentation is also a common requirement in security audits and in the cybersecurity regulations that apply to businesses.

2. Device inventory and classification

You can’t segment what you don’t know about. The starting point is an inventory of everything connected: user devices, servers and storage, printers, telephony, cameras and recorders, access control, HVAC, meeting rooms, access points and network equipment. For each type of device, work out which other systems it really needs to talk to and whether it needs internet access.

How to get it: the switches’ ARP and MAC address tables, the DHCP server’s leases and a network scan give you an initial inventory. Analysing flows on the firewall for a few days reveals the real dependencies between systems, which often differ from the documented ones.

3. Segment design

The number of segments should reflect different trust levels and communication requirements, not the org chart. A typical starting point for an office is:

• Corporate users: devices managed by the organisation, wired and wireless.
• Servers: internal services, storage and backups, ideally the backups on a segment of their own.
• Voice: IP telephony, with QoS.
• Printing: printers and multifunction devices.
• IoT and physical security: cameras, recorders, access control, HVAC and meeting room equipment.
• Guests: visitors and personal devices, with no access to internal resources.
• Management: admin interfaces for network equipment and systems.

Each segment is implemented as a VLAN with its own subnet and its own DHCP scope. Define a consistent addressing plan (for example, with the VLAN ID reflected in the subnet) and reserve ranges for growth.

4. Policies between segments

Creating VLANs without filtering traffic between them adds no security: if the core switch routes freely between all subnets, the network is still flat in practice. Segmentation’s value is in the policies. Inter-VLAN routing should happen at a point that can enforce rules, usually the firewall, or on a layer 3 switch with access control lists when internal traffic volume requires it.

Rule of thumb: deny by default and allow only the flows you need, defined by source, destination and service. For example: users to servers on the ports of the applications they use; users to printing on the print ports; IoT with no access to any internal segment except its recorder or controller. Logging denied flows helps spot both configuration errors and unusual behaviour.

5. Guest network

The guest segment should be treated as an external network that shares physical infrastructure. The minimum requirements are a dedicated VLAN with direct internet access and no routes to internal networks, client isolation on the access points so visitors’ devices can’t see each other, bandwidth limits so it doesn’t compete with corporate traffic, and short DHCP leases.

Verification: from a device on the guest network, check that no address on the internal segments responds, including the firewall and switch management interfaces, and that no other clients on the same network can be discovered. A captive portal with terms acceptance or temporary credentials adds control and traceability.

6. IoT, CCTV and unmanaged devices

Cameras, recorders, access controllers, displays and HVAC systems share a risk profile: firmware that rarely gets updated, default credentials, unnecessary services exposed and, often, communication with the vendor’s cloud. They can’t be protected with the same controls as a user device, so network containment is the main measure available.

Rule of thumb: put these devices on a segment of their own, or several if their roles justify it; allow communication only with their recorder, controller or management platform; restrict internet access to the vendor destinations that are essential, or block it; and give viewing access from the user segment only through the services needed.

7. Management network for network equipment

Admin interfaces for the firewall, switches, access points, UPS and servers shouldn’t be reachable from the user segment, and never from guests or IoT. It’s common to find all equipment management on the same VLAN as users, often the default VLAN 1, with unencrypted web access and shared credentials.

Rule of thumb: a dedicated management VLAN, reachable only from admin workstations or over VPN, with encrypted protocols (HTTPS, SSH), individual authentication for each administrator and access logging. Disable management services on interfaces that don’t need them.

8. Dynamic assignment with 802.1X

With static assignment, the VLAN depends on the socket the device is plugged into: anyone who plugs a device into a user socket gets on the corporate network. 802.1X authentication against a RADIUS server assigns the VLAN based on the user’s or device’s identity, wired and wireless, and denies or quarantines whatever can’t identify itself.

For devices that can’t do 802.1X, such as printers or cameras, MAC address authentication (MAB) is used with restricted profiles, bearing in mind it’s a weaker control. A gradual rollout, starting in monitor mode, avoids disruption while the inventory is completed.

9. Common mistakes and migration plan

• Free routing at the core: VLANs created but routed without filtering on a layer 3 switch.
• VLAN 1 in use: as the user, management or native VLAN on trunks.
• Permissive trunks: links carrying every VLAN to switches or access points that don’t need them.
• Forgotten dependencies: DNS, DHCP, authentication or licensing that stop working when the policies are applied.
• Temporary “any-any” rules that become permanent.
• Lack of documentation: VLAN plan, addressing and flow matrix not kept up to date.

Migrating from a flat network to a segmented one can be done without downtime if it’s planned in phases: define the design and flow matrix, create the VLANs and policies in log-only mode, migrate the lowest-risk segments first (guests and IoT are usually the simplest and give the most immediate benefit), analyse the denied flows and, finally, enforce the policies strictly.

When specialist help is needed

Segmenting a production network affects every system in the organisation and requires knowing their dependencies. In our network security projects we carry out the inventory and flow analysis, design the segments and policy matrix, and run the migration in phases without interrupting service.

When segmentation is part of a wider upgrade, we approach it through the network architecture, including the addressing plan, the management network and integration with the corporate Wi-Fi and 802.1X authentication.

For a first view of the overall state of your infrastructure, you can use our network self-assessment: twelve checks we review at the start of any audit.