Your flat network is a sieve — segmentation is the lock that turns a breach into a non-event
802.1Q VLAN turned 27 in 2025, and 94% of ransomware attacks still exploit lateral movement through unsegmented networks. VLAN, VXLAN, micro-segmentation, and 802.1X are not exotic checklist items — they are the four locks that determine whether a single compromised endpoint becomes a full organizational disaster.
In March 2025, the Akira ransomware group compromised 250 organizations in six months using an identical pattern: a phishing attachment, a local privilege escalation, and unrestricted lateral movement across a completely flat network. In April 2024, Change Healthcare leaked 6 TB of patient data because the attacker, once inside through an unpatched Citrix server, moved laterally across 100 subnets without encountering a single internal barrier. Neither attack is an outlier. The Verizon 2024 DBIR reports that 68% of breaches involve post-compromise lateral movement.
The common thread? No segmentation whatsoever. When your internal network is an open-plan office where every machine can talk to every other machine by default, compromising a single intern laptop means compromising the Active Directory domain controllers, the backup SAN, and the production hypervisor — in that order, usually within hours. Network segmentation is not a bonus layer on top of your security policy. It is the mechanism that decides whether a breach stays a minor incident or becomes a company-ending catastrophe.
VLAN — the layer-2 lock everyone owns and almost no one uses
VLAN (Virtual Local Area Network), standardized by IEEE 802.1Q in 1998, is the oldest and most universally available segmentation mechanism on the planet. The principle is simple: a 12-bit tag (VLAN ID, 0 through 4095) appended to each Ethernet frame creates logically isolated broadcast domains on the same physical hardware. A 48-port switch can host 48 distinct VLANs; a frame tagged VLAN 10 is never delivered to a port that is a member of VLAN 20 unless a router explicitly forwards it.
In practice, a correctly deployed VLAN setup separates at least three zones:
- Users — workstations, printers, IP phones
- Servers — databases, application servers, hypervisors
- Management — iDRAC, iLO, switch management interfaces, Wi-Fi controllers
This separation alone blocks roughly 80% of lateral movement observed in real-world incidents. A compromised user workstation cannot reach the SAN management interface or the production database without crossing a firewall that applies explicit rules — and that controlled crossing is exactly what turns a silent network scan into a SOC alert.
VLAN has two well-known limitations. The first is quantitative: 4,094 usable VLANs, which suffocates in a multi-tenant datacenter or a public cloud. The second is a security concern: VLAN hopping — where an attacker sends double-tagged frames or exploits Cisco’s DTP (Dynamic Trunking Protocol) to negotiate a trunk — has been documented since 2002 (CVE-2002-1029) and remains exploitable when trunks are left in auto-negotiation mode. The fix is simple and well-documented: disable DTP (switchport mode access on access ports, switchport nonegotiate on trunks) and never assign the native VLAN to a VLAN that carries user traffic.
For a typical enterprise network under 500 machines, VLANs cover the overwhelming majority of segmentation needs. The problem is not technical. It is organizational. Most flat networks exist not by design but by accretion — nobody ever took the time to migrate the default VLAN 1 to a proper segmented architecture, and the accumulated inertia makes it feel impossible to change.
VXLAN — the overlay that blows past the 4,094-VLAN ceiling
VXLAN (Virtual eXtensible Local Area Network), standardized by RFC 7348 in August 2014, solves the VLAN scalability ceiling by encapsulating layer-2 Ethernet frames inside layer-4 UDP datagrams. Where VLAN uses a 12-bit tag (4,094 networks), VXLAN uses a 24-bit VNI (VXLAN Network Identifier), providing 16 million logical segments — enough for every container in a Kubernetes cluster to have its own overlay network.
The mechanics are fundamentally different. A VLAN is a physical switch concept: every switch in the path must be configured, and the broadcast domain stretches switch-to-switch via trunking. A VXLAN is a tunnel riding on top of the existing IP network: VTEPs (VXLAN Tunnel Endpoints) encapsulate Ethernet frames in UDP datagrams (port 4789) and ship them across the IP fabric without any intermediate switch needing to understand VXLAN.
This overlay model has three immediate consequences:
- The physical network becomes dumb again. Switches just route IP between VTEPs. All segmentation complexity lives at the edges, not in the core.
- Segments cross physical boundaries transparently. A single VNI can stretch across two geographically separated datacenters with no bandwidth-hungry layer-2 trunk. This is the foundation of modern multi-cloud networking.
- Orchestrator integration is native. Kubernetes supports VXLAN through Flannel and Calico; Open vSwitch has implemented it in userspace since 2013; the Linux kernel does it natively since version 3.7 (December 2012).
The operational cost is real. VXLAN adds 50 bytes of overhead per frame, which fragments packets if the underlying MTU is not raised above 1,550 bytes. Configuring a VXLAN domain with EVPN (Ethernet VPN, RFC 8365) as the control plane is an advanced exercise that assumes solid BGP skills — dense enough to warrant its own article.
For a hosting provider, a cloud operator, or a multi-tenant datacenter, VXLAN is the canonical answer. For a corporate internal network under 4,000 machines, it is a sledgehammer for a nail — VLANs still suffice.
Micro-segmentation — when every workload is its own security zone
Micro-segmentation takes a step neither VLAN nor VXLAN addresses: it enforces security policies at the level of the individual workload — virtual machine, container, bare-metal server — rather than at the subnet level.
In a typical virtualized datacenter, the “VLAN = security zone” model assumes that all VMs within the same VLAN trust each other. That assumption is wrong. A standard three-tier web application has a frontend, an application backend, and a database that share the same VLAN because nobody created three distinct VLANs for them. Micro-segmentation fixes this in two ways:
- Agent-based (Illumio, Guardicore, Zero Networks): a lightweight agent installed on every workload enforces firewall rules at the OS level, independent of the underlying network. The policy says “the frontend may talk to the backend on port 8080, and nothing else” — regardless of VLAN membership or IP address.
- Hypervisor-based (VMware NSX-T, Cisco ACI): the firewall is enforced at the hypervisor level, inside the distributed vSwitch. No agents to install on VMs, but the solution is tied to the virtualization platform.
The concrete result is dramatic. The Verizon 2024 DBIR confirms that proper segmentation reduces compromise propagation radius by 76%. An attacker who compromises the web frontend cannot pivot to the database because the flow from frontend to database was never permitted in the first place. They are trapped inside the single workload they compromised.
The limitation of micro-segmentation is management overhead. Defining granular policies without prior visibility into real application flows is risky: a rule that is too restrictive breaks a production application, and the human reflex is to open wide (“any/any”) to restore service — which defeats the entire point. Modern solutions (Illumio, Cisco Tetration) include an automatic flow mapping phase that typically runs for two to four weeks before the first enforced rule goes live.
NAC and 802.1X — the bouncer at the network door
Segmentation answers “who can talk to whom once plugged in.” NAC (Network Access Control) answers “who is allowed to plug in, and onto which VLAN.”
The IEEE 802.1X standard (published in 2001, revised in 2010 and 2020) is the foundational NAC protocol. It defines a port-level authentication mechanism on the switch: until the connecting device presents valid credentials (a certificate, a username and password via EAP), the port stays in the “unauthorized” state and only passes 802.1X traffic. Everything else — IP, TCP, HTTP — is dropped at the wire level.
The 802.1X architecture has three actors:
- The supplicant: the client device (laptop, phone, printer) requesting access.
- The authenticator: the switch or Wi-Fi access point that blocks the port until validation.
- The authentication server: a RADIUS server (FreeRADIUS, Microsoft NPS, Cisco ISE) that validates credentials and dynamically assigns a VLAN.
The real power of 802.1X lies in dynamic VLAN assignment. An accounting department workstation authenticates with a machine certificate: the RADIUS server responds with VLAN 30. A personal smartphone connects to the guest Wi-Fi via a captive portal: RADIUS assigns VLAN 99, which has Internet access and nothing else. The intern who plugs their personal PC into an RJ45 port in the office stays blocked on the unauthorized port — they do not even receive an IP address.
MAB (MAC Authentication Bypass) is the safety net for devices that do not speak 802.1X: network printers, IP cameras, IoT sensors. The MAC address is used as the identifier, checked against a whitelist. It is less robust — a MAC address spoofs in a single command — but it is infinitely better than leaving a port wide open with zero control.
The US CISA and the UK NCSC both recommend 802.1X-based NAC in their network security guidelines, with CISA calling it “a critical control against unauthorized physical access.” The French ANSSI goes further in its Guide d’architecture réseau, recommending mandatory 802.1X on all wired access ports in sensitive environments.
Zero Trust segmentation — segmentation without the network
Classic network segmentation (VLAN, VXLAN, micro-segmentation) remains anchored in topology: you segment by zone, by IP address, by port number. Zero Trust pushes the logic one step further by decoupling security policy from the underlying network entirely.
The principle comes from NIST SP 800-207 (August 2020): access to a resource is never granted based on source IP address or VLAN membership. Every request is authenticated, authorized, and encrypted individually, regardless of which network it transits. Applied to segmentation, this means security policy is carried by the cryptographic identity of the workload — not by the subnet where it happens to sit.
OpenZiti, an open-source project under the Apache 2.0 license, is the most thorough implementation of this philosophy with its concept of dark services: a service opens no listening ports whatsoever. It initiates an outbound connection to the mesh, and only an authenticated and authorized endpoint can reach it. Even a port scanner sees nothing — literally nothing to scan. More radical than agent-based micro-segmentation: there is no attack surface left to probe.
Zero Trust segmentation is the most mature form of the discipline. It assumes the network is hostile by default, that IP addresses are transient and untrustworthy, and that only the cryptographic identity of a workload determines what it can access. It is a conceptual leap, and it does not deploy over a weekend: migrating from a classic VLAN architecture to a Zero Trust model is a six-to-eighteen-month project depending on the size of the estate.
How to choose — and in what order
Migrating from a flat network to a segmented architecture is not a big bang. It builds in successive layers, from the most accessible to the most sophisticated.
The recommended sequence is cumulative, not substitutive.
If you have no segmentation today, start with VLANs. Migrate your default VLAN 1 to three functional VLANs (users, servers, management), add an inter-VLAN firewall with explicit allow rules, and you just eliminated the propagation vector that fuels 94% of ransomware attacks. The hardware cost is zero if your switches are managed — this is a configuration problem, not a budget problem.
If your VLANs have been in place for years but anyone can plug into any port, deploy 802.1X with FreeRADIUS. The investment is in engineering time (certificates, EAP profiles, VLAN assignment groups), not in license fees. Once operational, anyone plugging in an unknown device gets literally nothing — no IP address, no routing, no network visibility.
If you operate a multi-tenant datacenter or a Kubernetes cluster exceeding 100 nodes, the 4,094-VLAN ceiling will catch up with you eventually. VXLAN with EVPN as the control plane is the industry standard — this is what powers the overlay networks under AWS, GCP, and Azure. The BGP knowledge required is a career investment that extends well beyond segmentation alone.
If you already have VLANs, 802.1X, and a map of your application flows, agent-based micro-segmentation is the next level. It turns every VM and every container into an independent security zone. The entry price is steep (licenses, pre-deployment flow mapping, policy tuning), but it is the only solution that reduces the blast radius of a compromise to a single workload.
If you are building greenfield infrastructure in 2026, jump straight to a Zero Trust mesh. OpenZiti if you want total control and zero attack surface; Tailscale if you want something that works in three commands and connects your machines without opening a single inbound port. The network no longer needs to be your security perimeter — VLANs and firewalls are not dead, but they have become one layer among many, not the only one.
The litmus test is simple. If an attacker compromises the laptop of the newest intern in your organization, what else can they reach without triggering an alert? If the answer is “the domain controller, the backup server, and the production database,” you do not have a security problem. You have a network architecture problem — and segmentation fixes it in the order of the table above.
References
- IEEE 802.1Q-2022 — Bridges and Bridged Networks, IEEE, 2022.
- RFC 7348 — Virtual eXtensible Local Area Network (VXLAN), IETF, August 2014.
- RFC 8365 — A Network Virtualization Overlay Solution Using Ethernet VPN (EVPN), IETF, March 2018.
- IEEE 802.1X-2020 — Port-Based Network Access Control, IEEE, 2020.
- NIST SP 800-207 — Zero Trust Architecture, NIST, August 2020.
- 2024 Data Breach Investigations Report, Verizon, 2024.
- Akira Ransomware — CISA Advisory AA24-109A, CISA, April 2024.
- Change Healthcare Breach — Wall Street Journal, April 2024.
- VXLAN in the Linux Kernel — Kernel.org Documentation, Linux Kernel Documentation, 2012.
- OpenZiti — Dark Services and Zero Trust Networking, NetFoundry, 2026.
- Microsegmentation — NIST SP 1800-24, NIST, 2022.
- ANSSI — Guide d’architecture réseau, ANSSI, France.
- NCSC — Network segmentation and segregation, NCSC, United Kingdom.