登录查看更多内容

What are the best TCP/IP network segmentation practices?

由人工智能和领英社区提供技术支持

Network segmentation is the practice of dividing a network into smaller subnetworks, or segments, based on different criteria, such as function, location, or security level. Network segmentation can improve the performance, security, and manageability of a network, especially when using the TCP/IP protocol suite. TCP/IP is the most widely used set of protocols for internet communication, and it consists of four layers: application, transport, internet, and network access. In this article, you will learn what are the best TCP/IP network segmentation practices and how they can benefit your network security.

此文章中的业界达人

由社区从 5 条内容中精选。了解更多

Vanderlei de Jesus Barcala

LinkedIn Top Voice | Especialista em Clouds, Ciberseguran?a, Dados, DevOps, Servi?os, Gerenciamento, ajudo empresas a…

1 Why segment a TCP/IP network?

One of the main reasons to segment a TCP/IP network is to reduce the size and scope of broadcast domains. A broadcast domain is a logical group of devices that can communicate with each other by sending broadcast messages, which are transmitted to all devices in the same domain. Broadcast messages can consume network bandwidth and cause network congestion, as well as expose sensitive information to potential attackers. By segmenting a network into smaller broadcast domains, you can limit the impact of broadcast traffic and increase the efficiency and availability of network resources.

Another reason to segment a TCP/IP network is to isolate different types of traffic and devices based on their security requirements and policies. For example, you may want to separate the traffic and devices that handle confidential data from those that handle public or less sensitive data. This way, you can apply different access control lists, firewall rules, encryption methods, and authentication mechanisms to each segment, and prevent unauthorized or malicious access to your network. Additionally, you can monitor and audit each segment more easily and detect any anomalies or intrusions.

添加您的观点

Vanderlei de Jesus Barcala

LinkedIn Top Voice | Especialista em Clouds, Ciberseguran?a, Dados, DevOps, Servi?os, Gerenciamento, ajudo empresas a impulsionar seus negócios digitalmente, tornando cada vez mais estratégicas.
举报内容
A segmenta??o de rede é uma abordagem de arquitetura que divide uma rede em vários segmentos ou sub-redes, cada um atuando como sua própria pequena rede. Essa prática oferece diversos benefícios, especialmente em termos de seguran?a e desempenho. Ao dividir a rede em segmentos, os administradores podem controlar o fluxo de tráfego entre essas sub-redes com base em políticas granulares. Isso permite otimizar o uso da rede e priorizar determinados tipos de comunica??o.

已翻译

赞
Nik Mitev

I help businesses improve their cyber security and efficiency. HaxHQ creator | full stack developer | security consultant
举报内容
Many years ago I was working for a company which had a large-ish call centre, approximately 200 users on desktops in a room. Once or twice a year we had a network card issue or other fault which caused a broadcast storm and brought the call centre down. It is not immediately obvious what the issue is, but we learned to recognise the practically solid rather than blinking lights on switch ports as the tell-tale sign. Implementing VLANs to separate the broadcast domains solved the problem. From a security perspective traffic should be segregated as well. This allows sensitive traffic to be kept away from the main network (e.g. console server access or similar). Regular users don't administer servers and switches :-)

已翻译

赞

2 How to segment a TCP/IP network?

There are different methods and devices that you can use to segment a TCP/IP network, depending on the layer of the TCP/IP protocol stack that you want to operate on. For example, routers, which operate on the internet layer, can segment a network into different IP subnetworks or subnets. Switches, which work on the network access layer, can segment a network into different collision domains. VLANs, which also work on the network access layer, can segment a network into different broadcast domains. And firewalls, which operate on either the transport layer or the application layer, can segment a network into different security zones. By using these methods and devices, you can create multiple segments within a larger network and control the routing of packets between them. This will help reduce collisions and increase the throughput and reliability of the network as well as protect it from external or internal threats.

添加您的观点

Vanderlei de Jesus Barcala

LinkedIn Top Voice | Especialista em Clouds, Ciberseguran?a, Dados, DevOps, Servi?os, Gerenciamento, ajudo empresas a impulsionar seus negócios digitalmente, tornando cada vez mais estratégicas.
举报内容
A segmenta??o de uma rede TCP/IP envolve dividir uma rede maior em sub-redes menores para melhor gerenciamento e eficiência. Antes de iniciar a segmenta??o, compreenda as necessidades da rede e determine quais sub-redes s?o necessárias.

已翻译

赞

3 What are the best practices for TCP/IP network segmentation?

To effectively and securely implement TCP/IP network segmentation, it’s important to follow best practices. This includes planning and designing your network segmentation strategy, considering the goals, needs, and resources of your organization. Identify criteria for segmenting your network, such as function, location, security level, performance, or compliance, then choose the appropriate methods and devices. Define the boundaries, scopes, and names of each network segment and document them clearly. Additionally, configure your network segmentation devices and methods correctly following standards and guidelines for each TCP/IP layer. Test and verify that your network segmentation works as intended and does not cause any connectivity or performance issues. Furthermore, monitor and maintain your network segmentation regularly using appropriate tools for each TCP/IP layer. Review and update your network segmentation devices and methods as needed based on changes or demands of your network.

添加您的观点

Vanderlei de Jesus Barcala

LinkedIn Top Voice | Especialista em Clouds, Ciberseguran?a, Dados, DevOps, Servi?os, Gerenciamento, ajudo empresas a impulsionar seus negócios digitalmente, tornando cada vez mais estratégicas.
举报内容
A segmenta??o lógica é feita na camada de transporte (geralmente usando o protocolo TCP). O TCP divide os dados recebidos da camada de aplica??o em blocos de tamanho adequado para envio, chamados de segmentos. Esses segmentos s?o ent?o colocados em datagramas IP para serem transmitidos pela rede.

已翻译

赞

4 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Vanderlei de Jesus Barcala

LinkedIn Top Voice | Especialista em Clouds, Ciberseguran?a, Dados, DevOps, Servi?os, Gerenciamento, ajudo empresas a impulsionar seus negócios digitalmente, tornando cada vez mais estratégicas.
举报内容
O tamanho máximo de um segmento é determinado pelo MTU (Maximum Transfer Unit), que é a dimens?o máxima do quadro na camada de enlace. O MTU varia dependendo da tecnologia de rede (por exemplo, Ethernet tem um MTU de 1500 bytes).

已翻译

赞

Network Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the best TCP/IP network segmentation practices?

1

2

3

4

1 Why segment a TCP/IP network?

2 How to segment a TCP/IP network?

3 What are the best practices for TCP/IP network segmentation?

4 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

更多Network Security相关文章

更多相关阅读内容

What are the best TCP/IP network segmentation practices?

1

2

3

4

1 Why segment a TCP/IP network?

2 How to segment a TCP/IP network?

3 What are the best practices for TCP/IP network segmentation?

4 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

查看其他技能