CISSP Secure Network Architecture: Segmentation, IPv6, and Wireless

Introduction

Secure network architecture combines segmentation, protocol protection, and visibility across trust boundaries. This CISSP lesson covers task 4.1 of Domain 4, Communication and Network Security (13% of the exam, ISC2 exam outline effective 15 April 2024): apply secure design principles in network architecture. The outline includes traffic flows, network planes, forwarding, and performance measures such as bandwidth, throughput, latency, jitter, and signal quality.

Every other control in this domain depends on the architecture. A firewall rule set cannot rescue a flat network where a compromised printer can reach the payroll database. The exam rewards candidates who think in terms of layers, segmentation, trust boundaries, and failure behavior, and who can reason about where a given attack or defense lives in the OSI or TCP/IP model.

Learning objectives

After this lesson you can:

1. Map protocols, devices, and attacks to the OSI and TCP/IP layers and explain encapsulation.
2. Compare IPv4 and IPv6 from a security viewpoint, including addressing, NAT, and IPsec.
3. Select secure protocols to replace insecure ones and explain converged protocols such as FCoE, iSCSI, MPLS, and VoIP.
4. Design segmentation with VLANs, VRFs, VPNs, micro-segmentation, and VPC isolation.
5. Describe wireless, cellular, CDN, and software-defined network (SDN) security considerations, including the data, control, and management planes.
6. Explain north-south versus east-west traffic and why east-west visibility matters.
7. Interpret bandwidth, throughput, latency, jitter, and signal quality, and relate them to capacity and fault management.

1. Network models and encapsulation

1.1 The OSI model

The OSI model has seven layers. The exam expects you to place technologies and attacks at the right layer.

A mnemonic from the top: All People Seem To Need Data Processing. From the bottom: Please Do Not Throw Sausage Pizza Away.

1.2 The TCP/IP model

TCP/IP groups the layers into four: Application (OSI 5-7), Transport (4), Internet (3), and Link (1-2). Real networks follow TCP/IP; the OSI model is the common vocabulary.

1.3 Encapsulation and layering effects

When an application sends data, each layer adds a header (and the link layer a trailer): data becomes a segment, then a packet, then a frame, then bits. The receiver reverses the process (decapsulation). Security consequences:

• Layering hides detail. Basic routing uses IP headers; integrated firewalls or inspection features can also examine higher layers. A layer 7 proxy interprets application traffic. Controls must sit at the layer where the information they need is visible.
• Encapsulation enables tunneling. A tunnel (IPsec, GRE, VXLAN, or an attacker's DNS tunnel) wraps one protocol inside another. This is useful for VPNs and also a way to smuggle data past controls that inspect only the outer header.
• Encryption at one layer hides inner layers from inspection. TLS hides URLs and payloads from a network IDS; IPsec in tunnel mode hides the inner IP header. Inspection requires a decryption point (TLS inspection proxy) with its own privacy and key-management cost.
• Lower-layer compromise can disrupt or redirect higher-layer traffic. If ARP spoofing at layer 2 lets an attacker become the default gateway, a perfectly written application is still exposed unless it uses TLS.

1.4 Protocol quick reference

2. IPv4 and IPv6

Security points:

• NAT is not a security control. Hiding private addresses may complicate scanning, but security comes from stateful filtering. IPv6 networks are protected by the same firewall policy, not by obscurity.
• Dual stack risk. Many hosts have IPv6 enabled by default even when the organization only manages IPv4. Attackers use IPv6 paths that nobody filters or monitors. Inventory, filter, and monitor IPv6 explicitly. Disable only unneeded mechanisms where supported after dependency testing; Microsoft advises against disabling the Windows IPv6 stack.
• NDP attacks. Rogue router advertisements and neighbor spoofing are the IPv6 equivalents of rogue DHCP and ARP spoofing. Mitigations: RA Guard, DHCPv6 Guard, and SEND (Secure Neighbor Discovery) where supported.
• Tunneling transition mechanisms (6to4, Teredo) can bypass perimeter controls and should be blocked unless required.
• Scanning is harder in IPv6 because of the large address space, but DNS, logs, and predictable addressing still leak targets.

3. Secure protocols and converged protocols

3.1 Replace clear-text protocols

Remember the difference: DNSSEC authenticates answers (it does not encrypt them); DoT and DoH encrypt the channel between client and resolver.

3.2 Converged protocols

Converged protocols carry specialized traffic (storage, voice, video) over standard IP or Ethernet networks. They save cost and cabling but expand the attack surface because sensitive traffic now shares infrastructure.

The exam pattern: "A company moves storage traffic onto the shared data network. What is the most important design control?" The answer is segmentation and isolation of the storage traffic, plus authentication and encryption where traffic crosses untrusted segments.

4. Segmentation and isolation

Segmentation limits the blast radius of a compromise and lets you apply different policies to different trust levels.

4.1 Physical isolation and logical segmentation

• Physical isolation (air gap): no network path at all. Used for the highest-sensitivity systems such as classified networks or industrial safety systems. Data still moves via removable media, which becomes the main risk (Stuxnet-style attacks).
• VLAN (802.1Q): a layer 2 broadcast domain defined by tags on one physical switch fabric. Traffic between VLANs must pass through a layer 3 device where filters apply. Risks: VLAN hopping by switch spoofing (a port negotiating a trunk with DTP) and double tagging (an attacker stacks two 802.1Q tags to reach another VLAN). Mitigate by disabling auto-trunking, setting access ports explicitly, not using VLAN 1 as the native VLAN, and pruning unused VLANs.
• VRF (Virtual Routing and Forwarding): multiple isolated routing tables on a single router, so overlapping address ranges and separate tenants can coexist.
• VPN: a private logical network over shared infrastructure. IPsec or TLS VPNs can provide encrypted tunnels; a provider MPLS VPN does not inherently encrypt customer traffic.
• Private VLANs and port isolation: appropriately configured port policies can limit direct peer communication within a subnet; exact isolated/community behavior depends on the selected mode. Useful for hosting providers and guest networks.

4.2 Micro-segmentation

Micro-segmentation applies policy at the level of the individual workload or application tier, usually enforced in the hypervisor, in the host firewall, or by a software-defined fabric. Instead of "the finance VLAN can talk to the database VLAN", you say "the payroll web tier can reach TCP 5432 on the payroll database, and nothing else can".

Benefits: it limits lateral movement when correctly enforced, supports zero trust, and can follow workloads through supported orchestration. Challenges: policy sprawl, need for accurate application dependency mapping, and operational ownership.

4.3 North-south versus east-west traffic

• North-south traffic crosses the boundary of the data center or network (users to servers, servers to the internet). Perimeter firewalls, WAFs, and load balancers see it.
• East-west traffic moves between systems inside the network (web tier to application tier to database, service to service). Its volume varies by environment. It may bypass perimeter inspection, depending on routing and sensor placement.

Attackers who gain a foothold move east-west. If the only inspection is at the perimeter, lateral movement is invisible. This is why micro-segmentation, host-based firewalls, flow logging, and internal sensors matter.

4.4 Edge connectivity and peering

The network edge is where your network meets others: internet service providers, partners, cloud on-ramps. Design points: redundant providers, BGP route filtering and suitable origin-validation controls (to reduce route-leak and hijack risk), DDoS scrubbing, and dedicated private links (for example cloud direct-connect services) for sensitive hybrid traffic. Peering exchanges traffic directly with another network; agree on who may announce which prefixes, and filter everything else.

4.5 Virtual Private Cloud (VPC) isolation

In cloud environments, a VPC (or VNet) is a logically isolated virtual network. Terminology and rule semantics vary by provider. The following example uses AWS VPC building blocks:

• Subnets: in AWS, a public subnet has a route to an internet gateway; internet reachability also depends on addressing and controls. A private subnet has no direct internet-gateway route, but other routes or exposure mechanisms still require assessment.
• Security groups: stateful, instance-level allow rules.
• Network ACLs: stateless, subnet-level allow and deny rules.
• Route tables select paths. NAT gateways commonly enable outbound internet connectivity; they do not make that path private. Supported private endpoints provide private service connectivity.
• VPC peering and transit gateways connect VPCs; remember that peering is usually non-transitive and that connecting VPCs also connects their risks.

Cloud shared responsibility applies: the provider secures the underlying fabric, the customer configures the VPC rules.

5. Wireless, cellular, and content delivery networks

5.1 Wireless (Wi-Fi)

Design recommendations:

• Use WPA2/WPA3-Enterprise with 802.1X, preferably EAP-TLS where certificate lifecycle support permits. Validate the authentication server certificate and expected name; PEAP without proper server validation can expose users to rogue servers.
• Separate guest, corporate, and IoT SSIDs on different VLANs.
• Detect rogue access points and evil twins with wireless intrusion prevention (WIPS) and site surveys.
• Disable WPS (PIN brute force).
• Place access points so signal does not extend far beyond the building, and use appropriate power levels.

5.2 Cellular (4G, 5G)

Cellular networks add concerns around SIM swapping, IMSI catchers (fake base stations), and network slicing and core-network interfaces in 5G. For private 5G or IoT over cellular, use private APNs, mutual authentication, and device identity management. Treat the carrier network as untrusted for data content: encrypt with TLS or VPN.

5.3 Content distribution networks (CDNs)

A CDN caches content on edge servers close to users. Security benefits: absorbing DDoS traffic, WAF at the edge, TLS termination, and hiding origin addresses. Risks: the CDN becomes a trusted third party that sees decrypted traffic; misconfigured caching can expose private content; an exposed origin IP lets attackers bypass the CDN. Controls: restrict origin reachability and authenticate requests from the intended CDN configuration, set correct cache-control headers for private data, and review the CDN provider's security attestations.

6. Software-defined networking and network planes

Networks operate through three planes:

In traditional devices all three live on each box. In software-defined networking (SDN) the control plane is centralized in a controller that programs the data plane through southbound APIs (OpenFlow, NETCONF), while applications use northbound APIs. Centralization is logical; resilient deployments may distribute controllers physically.

Security implications:

• The controller is a high-value target. Compromising it may change policy throughout its managed domain. Protect it with strong authentication, role-based access, hardened hosts, redundant controllers, and encrypted, authenticated channels to switches.
• Management plane isolation: use a dedicated out-of-band management network, MFA, TACACS+/RADIUS authorization, and logging of every change.
• Control plane protection: authenticate routing protocols, filter BGP, and rate-limit control traffic to resist route injection and floods.
• Data plane protection: ACLs, uRPF (unicast reverse path forwarding) against spoofing, and rate limiting.
• SDN improves consistency (policy as code, automated change, central visibility) but a single bad push can break or expose everything, so use review, testing, and rollback.

6.1 Forwarding methods and topologies

Packets can be forwarded as unicast (one to one), multicast (one to a group), broadcast (one to all in a domain), or anycast (routing chooses among nodes sharing an address, commonly for DNS and CDNs; the selected node need not be geographically closest). Broadcast storms are mitigated by limiting broadcast domains and by loop prevention (spanning tree); IGMP snooping can constrain IPv4 multicast flooding; IPv6 uses MLD mechanisms.

Common topologies: star (most LANs; central switch is a single point of failure), mesh (resilient, costly), ring (token ring, FDDI, SONET), bus (legacy), and hybrid. Choose redundancy according to availability needs: dual switches, dual uplinks, and diverse paths.

7. Performance measures and network operations

Security includes availability, so you should understand these terms.

Operational controls:

• Traffic shaping and QoS prioritize critical traffic (voice, storage, management) and limit abusive flows.
• Capacity management forecasts growth and avoids saturation that looks like an outage or enables easy DoS.
• Fault management and observability: flow records (NetFlow/IPFIX), SNMP traps, packet capture, synthetic probes, and centralized logging. Baselines make anomalies visible; without a baseline, an exfiltration spike looks like normal traffic.
• Redundancy: dual paths, dual providers, and automatic failover tested regularly.

8. Worked example: segmenting a hospital network

Scenario. Riverside Hospital runs a single flat /16 network. It hosts clinical workstations, infusion pumps (IoT medical devices running outdated firmware), an electronic health records (EHR) system, guest Wi-Fi, and a VoIP phone system. After a ransomware incident that started on a visitor laptop plugged into a conference-room port, the board orders a redesign. The CISO needs a plan that fits the budget and does not interrupt patient care.

Step 1: Classify assets and trust levels. EHR servers (high), clinical workstations (medium-high), medical devices (high criticality but low trust, since they cannot be patched), VoIP (medium), guests (untrusted).

Step 2: Choose segmentation layers.

• Create separate VLANs and subnets: clinical, medical devices, servers, voice, guest, management.
• Route between zones through a next-generation firewall with default deny.
• Put infusion pumps in a restrictive zone: they may reach only their management server on specific ports, and no inbound connections from clinical workstations except through that server.
• Place the EHR database in a data zone that accepts connections only from the application tier on the database port.
• Apply 802.1X and NAC on wired ports so an unknown laptop lands in a quarantine or guest VLAN rather than the clinical network.
• Use WPA3/WPA2-Enterprise for staff Wi-Fi and an isolated captive-portal SSID for guests, with client isolation.

Step 3: Protect east-west traffic. Enable host firewalls on servers, add flow logging between zones, and deploy IDS sensors on the zone interconnects.

Step 4: Secure management. Create a restricted management VLAN with MFA-protected jump hosts and TACACS+ for network devices.

A VLAN on the production fabric is logical separation, not by itself a physically independent out-of-band path.

Step 5: Plan the migration. Move one department at a time during maintenance windows, run the firewall in monitor mode first to learn real flows, then enforce.

Solution and why. The key controls are segmentation by trust level, default-deny between zones, NAC on wired ports, and isolation of unpatchable devices. Alternatives are weaker: only adding an endpoint antivirus does not protect the infusion pumps; only a stronger perimeter firewall would not have stopped lateral movement from the internal laptop; simply moving all devices to separate VLANs without filtering between them gives broadcast containment but no security, since traffic would still route freely; and an air gap for the whole hospital is impractical given the need for connectivity with labs and insurers.

9. Comparison tables

9.1 Segmentation techniques

9.2 AWS VPC security group versus network ACL

10. Mini case study

Scenario. Pinecrest Logistics is moving its warehouse management system to a public cloud and keeping its on-premises ERP. Requirements: the web tier faces customers via a CDN, the application tier talks to the ERP over a dedicated link, scanners in the warehouse use Wi-Fi, and the security team wants visibility of internal traffic. Current plan: one VPC, one public subnet holding all servers, a pre-shared-key Wi-Fi for scanners, and a permissive security group (0.0.0.0/0 on all ports) "until go-live."

Task. Identify the problems and propose the architecture.

Commented solution.

1. Single public subnet. Put only the load balancer or CDN-origin endpoint in a public subnet; place application and database tiers in private subnets with no route from the internet. Reason: shrink the attack surface and keep east-west paths controlled.
2. 0.0.0.0/0 security group. Replace with tier-specific rules: the web tier accepts HTTPS only from the CDN or load balancer; the app tier accepts only from the web tier; the database only from the app tier. Use network ACLs as a second, stateless layer. "Until go-live" rules are a frequent cause of breaches.
3. Origin exposure. Restrict origin reachability and authenticate the intended CDN distribution or tunnel. Shared CDN IP allowlists alone may not prove that a request came through your own protected configuration.
4. ERP link. Use a dedicated private connection and/or IPsec with redundancy, and route only the required prefixes. A dedicated connection does not itself guarantee payload encryption; add suitable protection when required. The link extends the trust boundary, so filter at both ends.
5. Wi-Fi scanners. Move from a shared PSK to WPA2/WPA3-Enterprise with certificates per device (EAP-TLS) on a dedicated scanner VLAN that reaches only the warehouse application.
6. Visibility. Enable VPC flow logs, centralize them with firewall and DNS logs, and baseline traffic so east-west anomalies can be detected.
7. Management plane. Restrict administrative access to a bastion or private endpoint with MFA and log every administrative API call.

11. Common pitfalls and exam tips

• Pitfall: treating a VLAN as a security boundary. A VLAN separates broadcast domains; you still need filtering between VLANs.
• Pitfall: believing NAT secures a network. Stateful filtering and segmentation do.
• Exam tip: DNSSEC provides integrity and origin authentication, not confidentiality.
• Exam tip: when a question mentions "lateral movement" or "east-west", think micro-segmentation, internal firewalls, and host-based controls rather than perimeter upgrades.
• Exam tip: "stateful" means the device tracks connection state (security groups, stateful firewalls); "stateless" evaluates each packet alone (network ACLs, simple packet filters).
• Pitfall: forgetting the management plane. Compromised management access defeats every other control.
• Exam tip: in SDN the controller is the crown jewel; the best answer usually includes strong authentication, segmentation of controller traffic, and redundancy.
• Exam tip: for wireless, the strongest answer is typically WPA3 or WPA2/WPA3-Enterprise with 802.1X; never WEP or an open network with only a captive portal for sensitive use.
• Pitfall: confusing bandwidth (capacity) with throughput (achieved) and latency with jitter (variation).
• Exam tip: converged protocols mean shared infrastructure; the answer is isolation (separate VLAN or fabric) plus authentication.

Key terms

• Encapsulation: wrapping data with the headers of each layer as it moves down the stack.
• VLAN / VRF: logical layer 2 segment / separate routing table.
• Micro-segmentation: workload-level policy that limits permitted paths and lateral movement.
• East-west / north-south: internal server-to-server traffic / traffic crossing the boundary.
• SDN: centralized control plane programming the data plane.
• Data, control, management plane: forwarding, building tables, configuring devices.
• SLAAC / NDP: IPv6 address autoconfiguration / neighbor discovery.
• DNSSEC / DoT / DoH: DNS authenticity / encrypted DNS transports.
• Jitter: variation in packet delay.
• VPC: logically isolated virtual network in a cloud.

Summary checklist

• I can place protocols, devices, and attacks on the OSI and TCP/IP layers.
• I can explain encapsulation, tunneling, and why encryption limits inspection.
• I can compare IPv4 and IPv6 security issues (dual stack, NDP, tunnels).
• I can pick secure replacements for Telnet, FTP, HTTP, SNMPv1/v2c, and LDAP.
• I can design segmentation with VLANs, VRFs, VPNs, micro-segmentation, and VPCs.
• I can explain north-south versus east-west traffic and why east-west visibility matters.
• I can describe WPA3, 802.1X, CDN, cellular, and SDN security considerations.
• I can define bandwidth, throughput, latency, jitter, and signal quality.

Apply secure design principles and zero trust when defining trust boundaries. Continue with network components and secure communication channels to implement the design, and connect admission policies to identification, authentication, and federation.

Official sources

• ISC2 CISSP exam outline: https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline (opens in a new tab)

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final (opens in a new tab)

• NIST SP 800-119, Guidelines for the Secure Deployment of IPv6: https://csrc.nist.gov/pubs/sp/800/119/final (opens in a new tab)

• NIST SP 800-207, Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final (opens in a new tab)

• NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks: https://csrc.nist.gov/pubs/sp/800/153/final (opens in a new tab)

• NIST SP 800-125B, Secure Virtual Network Configuration for VM Protection: https://csrc.nist.gov/pubs/sp/800/125/b/final (opens in a new tab)

• IETF, IPv6 node requirements (IPsec support): https://www.rfc-editor.org/rfc/rfc8504.html (opens in a new tab)

• Microsoft, IPv6 configuration guidance: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows (opens in a new tab)

• AWS, VPC security groups and network ACLs: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html (opens in a new tab)

• IETF, SNMP security levels: https://www.rfc-editor.org/rfc/rfc3411.html (opens in a new tab)

• IETF, IP over InfiniBand: https://www.rfc-editor.org/rfc/rfc4391.html (opens in a new tab)

• Cisco, WPA3 deployment: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/wpa3-dg.html (opens in a new tab)

• Microsoft, EAP server validation: https://learn.microsoft.com/en-us/windows-server/networking/technologies/extensible-authentication-protocol/network-access (opens in a new tab)

• Cloudflare, Account-specific authenticated origin pulls: https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/ (opens in a new tab)