topic Re: Firewall Segmentation in Network Security

Firewall Segmentation

dianawinsky — Sun, 15 Jun 2025 08:57:31 GMT

Is a Cisco firewall capable of microsegmentation? Can it handle east-west traffic and monitor traffic within the same VLAN?

Re: Firewall Segmentation

Rob Ingram — Sun, 15 Jun 2025 09:28:35 GMT

@dianawinsky for east-west segmentation you would use Cisco TrustSec https://community.cisco.com/t5/security-knowledge-base/segmentation-strategy/ta-p/3757424 the Firewall (FTD or ASA) can restrict access for traffic routed between VLANs, not within the same VLAN.

Re: Firewall Segmentation

dianawinsky — Sun, 15 Jun 2025 09:30:53 GMT

How about for monitoring the traffic within the same Vlans? Not just only between vlans

Re: Firewall Segmentation

Rob Ingram — Sun, 15 Jun 2025 09:33:49 GMT

@dianawinsky you can use netflow with Secure Network Analytics (Stealthwatch) to provide information on traffic flow within the VLAN. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-3019.pdf

Re: Firewall Segmentation

dianawinsky — Sun, 15 Jun 2025 09:45:09 GMT

Does this imply that a standalone firewall alone cannot provide complete functionality, and integration with additional solutions is necessary for my requirements?

Re: Firewall Segmentation

Rob Ingram — Sun, 15 Jun 2025 09:50:42 GMT

@dianawinsky yes, you need additional solutions to provide east-west segementation within the same VLAN.

The firewall will only see traffic routed through it (between networks/VLANs) in order to provide the segmentation.

Re: Firewall Segmentation

MHM Cisco World — Sun, 15 Jun 2025 14:03:16 GMT

What you meaning east west traffic?

If you talking about l2 traffic in DC then sure NGFW can do transparent for l2 traffic.

You can add IPS inline (i will be more sure about this point)

MHM

Re: Firewall Segmentation

dianawinsky — Mon, 16 Jun 2025 01:32:45 GMT

Yes, in our network, we want to have an internal firewall to handle east-west traffic and is capable of monitoring/inspecting traffic within the same VLANs, aside from inter-VLANs. It isn't for DC, but in our case, we have perimeter fw, core, distribution, and access, and we will add internal fw.