Network isolation

[dipakchaulagain525]

Hi,
I work as an IT engineer in a company with 200-500 employees, and I want to implement some concept of a zero trust model at the company network level. Currently, there are different networks with subnet of 255.255.255.0 for servers, databases, management, and user departments. But I want to make sure that even the devices on the same subnet could not communicate or reach each other, and only the permitted device can communicate with the other device. I can't create each subnet for a server or user device, as the amount and count would be large and complicated to manage. Is there any solution for this?
Or is there a method that can be implemented on a large scale so that I can allow or deny the communication on the L2 level as well?

Thank you.

[M02@rt37]

Hello @dipakchaulagain525 

Private VLANs are an excellent way to isolate devices within the same VLAN at Layer 2. PVLANs support different port types, such as isolated ports, which restrict devices from communicating with each other while allowing access to shared resources (e.g., a gateway or server). Community ports can be used for devices that need limited group-based communication. This would allow you to maintain your current IP addressing scheme while isolating traffic efficiently...

Also, a Network Access Control (NAC) system can help enforce Zero Trust policies by authenticating and authorizing devices before they are allowed onto the network. Solutions like Cisco ISE can dynamically assign access controls to devices based on their identity, posture, or role. NAC systems can also enforce segmentation by dynamically applying VLAN assignments or access policies to devices, ensuring they can only communicate with authorized endpoints.

[Flavio Miranda]

@dipakchaulagain525 

Best solution for network segmentation at layer2 level now a days is DNAC with ISE, or ISE alone. Hawever, hard to justify such investiment for a small to middle size Company.

 But, If investiment is not a problem, ISE is the best option.