OT Microsegmentation

[carl_townshend]

Hi Guys

Probably a common topic in todays networking, I am keen to see how people are tackling micro segmentation, particularly in OT networks.

We already secure north south traffic via firewalls, but we want to go one step further and secure east west traffic.

We already use a NAC solution (not Cisco) to identify the assets, so implementing ISE/Trustsec would not be viable.

What options do we have? how are people tackling this?

Cheers

[pieterh]

is your NAC capable of defining policies? and sending DACL information to the network switches ?
ISE is not the only server that can do this!

-> define profiles or groups of devices and/or users that can or cannot initiate communitation to the other group(s) 

[carl_townshend]

Hi, it used to be but we have switched that feature off, it would have created too many ACLs and the TCAM tables on the switches would not be sufficient from what I remember.

I can see some other options, VACLS, PVLANs? I did also see a solution called Airgap which looked good

[Elliot Dierksen]

Is your goal to keep devices on the same network from talking to each other and only permit north/south traffic? If so, that sounds exactly like what PVLAN is designed to do. It is also likely simpler to implement than the other options you mentioned.