mcpField
N
network-segmentation-review

network-segmentation-review

github.com/securityskillsSecurity0697 installsUpdated 9w ago
Repository

About network-segmentation-review

network-segmentation-review is a security skill for network and security teams assessing whether segmentation boundaries hold. It guides design and policy reviews, authorized connectivity tests, and evidence-based remediation reporting.

Key features

  1. 01Map zones, trust levels, and expected flows
  2. 02Check VLAN, routing, and ACL boundaries
  3. 03Review firewall rules and management access
  4. 04Inspect cloud groups, routes, and egress controls
  5. 05Run authorized cross-zone connectivity tests
  6. 06Produce flow matrices, evidence, and remediation

Use cases

  1. 01Verify implementation of network segmentation
  2. 02Find overly broad or unused firewall rules
  3. 03Test allowed and denied inter-zone connections
  4. 04Document boundary gaps with device evidence

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill network-segmentation-review

After installing, type/network-segmentation-reviewin Claude Code to confirm it loaded.

Details

From the project README

Network Segmentation Review

Verify that intended segmentation boundaries actually hold.

1. Understand the Intended Design

  • Obtain the network diagram: zones (DMZ, internal, production, corporate, OT), trust levels, intended flows
  • Map documented allowed flows vs "everything else should be denied"

2. Verify Layer 2/3 Boundaries

  • VLAN hopping: double-tagging, DTP negotiation on user ports, native VLAN mismatches on trunks
  • Inter-VLAN routing: which SVIs exist, ACLs between them
  • Private VLANs / port isolation where host-to-host traffic is unnecessary

3. Firewall and Router Policy

  • Rulebase review: any-any rules, overly broad source/destination (any→internal), rules by IP instead of objects
  • Shadowed and unused rules; logging disabled on deny rules
  • Management access: SSH/admin planes reachable from user segments?

4. Cloud Boundaries

  • Security groups: per-role groups, no 0.0.0.0/0 ingress on non-web ports
  • NACLs vs SGs layering; peering/transit gateway route tables leaking broader CIDRs
  • Egress control: can compromised workload reach arbitrary internet (data exfil path)?

5. Active Validation (authorized testing)

  • From representative hosts in each zone, attempt connections across boundaries: allowed (should work), denied (should fail and log)
  • Test both directions and return traffic for stateful devices
  • Use nmap -PN -sT -p <port> style targeted probes; record device logging the block

Output

A verified flow matrix (source zone × destination zone × port × expected × observed), gaps with device-level evidence, and remediation per boundary.

Comments

Markdown supported