implementing-network-segmentation-with-firewall-zones

使用防火墙区域实施网络分段

概述

网络分段将扁平网络划分为彼此隔离的安全区域，并通过防火墙强制实施边界，从而遏制安全漏洞、限制横向移动，并在工作负载之间执行最小权限访问。分段是 PCI DSS、HIPAA、NIST 800-53 和零信任架构所要求的基础控制措施。现代分段将传统的基于 VLAN 的方法与工作负载级微分段相结合，以精细控制东西向流量。本技能介绍如何设计区域架构、配置区域间防火墙策略、在交换机上实施 VLAN 分段，以及为动态环境部署微分段。

适用场景

• 在环境中部署或配置具备使用防火墙区域实施网络分段功能的方案
• 建立符合合规要求的安全控制措施
• 构建或改进此领域的安全架构
• 开展需要实施此方案的安全评估

前提条件

• 包含资产清单的网络拓扑文档
• 支持基于区域策略的防火墙（Palo Alto、Fortinet、Cisco Firepower）
• 支持 VLAN 的托管交换机（802.1Q 中继）
• 流量流向文档或用于基线分析的 NetFlow 数据
• 合规要求（PCI DSS 范围、HIPAA ePHI 边界）

核心概念

区域架构层级

区域	信任级别	示例	访问策略
互联网	无	公共互联网	默认拒绝入站流量
DMZ	低	Web 服务器、邮件中继、DNS	限制入站流量，限制出站流量
访客	低	访客 WiFi、访客网络	仅限互联网访问，禁止访问内部网络
企业	中	员工工作站、打印机	受控访问内部资源
服务器/数据中心	高	应用服务器、数据库	严格的 ACL，仅允许有限的管理员访问
PCI CDE	严重	支付系统、持卡人数据	符合 PCI DSS 的隔离
管理	严重	网络设备、虚拟机监控程序、IPMI	严格限制，仅允许通过跳板机访问
OT/SCADA	严重	工业控制系统	物理隔离或严格的防火墙保护

分段方法

方法	范围	粒度	使用场景
VLAN 分段	第 2 层	子网级	部门隔离、访客隔离
防火墙区域	第 3-7 层	区域间	强制执行区域间策略
路由器上的 ACL	第 3-4 层	子网/端口	在路由边界快速过滤
微分段	第 3-7 层	工作负载级	零信任、容器环境
SGT/TrustSec	第 2-7 层	基于标签	基于身份的分段

工作流

步骤 1：映射流量流向并定义区域

实施分段前，先采集流量基线：

# Capture NetFlow data to understand existing traffic patterns
nfdump -R /var/cache/nfdump/ -s srcip/bytes -n 50

# Identify east-west traffic between subnets
nfdump -R /var/cache/nfdump/ -s record/bytes \
  'src net 10.0.0.0/8 and dst net 10.0.0.0/8' -n 100

# Map application dependencies
# Document which servers need to communicate with which other servers

步骤 2：在交换机上配置 VLAN

! Core switch VLAN configuration
vlan 10
 name Management
vlan 20
 name Corporate-Users
vlan 30
 name Servers
vlan 40
 name PCI-CDE
vlan 50
 name Guest
vlan 60
 name DMZ
vlan 99
 name Native-Unused

! Trunk port to firewall
interface GigabitEthernet1/0/1
 description Trunk-to-Firewall
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,60
 switchport trunk native vlan 99
 switchport nonegotiate

! Access port for corporate users
interface range GigabitEthernet1/0/2-24
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast

! Access port for servers
interface range GigabitEthernet1/0/25-36
 switchport mode access
 switchport access vlan 30

! Prevent VLAN hopping
interface range GigabitEthernet1/0/37-48
 switchport mode access
 switchport access vlan 99
 shutdown

步骤 3：配置防火墙区域策略

Palo Alto 基于区域的策略：

# Define zones on firewall sub-interfaces
set network interface ethernet ethernet1/1 layer3 units ethernet1/1.10 tag 10 ip 10.0.10.1/24
set network interface ethernet ethernet1/1 layer3 units ethernet1/1.20 tag 20 ip 10.0.20.1/24
set network interface ethernet ethernet1/1 layer3 units ethernet1/1.30 tag 30 ip 10.0.30.1/24
set network interface ethernet ethernet1/1 layer3 units ethernet1/1.40 tag 40 ip 10.0.40.1/24

set zone Management network layer3 ethernet1/1.10
set zone Corporate network layer3 ethernet1/1.20
set zone Servers network layer3 ethernet1/1.30
set zone PCI-CDE network layer3 ethernet1/1.40

# Inter-zone policies (deny by default, explicitly allow)

# Corporate -> Servers (only specific apps)
set rulebase security rules Corp-to-Servers from Corporate to Servers
set rulebase security rules Corp-to-Servers application [ web-browsing ssl dns smtp ]
set rulebase security rules Corp-to-Servers action allow
set rulebase security rules Corp-to-Servers profile-setting group Standard-Profiles

# Corporate -> PCI (DENY)
set rulebase security rules Corp-to-PCI from Corporate to PCI-CDE
set rulebase security rules Corp-to-PCI action deny log-end yes

# Servers -> PCI (only payment processing)
set rulebase security rules Servers-to-PCI from Servers to PCI-CDE
set rulebase security rules Servers-to-PCI source [ 10.0.30.10 ]
set rulebase security rules Servers-to-PCI destination [ 10.0.40.10 ]
set rulebase security rules Servers-to-PCI application [ ssl ]
set rulebase security rules Servers-to-PCI service service-https
set rulebase security rules Servers-to-PCI action allow

# Management -> All (admin access via jump box)
set rulebase security rules Mgmt-Admin from Management to [ Servers PCI-CDE ]
set rulebase security rules Mgmt-Admin source [ 10.0.10.50 ]
set rulebase security rules Mgmt-Admin application [ ssh rdp ]
set rulebase security rules Mgmt-Admin source-user [ admin-group ]
set rulebase security rules Mgmt-Admin action allow

# Intra-zone deny (prevent lateral movement within zone)
set rulebase security rules Deny-Intrazone from Corporate to Corporate
set rulebase security rules Deny-Intrazone action deny log-end yes

# Default deny all
set rulebase security rules Deny-All from any to any
set rulebase security rules Deny-All action deny log-end yes

步骤 4：实施 VLAN 间路由 ACL

如需在路由器/L3 交换机上进行额外的第 3 层过滤：

! ACL: Corporate can only reach specific server ports
ip access-list extended CORP-TO-SERVERS
 permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 80
 permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 443
 permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 25
 permit udp 10.0.20.0 0.0.0.255 10.0.30.10 0.0.0.0 eq 53
 deny ip 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 log

! ACL: PCI CDE isolation
ip access-list extended PCI-ISOLATION
 permit tcp host 10.0.30.10 host 10.0.40.10 eq 443
 permit tcp 10.0.10.50 0.0.0.0 10.0.40.0 0.0.0.255 eq 22
 deny ip any 10.0.40.0 0.0.0.255 log

! Apply ACLs to VLAN interfaces
interface Vlan20
 ip address 10.0.20.1 255.255.255.0
 ip access-group CORP-TO-SERVERS out

interface Vlan40
 ip address 10.0.40.1 255.255.255.0
 ip access-group PCI-ISOLATION in

步骤 5：验证分段

#!/usr/bin/env python3
"""Network segmentation validation - tests connectivity between zones."""

import subprocess
import sys
import json
from datetime import datetime


class SegmentationValidator:
    """Test network segmentation controls between zones."""

    def __init__(self):
        self.results = []

    def test_connectivity(self, src_desc: str, dst_ip: str, port: int,
                          protocol: str = "tcp", expected: str = "blocked"):
        """Test if connectivity exists between source and destination."""
        try:
            if protocol == "tcp":
                cmd = ["nc", "-z", "-w", "3", dst_ip, str(port)]
            elif protocol == "udp":
                cmd = ["nc", "-z", "-u", "-w", "3", dst_ip, str(port)]
            elif protocol == "icmp":
                cmd = ["ping", "-c", "1", "-W", "3", dst_ip]
            else:
                return

            result = subprocess.run(cmd, capture_output=True, timeout=5)
            actual = "open" if result.returncode == 0 else "blocked"

        except subprocess.TimeoutExpired:
            actual = "blocked"
        except FileNotFoundError:
            actual = "error"

        status = "PASS" if actual == expected else "FAIL"

        self.results.append({
            "source": src_desc,
            "destination": f"{dst_ip}:{port}/{protocol}",
            "expected": expected,
            "actual": actual,
            "status": status,
        })

        symbol = "[+]" if status == "PASS" else "[!]"
        print(f"  {symbol} {src_desc} -> {dst_ip}:{port}/{protocol} "
              f"| Expected: {expected} | Actual: {actual} | {status}")

    def run_validation(self):
        """Run segmentation validation tests."""
        print(f"\n{'='*70}")
        print("NETWORK SEGMENTATION VALIDATION")
        print(f"{'='*70}")
        print(f"Date: {datetime.now().isoformat()}\n")

        # Tests that SHOULD be blocked
        print("[*] Testing controls that should BLOCK traffic:")
        self.test_connectivity("Corporate", "10.0.40.10", 443, "tcp", "blocked")
        self.test_connectivity("Corporate", "10.0.40.10", 22, "tcp", "blocked")
        self.test_connectivity("Guest", "10.0.30.10", 80, "tcp", "blocked")
        self.test_connectivity("Guest", "10.0.20.1", 0, "icmp", "blocked")

        # Tests that SHOULD be allowed
        print("\n[*] Testing controls that should ALLOW traffic:")
        self.test_connectivity("Corporate", "10.0.30.10", 443, "tcp", "open")
        self.test_connectivity("Corporate", "10.0.30.10", 80, "tcp", "open")
        self.test_connectivity("Management", "10.0.30.10", 22, "tcp", "open")

        # Summary
        passed = sum(1 for r in self.results if r["status"] == "PASS")
        failed = sum(1 for r in self.results if r["status"] == "FAIL")
        print(f"\n{'='*70}")
        print(f"Results: {passed} PASSED, {failed} FAILED out of {len(self.results)} tests")

        if failed > 0:
            print(f"\n[!] FAILED TESTS:")
            for r in self.results:
                if r["status"] == "FAIL":
                    print(f"  - {r['source']} -> {r['destination']}: "
                          f"expected {r['expected']}, got {r['actual']}")

        # Save report
        report = {
            "date": datetime.now().isoformat(),
            "total_tests": len(self.results),
            "passed": passed,
            "failed": failed,
            "results": self.results,
        }
        report_path = f"segmentation_test_{datetime.now().strftime('%Y%m%d')}.json"
        with open(report_path, 'w') as f:
            json.dump(report, f, indent=2)
        print(f"\nReport saved to: {report_path}")


if __name__ == "__main__":
    validator = SegmentationValidator()
    validator.run_validation()

最佳实践

• 默认拒绝 - 从默认拒绝所有区域间规则开始，并明确允许所需流量
• 记录流量 - 在实施限制前，绘制所有合法流量的流向
• 按敏感度分段 - 按数据分类和合规范围对资产分组
• 控制区域内流量 - 阻止区域内的横向移动，而不仅仅是区域间的移动
• 限制管理访问 - 将管理平面限制在设有跳板机的专用区域内
• 定期验证 - 每季度使用自动化工具测试分段控制
• 监控被拒绝的流量 - 记录并审查被拒绝的区域间流量，以完善策略
• 缩减 PCI 范围 - 使用分段缩小 PCI DSS 持卡人数据环境的范围

参考资料

• CISA 零信任微分段指南
• NIST SP 800-125B - 安全虚拟网络配置
• PCI DSS v4.0 - 网络分段
• Faddom 2025 年网络分段最佳实践