Got an interesting microsegmentation-focused email from one of my readers. He started with:

Since every SDDC vendor is bragging about need for microsegmentation in order to protect East West traffic and how their specific products are better compared to competition, I’d like to ask your opinion on a few quick questions.

First one: does it even make sense?

In most cases, all they implementing is our old day friend ACL which at most can look into Layer 2-4 parameters. I am not a security expert, but what percentage of attacks today in Cyber Security Advance Threats realm really rely upon just opened holes as port numbers access?

Let's just say that limiting access to services that are needed to actually run an application stack is a huge improvement over "let's put all web servers in the same VLAN because we don't want to configure a web VLAN per application" state-of-mind we see in many data centers today.

I'd love to be an intruder hitting such a data center. All I'd have to do to have all the fun in the world is turn on IPv6.

For more details on 50 shades of firewall statefulness watch the Virtual Firewalls webinar (part of ipSpace.net subscription).

For example, if I put myself into shoes of an attacker to play role of devil’s advocate, I would not try to gets access to web server from outside just because web port is opened, but rather to hide my exploit code in payload and trigger it with some mechanism from outside.

That's why you'd implement a decent set of protections in the public-facing segment, harden your servers, deploy WAFs... Within the data center you don't have the CPU power to do more than basic hygiene (or it becomes too expensive).

Deep packet inspection firewalls consume on order of 4 CPU cores to filter 1 Gbps of customer traffic. A single 1RU data center switch provides terabits of bandwidth. Do I need to say more?

Also, my understanding is that in most cases when a major breakout happens, those are usually targeted on specific vulnerabilities and not that they exploit let’s say Web vulnerabilities first and for more fun later try to exploit Data Base as most of such attacks in my opinion have targeted hosts in mind with Automated deployment design in mind.

OK, let's assume you have a 0-day exploit for Apache server. Next thing you know, you own all the web servers. Game over.

You also have a SSH 0-day exploit... but guess what, you can't SSH from servers running Apache to adjacent servers running nginx (or mysql) because someone actually implemented microsegmentation.

OTOH if all microsegmentation does is to give some protection by blocking unnecessary access, we can still use traditional tools like Private VLANs, Protected Ports or an IPS as Intermediate devices between Segments to get things done one way or another.

Can I invoke RFC 1925 rule 4? ;)

Try implementing private VLANs in a large multi-layer data center fabric with many apps (and proper segmentation, not just "let's send everything to the first-hop router just because") and let me know how well it works.

Also, from the Roman times there's the concept of "divide et impera". Having a tightly focused ACL in front of every server is infinitely (admittedly for some small value of infinity) more manageable than having a 10.000 line ACL sitting on your core router.

As for the IPS idea, they have similar bandwidth-per-CPU-core ratios as DPI firewalls. I don’t think you can afford them at the data center fabric speeds.

Want to know more?

There are two major products promising the nirvana of microsegmentation: VMware NSX and Cisco ACI. I’ll highlight their high-level differences in the introductory session of VMware NSX, Cisco ACI or Standard-Based EVPN, and cover VMware NSX in more details in the DIGS event and workshop on April 19th.