Skip to main content
Bjay_Prakash_Ghising
Bjay_Prakash_Ghising
Explorer II
August 21, 2023
Question

Host-based micro-segmentation approach to restrict traffic within the same network?

  • August 21, 2023
  • 2 replies
  • 7696 views

Hi everyone

 

I want to know whether a host-based micro-segmentation approach can restrict the communication channel between hosts residing on the same network. Without any additional infrastructure like FortiSwitch and FortiAP. 

 

"Micro-segmentation Approaches:

There are three primary approaches to micro-segmentation security, and they are categorized based on where the implementation is taking place: network-based, hypervisor-based, and host-based.

 

1. Network-based
Network-based microsegmentation involves choosing who or what can enter different segments of the network. One benefit is it is straightforward to administer, making it less work-intensive for administrators. However, network-based segmentation is essentially very similar to traditional segmentation, and if you end up with very large segments, it can be difficult and costly to administer security controls.

 

2. Hypervisor-based
With a hypervisor, you have software or hardware that makes and runs virtual machines. Hypervisor-based microsegmentation directs all of your traffic through the hypervisor, giving you the ability to monitor and manage it. In many cases, this is a convenient choice because you can often do this with your existing firewalls and move security policies from one hypervisor to another.

On the downside, a hypervisor-based approach does not work well within cloud deployments or with bare metal, container, or physical workloads.

 

3. Host-based
Host-based micro-segmentation depends on positioning agents within each endpoint. With this kind of architecture, a central manager has visibility of all data, processes, software, communications on the network, and potential vulnerabilities. However, to achieve this visibility, the administrator has to install an agent on each and every host. This could be time-consuming for both the administrator and end-users."

 

Please find the link to understand more about micro-segmentation

https://www.fortinet.com/resources/cyberglossary/microsegmentation

 

 

So to communicate, the host residing on the same subnet needs to traverse the FortiGate Firewall and pass through the policy with the security scan.

 

 

Kind regards, 

Bijay Prakash Ghising

2 replies

adambomb1219
SuperUser
adambomb1219
SuperUser
August 21, 2023

Not without FortiSwitch or FortiAP no.  Otherwise the traffic will never reach the firewall from a layer2 prospective unless the firewall is also aware of the layer2 domain (via FortiSwitch/FortiAP).

adambomb1219
SuperUser
adambomb1219
SuperUser
August 21, 2023

Another option would be a completely access layer segmentation solution like Cisco ISE with TrustSec.  Those TrustSec tags can also be shared with the FortiGate via pxGrid for firewall policy enforcement for layer3/egress.

    Bjay_Prakash_Ghising
    Bjay_Prakash_GhisingAuthor
    Explorer II
    August 22, 2023

    Thank you. This one (Cisco ISE) is a new thing for me. I will research them later. 

    I appreciate your response. You must be taking about this.

     

    <Edit>

    SGTs - a part of Cisco's identity-based networking and access control solutions, often associated with Cisco's TrustSec technology. 

     

    https://docs.fortinet.com/document/fortigate/7.0.0/new-features/322202/cisco-security-group-tag-as-policy-matching-criteria-7-0-1

    <Edit/>

      ebilcari
      Staff
      ebilcari
      Staff
      August 22, 2023

      As you mentioned micro-segmentation is related to Layer 2 communications between the hosts that share the same subnet. In case you want to limit their communication you have to enforce policy at the device that offers this Layer 2 communication because they can reach each other without the need of a layer 3 device.

      Both FortiAP (Block intra-SSID traffic) and the FortiSwitch (Block intra-VLAN traffic) offer restrictions at layer 2 and FGT can be configured as a proxy ARP to allow communication between layer 2 hosts after a firewall policy evaluation.

      Emirjon
      Bjay_Prakash_Ghising
      Bjay_Prakash_GhisingAuthor
      Explorer II
      August 22, 2023

      Certainly! FortiAP and FortiSwitch are equipped to implement L2 micro-segmentation

       

      However, I'd like to understand if this same capability can be achieved through FortiClient EMS. Specifically, with the host-based micro-segmentation approach

       

      While I'm aware that FortiGate and FortiClient EMS can facilitate application-based micro-segmentation, I'm curious if EMS can extend its capabilities to encompass network-level micro-segmentation.

       

      On Forticlient EMS's, Administration > Fabric Device. We have the option to share all the IPs and MAC of the endpoint to the FortiGate.

      Share all FortiClients

      The selected FortiGate receives all endpoints' resolved IP or MAC addresses (hereafter referred to as "host tag"), regardless of whether the gateways point to the selected FortiGate.

       

      So with these capabilities, can it be extende to have network-level micro-segmentation?

       

      Also, will you give me some insight about host-based micro-segmentation, Is it the same as the ZTNA application proxy for the end host to access the internal services?

       

      Kind Regards, 

      Bijay Prakash Ghising

      adambomb1219
      SuperUser
      adambomb1219
      SuperUser
      August 22, 2023

      No, because the FortiGate still doesn't participate in layer2 in this scenario.  

      Terms & ConditionsAccessibility statement