Host-based micro-segmentation approach to restrict traffic within the same network?

[Bjay_Prakash_Ghising]

Hi everyone

I want to know whether a host-based micro-segmentation approach can restrict the communication channel between hosts residing on the same network. Without any additional infrastructure like FortiSwitch and FortiAP. 

"Micro-segmentation Approaches:

There are three primary approaches to micro-segmentation security, and they are categorized based on where the implementation is taking place: network-based, hypervisor-based, and host-based.

1. Network-based
Network-based microsegmentation involves choosing who or what can enter different segments of the network. One benefit is it is straightforward to administer, making it less work-intensive for administrators. However, network-based segmentation is essentially very similar to traditional segmentation, and if you end up with very large segments, it can be difficult and costly to administer security controls.

2. Hypervisor-based
With a hypervisor, you have software or hardware that makes and runs virtual machines. Hypervisor-based microsegmentation directs all of your traffic through the hypervisor, giving you the ability to monitor and manage it. In many cases, this is a convenient choice because you can often do this with your existing firewalls and move security policies from one hypervisor to another.

On the downside, a hypervisor-based approach does not work well within cloud deployments or with bare metal, container, or physical workloads.

3. Host-based
Host-based micro-segmentation depends on positioning agents within each endpoint. With this kind of architecture, a central manager has visibility of all data, processes, software, communications on the network, and potential vulnerabilities. However, to achieve this visibility, the administrator has to install an agent on each and every host. This could be time-consuming for both the administrator and end-users."

Please find the link to understand more about micro-segmentation

https://www.fortinet.com/resources/cyberglossary/microsegmentation

So to communicate, the host residing on the same subnet needs to traverse the FortiGate Firewall and pass through the policy with the security scan.

Kind regards, 

Bijay Prakash Ghising

[adambomb1219]

Not without FortiSwitch or FortiAP no.  Otherwise the traffic will never reach the firewall from a layer2 prospective unless the firewall is also aware of the layer2 domain (via FortiSwitch/FortiAP).

[adambomb1219]

Another option would be a completely access layer segmentation solution like Cisco ISE with TrustSec.  Those TrustSec tags can also be shared with the FortiGate via pxGrid for firewall policy enforcement for layer3/egress.

[Bjay_Prakash_Ghising]

Thank you. This one (Cisco ISE) is a new thing for me. I will research them later. 

I appreciate your response. You must be taking about this.

<Edit>

SGTs - a part of Cisco's identity-based networking and access control solutions, often associated with Cisco's TrustSec technology. 

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/322202/cisco-security-group-tag-as-p...

<Edit/>

[ebilcari]

As you mentioned micro-segmentation is related to Layer 2 communications between the hosts that share the same subnet. In case you want to limit their communication you have to enforce policy at the device that offers this Layer 2 communication because they can reach each other without the need of a layer 3 device.

Both FortiAP (Block intra-SSID traffic) and the FortiSwitch (Block intra-VLAN traffic) offer restrictions at layer 2 and FGT can be configured as a proxy ARP to allow communication between layer 2 hosts after a firewall policy evaluation.

[Bjay_Prakash_Ghising]

Certainly! FortiAP and FortiSwitch are equipped to implement L2 micro-segmentation

However, I'd like to understand if this same capability can be achieved through FortiClient EMS. Specifically, with the host-based micro-segmentation approach

While I'm aware that FortiGate and FortiClient EMS can facilitate application-based micro-segmentation, I'm curious if EMS can extend its capabilities to encompass network-level micro-segmentation.

On Forticlient EMS's, Administration > Fabric Device. We have the option to share all the IPs and MAC of the endpoint to the FortiGate.

Share all FortiClients

The selected FortiGate receives all endpoints' resolved IP or MAC addresses (hereafter referred to as "host tag"), regardless of whether the gateways point to the selected FortiGate.

So with these capabilities, can it be extende to have network-level micro-segmentation?

Also, will you give me some insight about host-based micro-segmentation, Is it the same as the ZTNA application proxy for the end host to access the internal services?

Kind Regards, 

Bijay Prakash Ghising

[adambomb1219]

No, because the FortiGate still doesn't participate in layer2 in this scenario.  

[Bjay_Prakash_Ghising]

Indeed, I tested it in my lab, and it appears that the method I mentioned earlier does not function as anticipated.

As we discussed previously, FortiGate wasn't aware of the L2 network.

With those mentioned methods, micro-segmentation could not be achievable

Thanks to everyone who participated in the discussion. From, next time, I will test myself before I take part in the discussion

Thanks again.

Kind Regards,
Bijay Prakash Ghising

[ebilcari]

Micro-segmentation from the ZTA access is more like protecting access to only the necessary servers while checking that the source is compliant, not running suspicious process (RDP hopping), has vulnerabilities or is affected by some malware. As soon as it's detected base on rules this host losses access to the remote resource or get quarantined by FortiClient to isolate the contamination.

Some more detail are well explained here: https://www.fortinet.com/resources/cyberglossary/microsegmentation

It has some similarities from security perspective but differs from the classic L2 isolation between the hosts.