Host-based micro-segmentation approach to restrict traffic within the same network?
I want to know whether a host-based micro-segmentation approach can restrict the communication channel between hosts residing on the same network. Without any additional infrastructure like FortiSwitch and FortiAP.
There are three primary approaches to micro-segmentation security, and they are categorized based on where the implementation is taking place: network-based, hypervisor-based, and host-based.
1. Network-based Network-based microsegmentation involves choosing who or what can enter different segments of the network. One benefit is it is straightforward to administer, making it less work-intensive for administrators. However, network-based segmentation is essentially very similar to traditional segmentation, and if you end up with very large segments, it can be difficult and costly to administer security controls.
2. Hypervisor-based With a hypervisor, you have software or hardware that makes and runs virtual machines. Hypervisor-based microsegmentation directs all of your traffic through the hypervisor, giving you the ability to monitor and manage it. In many cases, this is a convenient choice because you can often do this with your existing firewalls and move security policies from one hypervisor to another.
On the downside, a hypervisor-based approach does not work well within cloud deployments or with bare metal, container, or physical workloads.
3. Host-based Host-based micro-segmentation depends on positioning agents within each endpoint. With this kind of architecture, a central manager has visibility of all data, processes, software, communications on the network, and potential vulnerabilities. However, to achieve this visibility, the administrator has to install an agent on each and every host. This could be time-consuming for both the administrator and end-users."
Please find the link to understand more about micro-segmentation
Another option would be a completely access layer segmentation solution like Cisco ISE with TrustSec. Those TrustSec tags can also be shared with the FortiGate via pxGrid for firewall policy enforcement for layer3/egress.
As you mentioned micro-segmentation is related to Layer 2 communications between the hosts that share the same subnet. In case you want to limit their communication you have to enforce policy at the device that offers this Layer 2 communication because they can reach each other without the need of a layer 3 device.
Both FortiAP (Block intra-SSID traffic) and the FortiSwitch (Block intra-VLAN traffic) offer restrictions at layer 2 and FGT can be configured as a proxy ARP to allow communication between layer 2 hosts after a firewall policy evaluation.
- Emirjon If you have found a solution, please like and accept it to make it easily accessible for others.
Micro-segmentation from the ZTA access is more like protecting access to only the necessary servers while checking that the source is compliant, not running suspicious process (RDP hopping), has vulnerabilities or is affected by some malware. As soon as it's detected base on rules this host losses access to the remote resource or get quarantined by FortiClient to isolate the contamination.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.