Office VLANs and L3 ACLs: A Segmentation Map You Can Explain to Your Boss

Back when this office was young, the network was "one /24 to rule them all": finance desktops, the front-desk guest Wi-Fi, the surveillance NVR, and the print server all lived in the same broadcast domain. Then a ransomware sample got loose on a lab machine, and I finally had the political cover to segment. The goal wasn't a Cisco-certification-grade three-layer design, but this: a diagram you can draw in one picture, an ACL set you can explain in one conversation, and rollback you can execute at 3 a.m.

Segmentation principles (write them down first)

The principles:

1. Guests reach the internet by default and nothing else — no 10, no 20, no 99.
2. Endpoints to servers: only the ports you actually need (files, AD, business apps).
3. The management network is reachable only from the IT jump host and the ops segment.
4. The low-trust zone can't initiate connections to endpoints.

Addressing and gateways

Put the SVIs (or subinterfaces) on the core/L3 switch or the firewall. Keep DHCP split per VLAN, and make sure the Option field hands out the right DNS — internal DNS, not just your ISP's resolver.

VLAN10 SVI 10.10.10.1/24
VLAN20 SVI 10.10.20.1/24
...
default route -> edge firewall

Label the switch access ports: write the VLAN on the wall-plate sticker. That beats keeping the port table in your head. And only carry the VLANs you need on trunk uplinks — don't let "allow all" become a habit.

The minimal ACL set (example logic)

Describe each rule in gateway direction as "from source segment to destination segment," then translate to your device's syntax (numbered ACLs or object groups) when you implement it.

# guest -> any internal RFC1918 : deny
# guest -> internet : allow
# endpoint -> server : allow TCP 445, 88, 389, 443, business ports
# endpoint -> management : deny (except IT group)
# low-trust -> endpoint : deny
# management -> devices : allow SSH/HTTPS (source restricted to jump host)

Common failure modes: an ACL stuck on the wrong direction; an any any allow at the bottom with a deny tucked after it; and blocking only TCP while forgetting that same-subnet traffic reaches its target at Layer 2 anyway — ACLs can't police inside a VLAN, so segmentation is the precondition, not an afterthought.

Change order (so you don't lock yourself out)

1. Create the VLANs, SVIs, and DHCP first; endpoints stay on the old network for now.
2. Move the IT machines to the new VLAN and verify internet, AD, and file shares.
3. Move servers into VLAN20 (or put new servers straight into 20).
4. Only now apply the ACLs — monitor/log first, then enforce, if your device supports it.
5. Point the guest SSID at VLAN30.

The rollback point: don't delete the old SVI and old DHCP yet. Keep a window where you can jump back to the flat Layer 2 network.

Printers and scanners: the crying after segmentation

Cross the VLAN boundary and discovery protocols start weeping — Bonjour/mDNS and some vendor discovery mechanisms simply won't find each other. My playbook:

• Put printers in VLAN40 and add them by IP address in the drivers.
• Scan-to-email goes through the server, not "PC discovers printer."
• Don't bridge VLAN 40 and 10 at Layer 2 just to save yourself trouble.

Acceptance

• Guest machines can't see \\files.
• Employees can map drives and log in to AD normally.
• Management addresses accept SSH only from the IT jump host.
• No abnormal spikes in egress traffic or core CPU.

Wrapping up

Office segmentation is a network engineer's basic deliverable: a diagram, an address table, port roles, ACL intent, and rollback steps — five artifacts. None of it is technically hard. The hard part is carving out a change window in a culture of "just get it online first." Segmenting after the incident always costs more than that one quiet weekend.