Français
English
Español
Deutsch
NorskPractical guide
Segment a network and verify traffic rules
Prepare a communication matrix, enforce rules and demonstrate separation between zones.
Practical guide
A case to prepare your project
An office shares connectivity between staff, visitors and cameras. Visitors need Internet without internal or management access; cameras should reach only services necessary for their function.
Illustrative scenario, to adapt to your organisation.Prepare and perform the checks
Write the traffic matrix
For each source zone, record destination, service, reason and owner. Include often missed DNS, time, update and printing dependencies.
Prepare the change
Retain configurations, provide emergency management access and pilot one zone. Agree a maintenance window and rollback trigger.
Test both directions
Check required access and expected denials from every zone. Include IPv6 when enabled and verify Wi-Fi isolation too.
A reusable acceptance checklist
Agree thresholds, owners and test data before testing. Retain dated results, exceptions and the acceptance decision.
| Check | Expected result | Evidence to retain |
|---|---|---|
| Guest isolation | Guests reach Internet but not internal resources or management interfaces. | Tests from a guest device and matching rules. |
| Protected administration | Sensitive interfaces are reachable only through approved paths. | Access matrix and connection logs. |
| Business availability | Required applications still work after segmentation. | User scenarios including DNS and printing. |
| Recovery path | An authorised person can restore a known working configuration. | Readable backup and rehearsed procedure. |
Decide using evidence
Validate a rule against a documented need and a test. Give temporary exceptions an expiry date. Review denied traffic and anomalies instead of broadly opening the network.
Standards and reading
References checked on .
Relevant ISO standards
- ISO/IEC 27001:2022 (+ Amd 1:2024)
Connect security decisions to risk.
- ISO/IEC 27002:2022
Select network protection measures.
These standards help define scope and expected evidence. Citing them does not certify Salott-IT or establish your project’s conformity. A dedicated assessment is required. Include applicable amendments when scoping the engagement.
Technical documentation
Reference books
- Computer Networking: A Top-Down Approach · 9th edition
James F. Kurose & Keith Ross · Pearson · 2025
- Security Engineering · 3rd edition
Ross Anderson · Wiley · 2020
Original synthesis based on official summaries, open documentation and publishers’ public descriptions or contents. Books are selected references, not a universal ranking. Copyrighted book and standards text is not reproduced.
Start with your actual situation.
Scope, responsibilities, timing and acceptance criteria will be defined in the proposal.