The printer was on the same Layer 2 segment as the domain controllers. Default admin password, firmware from 2016, web UI reachable from every workstation in the building. When the incident response team pulled the ip neigh table off the core switch, the "oh no" moment wasn't a single compromised host — it was 340 devices in one broadcast domain, all of them one ARP spoof away from talking to each other. The attacker didn't need a zero-day. They needed the printer, and the printer was already inside the perimeter.
This guide is for the sysadmin or network engineer who inherited a flat 192.168.1.0/24 and a prayer, and now has to explain to leadership why segmentation is not optional. By the end, you'll have a four-zone model you can actually deploy, a VLAN numbering schema that survives a staff turnover, and the firewall and switch configs to enforce it. I've done this migration in regulated environments and in shops that had exactly one switch and no budget. Both are solvable.
The flat network is a liability, not a convenience. Every device can ARP-spoof every other device. Every broadcast is a blast radius. Ransomware crews know this — lateral movement across a flat L2 is the easiest part of their playbook, and Mirai-style IoT botnets have been turning cameras and DVRs into pivot points since 2016. Segmentation is the cheapest lateral-movement control you're not using.
:::note[TL;DR]
- Four zones cover 95% of orgs: Management, Servers, Clients, IoT/Untrusted. More zones mean firewall rule sprawl and troubleshooting hell.
- Every inter-zone flow goes through a firewall. L3 switch routing is fine within a zone, never between zones.
- Management VLAN holds switch mgmt, IPMI, iDRAC, iLO, and PDUs — reachable only from a jump host.
- IoT is hostile. Treat it like the internet: internet egress allowed, RFC1918 denied, log everything. :::
Prerequisites
Before you touch a switch, have the following ready:
- IPAM tool — NetBox, phpIPAM, or even a disciplined spreadsheet. You need a source of truth before you create VLAN 20.
- A firewall that can route — pfSense/OPNsense, Palo Alto, Fortinet, or an L3 switch with ACLs if that's all you have.
- Console access to your switches — you will lock yourself out at least once. Have the console cable and the serial adapter.
- A maintenance window — yes, even for "just adding a VLAN." You are changing the default gateway for devices.
-
Inventory of every device with its current IP, MAC, and what it talks to.
nmap -snandarp -aare your friends here.
Why Flat Networks Keep Getting People Fired
The 192.168.1.0/24 that "just works" works right up until it doesn't. A single broadcast domain means every device can reach every other device at Layer 2 — no firewall, no ACL, no logging, no policy. When the incident response team asks "how did the attacker move from the HVAC controller to the file server," the answer is "they were on the same VLAN."
The war story I keep coming back to: a mid-sized manufacturer had a networked label printer on the same segment as their ERP servers. The printer's web interface had a default credential that nobody changed because "it's just a printer." An attacker used it as a foothold, dumped the ARP table, and had a map of every internal host within minutes. The printer was the entry point; the flat network was the multiplier.
⚠️ TRUNCATED VERSION
This is an abbreviated cross-post. Full article (all config files, architecture diagrams, images): valtersit.com
🛠️ Partner Tools for Developers
ValtersIT curates partner deals for developers and sysadmins — VPS hosting, security tools, monitoring platforms and dev productivity gear. No filler, no affiliate spam.
Top comments (0)