Network Segmentation Quick Start

Get up and running with Network Segmentation Analysis in just a few steps.

Prerequisites

Before you begin, ensure you have:

• Discovery agents deployed and collecting data
• Discovery schedules configured with IP ranges
• Network connection data being collected from servers

Step 1: Access Network Segmentation

1. Navigate to CMDB in the main menu
2. Click on Network Zones in the submenu
3. The Network Segmentation Analysis dashboard will load

Network Segmentation Analysis dashboard with Sankey diagram view

Step 2: Review Your Zones

The dashboard automatically displays all network zones derived from your discovery schedules:

Column	Description
Zone Name	Auto-generated from discovery schedule
IP Range	The network subnet covered
Agent	Discovery agent managing this zone
Zone Type	Classification (if configured)
Security Level	Priority level (if configured)

Step 3: Configure Zone Types

For each zone, click the Edit button to configure:

1. Zone Type: Select the appropriate classification

   • Production, DMZ, Management, Workstation, IoT, Guest, Development, Staging, Backup

2. Security Level: Set the protection priority

   • Critical, High, Medium, Low

3. Allowed Inbound: Select which zones can connect TO this zone

   • Leave empty to allow all (no violations generated)
   • Select specific zones to enforce strict policies

4. Click Save Configuration

Step 4: View Traffic Analysis

Switch to the Traffic Analysis tab to see:

1. Cross-zone traffic flows visualized
2. Connection counts between zones
3. Ports used for communications
4. Violation status for each flow

Using Filters

• Source Zones: Select one or more zones to filter by origin
• Target Zones: Select one or more zones to filter by destination
• Min Connections: Adjust slider to show only high-volume traffic
• Violations Only: Toggle to focus on policy violations

Choosing Views

• Flow Diagram: Best for presentations and overview
• Matrix View: Best for detailed analysis (recommended)
• List View: Best for quick scanning

Step 5: Investigate Violations

Switch to the Violations tab:

1. Review the list of detected violations
2. Note the severity (High or Medium)
3. Click Investigate on any violation
4. View the IP-by-IP connection details:
   • Source IP addresses
   • Target IP addresses
   • Number of connections
   • Destination ports

Step 6: Take Action

For each violation, decide:

If Traffic is Legitimate

1. Edit the target zone's configuration
2. Add the source zone to Allowed Inbound
3. Save configuration
4. Violation will no longer appear

If Traffic is Unauthorized

1. Document the finding
2. Investigate the source systems
3. Implement firewall rules to block
4. Create an incident ticket if needed

Example Configuration

Securing a Production Database Zone

Zone: Production_Databases
IP Range: 10.160.160.0/24
Zone Type: Production
Security Level: Critical

Allowed Inbound:
  - Application_Servers (10.160.170.0/24)
  - Management_Zone (10.100.0.0/24)

# All other zones will generate violations if they
# attempt to connect to this database zone

Summary Metrics

After configuration, monitor these key metrics:

Metric	Target	Action if Exceeded
Violations	0	Investigate immediately
Cross-Zone Traffic	Expected patterns	Review new flows
Unconfigured Zones	0	Complete zone setup

Next Steps

• Overview - Detailed feature documentation
• Zone Configuration - Advanced zone settings
• Violation Investigation - Deep-dive analysis