Network architecture and segmentation
Review traffic paths, trust boundaries and failure behaviour, then design network segmentation that can be implemented, supported and rolled back.
What we review
- Current-state topology and traffic paths: Layer 2 and Layer 3 boundaries, routing domains, Internet and WAN paths, NAT, shared services, remote access and management connectivity.
- Trust zones and segmentation policy: User, server, management, guest, partner, development, production, backup, operational technology and other boundaries relevant to the environment.
- Application dependency mapping: Required flows, direction, protocols, DNS and identity dependencies, external services and operational access.
- Cloud and hybrid connectivity: Virtual networks, transit design, private connectivity, VPN, route exchange, egress, security insertion and overlapping address space.
- High availability and failure behaviour: Device, circuit and path redundancy; convergence assumptions; asymmetric routing; stateful failover; and the effect of component loss.
- Migration and change sequencing: Intermediate states, dependency order, maintenance windows, coexistence, success checks and executable rollback.
- Operational visibility: Flow evidence, routing and interface monitoring, configuration records, logging, ownership and troubleshooting access.
Deliverables
- Current-state architecture: Validated diagrams and notes covering relevant devices, paths, zones, routing, shared services and known uncertainty.
- Trust and traffic model: A record of which systems may communicate, why the access exists, where it is enforced and who owns exceptions.
- Target-state design: Architecture diagrams, design decisions, addressing or routing considerations, enforcement points and availability assumptions.
- Dependency and risk register: Services, technical constraints, single points of failure, unresolved flows and decisions that must be made before change.
- Migration plan: Ordered stages, prerequisites, change boundaries, validation checks, hold points and rollback criteria.
- Operational handoff: Troubleshooting paths, monitoring needs, expected failure behaviour and records the support team will need after implementation.
Engagement boundaries
- Architecture work states assumptions and design constraints. Performance, compatibility and failure behaviour still need validation against the selected platforms and the production environment.
- Included: Review or design of the network areas agreed during scoping.
- Included: Explicit dependencies, assumptions and unresolved decisions.
- Included: Change and rollback planning where a migration is in scope.
- Included: Collaboration with application, cloud, security and operations owners.
- Not included: Application redesign, carrier construction, structured cabling or wireless surveys unless specifically added.
- Not included: Procurement commitments, vendor selection guarantees or a bill of materials based on unconfirmed requirements.
- Not included: Production configuration changes unless implementation access and change authority are separately agreed.
- Not included: Discovery of traffic that is unavailable in documentation, configuration, logs or an approved observation period.
Questions before the work starts
Can you review a design prepared by our internal team or another supplier?
Yes. The review can focus on assumptions, routing and security boundaries, failure cases, implementation sequencing and operational support. Findings distinguish design concerns from points that simply need confirmation.
Do we need flow data before starting a segmentation project?
Flow data is useful but not always available. Work can begin with configuration, application records and interviews. Where the evidence is weak, the plan can include a defined observation period before policy is enforced.
Can segmentation be introduced without a single large cutover?
Often, yes. A staged approach may create zones, add visibility, move selected services and enforce policy in steps. The available options depend on topology, addressing, routing and the enforcement platforms already in place.
Will the design cover both on-premises and cloud networks?
Yes, when both are in scope. Hybrid work includes the routes, security controls, identity and DNS dependencies that cross the boundary, not only the individual network diagrams.
Can HAI Consulting support the implementation?
Yes. Implementation support can include configuration review, change plans, maintenance-window support and post-change validation. Production roles, approvals and rollback authority are agreed separately from the design.
The platforms this work covers
Segmentation work is designed against the enforcement points already in the environment, on-premises and in cloud.
- Cisco routing, switching and Firepower
- Palo Alto Networks
- Fortinet FortiGate
- Check Point
- F5 application delivery
- Data centre fabric and east-west traffic
- Azure virtual networks
- AWS VPC
Audits available
- Segmentation audit: whether stated trust boundaries are actually enforced, and where traffic crosses them unexpectedly.
Other ways we can help
Engagements are often scoped together; these are the closest neighbours to this one.
Working through a segmentation, migration or routing decision?
Share the environment, the services involved and the change you are considering. Include any fixed deadline, outage constraint or design material already available.