Vendor Independent Network Segmentation#

Brian Jemes – University of Idaho

• Why: Network segmentation designs usually collapse under vendor churn or rule-count growth; this is a concrete, numbers-backed architecture that survived six major vendor changes in 20 years — directly relevant to the PM's network-security interest.
• What: Subnet-level segmentation at the University of Idaho: 425 policy-enforced subnets (110 service-consumer, 190 service-provider, 120 behind the border), 230 router-ACL interfaces, 195 NGFW-interfaces carrying 840 rules, 10 router VRFs, 6 firewall virtual instances. The key policy insight is that provider subnets get "standalone" O(n) policies (inbound default-deny exposing only the services offered, outbound default-allow) referenced by subnet groups, avoiding O(n²) mesh rules.
• How: Consumers sorted into subnets via RADIUS-assigned VLANs (802.1X/MAB) from IdP user/device groups; dedicated VRF per consumer group with router ACLs blocking east-west; per-group virtual NGFWs; uRPF on every subnet; L2 ACLs for same-subnet traffic. Hard-won lessons: VRF-lite doesn't scale past ~3 VRFs, PBR isn't operationally scalable, DHCP relay in firewalls silently drops at enterprise scale, aggregate the address plan by type before geography, and use hub-spoke virtual cloud architecture because clouds aren't structured for subnet segmentation.
• Where applicable: Mid-size enterprise (12k students, ~70k WiFi endpoints, ~800 switches) but the pattern is deliberately vendor-independent and generalizes. The tradeoff is explicit: middleboxes in all internal traffic flows complicate intranet routing and troubleshooting; app-layer authn/authz is out of scope.