Advanced network segmentation on Cisco switches: VLANs, VRF, 802.1X and TrustSec

Cybersecurity Published 11 min read

Dividing a network into zones is one of the most effective ways to stop an attack on one computer from turning into an attack on the whole organisation. Cisco Catalyst switches can do much more than just separate VLANs. We show how we combine VRF, layer 2 protection, 802.1X authentication and TrustSec with a firewall, and how to roll it out without stopping work.

Key points

  • Zones are the foundation: management, servers, users, printers, guests. Traffic between zones should pass through the firewall, not be routed on a switch.
  • VRF-lite on Catalyst 9000 switches separates the routing tables of the zones, so the network core cannot connect them behind the firewall's back.
  • Layer 2 protection (DHCP snooping, Dynamic ARP Inspection, IP Source Guard) stops spoofing of the DHCP server and the gateway. Private VLANs isolate devices from each other within the same zone.
  • 802.1X and MAB with Cisco ISE place a device in a zone based on its identity, not the wall socket. TrustSec lets you divide traffic within a zone as well.
  • Licences matter: segmentation features (VRF, TrustSec) on the Catalyst 9300 require Network Advantage. The Catalyst 2960-X loses support on 31 October 2027.

Zones and the role of the firewall

We start by dividing the network into a few zones with different levels of trust. A typical set in a public office or company is management, servers, users, printers, a training room and guests. We show an example from one of our projects on our Network security page.

The key design decision: traffic between zones goes through the firewall. Only there can you enforce policies, log who connects to whom and use security inspection. Cisco's Zero Trust architecture guide also names the firewall as the typical enforcement point between zones. The switches make sure a device lands in the right zone and cannot impersonate anyone.

In smaller networks the firewall itself is the gateway for every zone, and the switches work at layer 2 only. In larger networks with a layer 3 core, where some traffic within a zone should be routed locally, VRF comes in.

VRF-lite: the core cannot bypass the firewall

A classic mistake in networks with a layer 3 core switch: the VLAN interfaces of every zone sit on one switch, which routes between them directly. The firewall then sees only internet traffic, and zone boundaries exist only on paper or in ACLs that nobody maintains.

VRF-lite splits the switch into several independent routing tables. Each zone gets its own VRF, and the only way out of it is a default route to the firewall. The switch physically has no route to another zone, so it cannot bypass the firewall even through a configuration mistake.

ip routing
!
vrf definition USERS
 rd 65000:20
 address-family ipv4
 exit-address-family
!
interface Vlan20
 description Users
 vrf forwarding USERS
 ip address 10.20.0.1 255.255.255.0
!
! transit VLAN to the firewall in the same VRF
interface Vlan920
 vrf forwarding USERS
 ip address 10.255.20.2 255.255.255.252
!
! the only way out of the zone is through the firewall
ip route vrf USERS 0.0.0.0 0.0.0.0 10.255.20.1
!
show ip route vrf USERS

A layer 3 interface can belong to only one VRF, and all VRFs share the switch's TCAM. On the firewall side, each transit VLAN is a separate interface with its own zone and policies.

Check licences before the design

According to the Catalyst 9300 data sheet, segmentation features (VRF, TrustSec, SGT) belong to the Network Advantage licence. Private VLANs and SXP are in Network Essentials. The smaller Catalyst 9200 supports a limited number of virtual networks, and the 9200L only one.

Layer 2 protection

VLANs on their own do not protect against attacks within a zone: a rogue DHCP server, gateway spoofing (ARP spoofing) or a stolen IP address. Catalyst switches have three mechanisms for this that work together:

  • DHCP snooping lets DHCP replies through only from trusted ports (links towards the DHCP server or firewall) and builds a table of port, MAC address and IP address.
  • Dynamic ARP Inspection checks ARP packets against that table and drops those that impersonate another device.
  • IP Source Guard allows traffic from a port only from the address assigned to that port.
ip dhcp snooping vlan 20,30
ip dhcp snooping
ip arp inspection vlan 20,30
ip arp inspection validate src-mac dst-mac ip
!
interface TenGigabitEthernet1/1/1
 description Uplink to firewall
 ip dhcp snooping trust
 ip arp inspection trust
!
interface range GigabitEthernet1/0/1-48
 ip dhcp snooping limit rate 10
 ip verify source
 storm-control broadcast level 1.00
 storm-control action trap

A few pitfalls from practice. Dynamic ARP Inspection allows 15 ARP packets per second on an untrusted port by default and err-disables the port when the limit is exceeded, so uplinks must be trusted. IP Source Guard needs DHCP snooping enabled on the VLAN, and devices with static addresses (printers, cameras) need static bindings or DHCP reservations. On IOS XE, enabling DHCP snooping automatically starts device tracking (SISF), which 802.1X also relies on.

Private VLANs: isolation within a zone

In a guest, printer or camera zone, devices have no reason to talk to each other, only to the gateway. Private VLANs (PVLANs) enforce that: ports in an isolated VLAN see only the promiscuous port, usually the link to the firewall, and not each other, even though they share a subnet.

vtp mode transparent
!
vlan 501
 private-vlan isolated
vlan 40
 private-vlan primary
 private-vlan association 501
!
interface GigabitEthernet1/0/22
 description Printer
 switchport mode private-vlan host
 switchport private-vlan host-association 40 501
!
interface GigabitEthernet1/0/48
 description Firewall
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 40 add 501

Restrictions according to Cisco's documentation: a VLAN interface only for the primary VLAN, PVLAN ports cannot be EtherChannel members, and on host ports 802.1X is not combined with port security, a voice VLAN or per-user ACLs. On older Catalyst 2960-X switches, PVLAN support depends on the software version.

802.1X and MAB: the zone depends on identity, not the socket

Without authentication, the zone is decided by the socket: anyone who plugs a laptop into a port in the meeting room lands in the user network. With 802.1X the switch asks a RADIUS server (most often Cisco ISE) who is connecting and only then assigns a VLAN, an ACL or a group. Computers authenticate with a certificate, and devices without 802.1X support, such as printers or phones, by MAC address (MAB), ideally backed by profiling in ISE.

aaa new-model
radius server ISE1
 address ipv4 10.99.0.10 auth-port 1812 acct-port 1813
 key SharedSecret
aaa group server radius ISE
 server name ISE1
aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa server radius dynamic-author
 client 10.99.0.10 server-key SharedSecret
radius-server vsa send authentication
dot1x system-auth-control
!
interface GigabitEthernet1/0/10
 switchport mode access
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator

The example uses the classic syntax. The newer IBNS 2.0 model describes port behaviour with policies (policy-map type control subscriber). The authentication display new-style command shows what the configuration would look like after conversion, while authentication convert-to new-style converts it permanently and cannot be undone. Set the RADIUS ports explicitly, because the IOS XE documentation gives different defaults in different places.

ISE licences: the Essentials tier covers 802.1X, MAB, web authentication and guest access. Device profiling and TrustSec require the Advantage tier, and every device that ISE assigns an SGT to consumes an Advantage licence.

TrustSec: segmentation within a zone

VLANs and VRFs divide the network by address. TrustSec divides it by group: at authentication ISE gives a device a Security Group Tag (SGT), for example "Finance" or "Cameras", and the switch enforces rules between groups with SGACLs. This way, within a single user zone, you can stop HR computers from reaching a server that only finance uses, without splitting subnets.

! enforce policy for routed traffic and on selected VLANs
cts role-based enforcement
cts role-based enforcement vlan-list 20,30
!
! example: group 20 may reach group 50 only over HTTPS
ip access-list role-based HTTPS_ONLY
 10 permit tcp dst eq 443
cts role-based permissions from 20 to 50 HTTPS_ONLY

In practice the policy matrix between groups is maintained centrally in ISE, and switches download it. Devices that cannot carry tags in frames exchange address-to-group mappings over SXP. The Catalyst 2960-X supports SXP only, so policy is enforced on a switch further up. TrustSec makes sense in larger networks with ISE. In smaller ones, zones, a firewall and private VLANs are usually enough.

The management zone and access to switches

Segmentation is pointless if every computer on the network can log in to a switch. The management interfaces of switches, firewalls, storage arrays and servers go into a separate zone, reachable only from administrators' workstations. On the switch itself we restrict SSH access:

ip access-list standard ADMINS
 10 permit 10.99.10.0 0.0.0.255
!
line vty 0 15
 access-class ADMINS in vrf-also
 transport input ssh
 exec-timeout 10 0
!
ip ssh version 2
no ip http server
no ip http secure-server

Without vrf-also, sessions arriving from a VRF (for example a separate management VRF) are refused. Without ip ssh version 2, IOS XE also accepts the obsolete SSH version 1. In IOS XE 26.1.1 Cisco blocks insecure configuration commands by default, and earlier versions from 17.18.2 warn about them (show system insecure configuration).

Rolling out without downtime

We segment a live network in stages, so that no working day starts with users cut off from their systems:

  1. InventoryDevices and flows: MAC and ARP tables, CDP and LLDP neighbours, firewall logs. This turns up devices nobody remembered and connections nobody expected.
  2. DesignZones, addressing, VRFs, a matrix of allowed connections between zones and a plan for moving devices.
  3. Rules in observation modeNew firewall policies first allow and log traffic. After a few days it is clear what is needed, and we tighten the rules based on data.
  4. Moving zonesVLAN by VLAN, in maintenance windows, with a rollback plan ready.
  5. 802.1X in stagesFirst monitor mode, in which nobody loses access while we see the authentication results. Then low-impact mode, and finally closed mode.
  6. Documentation and reviewA zone diagram, a connection matrix and configurations in a repository, with rules reviewed every quarter.

It is also a good moment to review the hardware. The Catalyst 2960-X and 2960-XR are supported until 31 October 2027, and the copper Catalyst 3850 models lost support on 31 October 2025. Cisco names the Catalyst 9200L and Catalyst 9300 as their respective successors. For the Catalyst 9000 family, Cisco recommended IOS XE 17.18.4 and 17.15.6 as of September 2026.

  • A list of zones describing what belongs in each and its default rule.
  • Traffic between zones only through the firewall, with no routing between them on switches.
  • DHCP snooping, Dynamic ARP Inspection and IP Source Guard in user zones.
  • Private VLANs for guests, printers and cameras.
  • Device management reachable only from the administrators' zone, over SSH version 2.
  • A plan to replace switches that are out of vendor support.
  • Switch and ISE licences checked before the design.

Frequently asked questions

Are VLANs alone enough to segment a network?

No. VLANs separate broadcast traffic, but if a switch routes between them without restrictions, every computer can still reach every server. Segmentation only starts when traffic between VLANs is controlled by a firewall or by strictly maintained rules.

Won't routing traffic through the firewall slow the network down?

The firewall needs throughput that matches the traffic between zones. We design the largest flows, such as backups between servers and storage, to stay within one zone. For typical user-to-server traffic, a properly sized firewall is not a bottleneck.

Do we need Cisco ISE for segmentation?

Not for basic segmentation: zones, a firewall and layer 2 protection are enough. ISE is needed to place devices in zones dynamically through 802.1X, for profiling and for TrustSec. Simple 802.1X with VLAN assignment can also be done with NPS on Windows Server.

What about Catalyst 2960-X switches?

They are supported until 31 October 2027. They support DHCP snooping, Dynamic ARP Inspection and 802.1X, and in newer software versions also private VLANs. TrustSec only as far as SXP. You can roll out segmentation now and plan the move to Catalyst 9200L before support ends.

Does NIS2 require network segmentation?

The rules do not mention VLANs as such, but they require technical measures proportionate to risk, including access control. Dividing a network into zones is one of the first measures auditors ask about. We cover the Polish deadlines and obligations in our guide NIS2 and the Polish KSC Act.

Sources

As of 6 November 2026. The configuration examples are simplified; adjust addresses, VLAN numbers and names to your own network, and check the syntax for your software version.

Cybersecurity: all guides

Is your whole network a single zone?

We will take an inventory, design the zones and roll out segmentation in stages, without stopping the office or company.

Let's talk about your network