Microsegmentation in Data Centers: Trends and Implementation in 2019

December, 2019 • 7 min read

As data center environments evolve, the need for granular control over east-west traffic grows. In 2019, microsegmentation emerges as a cornerstone of data center security, offering organizations a method to contain threats, enforce policy, and gain visibility across virtualized and hybrid infrastructures.

Understanding Microsegmentation

Microsegmentation refers to the practice of creating secure zones in data centers and cloud environments to isolate workloads from one another and define security controls down to the workload level. Unlike traditional segmentation that operates at a VLAN or subnet level, microsegmentation works at the application and VM level.

Drivers of Microsegmentation in 2019

Several trends have driven interest and adoption:

• East-West Traffic Growth: Lateral traffic in data centers now vastly exceeds north-south traffic, and legacy firewalls can't efficiently monitor this.
• Zero Trust Architectures: The need to verify and authenticate traffic inside the network aligns with microsegmentation’s enforcement capabilities.
• Virtualization and Hybrid Cloud: Workloads move dynamically across environments, and static controls are no longer sufficient.
• Compliance Requirements: Regulations like PCI-DSS and HIPAA require strong internal data isolation and auditing.

Approaches to Microsegmentation

Organizations in 2019 typically adopt one of the following:

• Agent-based: Deploy agents on workloads to enforce policies regardless of network topology.
• Hypervisor-integrated: Solutions like VMware NSX leverage the hypervisor for granular flow control.
• Overlay-based: Use overlay networks with integrated policy engines to manage segmentation independently of physical infrastructure.
• Network-based: Leverage next-gen firewalls or SDN to apply policies at the network layer.

Use Cases and Benefits

Effective microsegmentation helps in several ways:

• Application Isolation: Prevent unauthorized access between services.
• Threat Containment: Stop lateral movement of threats like ransomware.
• Policy Enforcement: Centrally define and enforce rules based on workload identity.
• Visibility: Gain insights into traffic flows and application behavior.

Challenges and Pitfalls

Despite the benefits, challenges remain:

• Operational Overhead: Implementing and maintaining policies requires effort and visibility.
• Policy Complexity: With fine-grained rules, mistakes or gaps can create outages or blind spots.
• Integration: Aligning microsegmentation with existing tooling and infrastructure can be complex.

Market and Vendor Landscape

In 2019, several key players shape the microsegmentation market:

• VMware NSX: Broad adoption in virtualized data centers with integrated firewall capabilities.
• Illumio: Agent-based solution focusing on adaptive segmentation and visualization.
• Cisco Tetration: Focuses on telemetry and policy enforcement across hybrid environments.
• Guardicore Centra: Provides visibility and segmentation for both on-prem and cloud environments.

Strategic Considerations

Before implementation, organizations should:

• Map application dependencies and flows.
• Start with a visibility phase using monitoring tools.
• Pilot segmentation in a test environment or with low-risk apps.
• Define operational ownership between security and infrastructure teams.

Conclusion

Microsegmentation in 2019 offers a practical path to Zero Trust and improved security posture. With virtualization and hybrid models becoming the norm, traditional perimeter models fall short. Microsegmentation enables organizations to defend from within and enforce meaningful, workload-centric policies that align with today’s dynamic environments.

Eduardo Wnorowski is a network infrastructure consultant and Director.
With over 24 years of experience in IT and consulting, he helps organizations maintain stable and secure environments through proactive auditing, optimization, and strategic guidance.
LinkedIn Profile

Understanding Route Maps in Cisco IOS: Policy Control in Action

June 2012   |   9 min read

In Cisco IOS, route maps serve as a highly flexible tool for defining conditional routing and policy enforcement. They are widely used in policy-based routing (PBR), redistribution, filtering, and advanced BGP/OSPF manipulations. This post dives into their syntax, structure, and best practices.

What is a Route Map?

A route map is essentially a conditional if-then construct for modifying or filtering routes. Each route map comprises multiple numbered entries called clauses. These are evaluated sequentially until a match occurs, making the order of entries critical.

Route Map Use Cases

• Policy-Based Routing (PBR): Forwarding decisions based on source IP or packet attributes, not just destination.
• Redistribution Control: Manipulating which routes are injected between protocols (e.g., OSPF to BGP).
• Prefix Filtering: Allow or deny based on prefix-lists or access-lists.
• Attribute Manipulation: Changing BGP metrics (MED, weight, local preference).

Route Map Syntax Overview

route-map <name> permit|deny <sequence>
  match ...
  set ...
  

Each clause contains match statements (criteria) and set statements (actions). If no match is made, the next clause is evaluated. If no clauses match, the route is denied by default.

Policy-Based Routing Example

access-list 101 permit ip 192.168.10.0 0.0.0.255 any

route-map PBR permit 10
  match ip address 101
  set ip next-hop 10.1.1.1

interface FastEthernet0/0
  ip policy route-map PBR
  

This configuration routes traffic from 192.168.10.0/24 to next-hop 10.1.1.1 regardless of the routing table.

Controlling Redistribution

Let’s look at filtering route redistribution into OSPF:

route-map REDIST deny 10
  match ip address 10

route-map REDIST permit 20

router ospf 1
  redistribute eigrp 100 route-map REDIST
  

This example denies redistribution of certain prefixes while allowing all others.

Match and Set Commands

Some of the most common match commands:

• match ip address
• match interface
• match metric
• match route-type

Useful set commands include:

• set ip next-hop
• set metric
• set local-preference
• set weight

Best Practices

• Use sequence numbers in increments (e.g., 10, 20, 30) for flexibility.
• Test route-map logic with show route-map and debug ip policy.
• Document the logic inside config with comments.
• Combine with prefix-lists for efficient and readable filtering.

Verifying Route Maps

Verification tools:

• show route-map
• show ip policy
• show ip bgp or ospf database
• debug ip policy (use with care)

Conclusion

Route maps are foundational tools in Cisco IOS. Whether directing traffic with PBR or shaping protocol behavior, mastering route-map logic will elevate your capabilities in enterprise network design and troubleshooting.

Eduardo Wnorowski is a network infrastructure consultant and technologist.
With over 17 years of experience in IT and consulting, he brings deep expertise in networking, security, infrastructure, and transformation.
Connect on Linkedin