Skip to main content
Version: 0.7.0

Network segment

Definition​

A network segment is a significant connectivity and policy zone that groups resources with the same access rules.

Boundaries​

A segment need not match a VLAN or subnet. It represents a boundary meaningful to an architecture decision: public zone, internal zone, data perimeter, cloud VPC, or trusted partner zone.

Minimum characteristics​

  • purpose;
  • trust level or security class;
  • scope or location;
  • network-policy owner;
  • state.

Relationships​

A compute resource connects to a segment. Connectivity between segments may be refined by a policy or allowed flow, but it does not replace an integration, which carries application meaning.

Example​

NET-PROD-INTERNAL is an internal production zone not directly accessible from the public network.

Common mistakes​

  • importing a full network inventory without an architecture purpose;
  • treating a network connection as an application integration;
  • using a location or data center as a segment without a network policy.