Experience/feedback with VLAN insertion design for East-West traffic segregation

[PratheeshP]

Experience/feedback with VLAN insertion design for East-West traffic segregation

We are planning to leverage the VLAN insertion design for achieving micro segmentation in out OT network. 

just thought of checking within the Live community team for any feedback, caveats  based on your experience with similar implemetation. Thank you.

https://www.paloaltonetworks.com/resources/whitepapers/applying-vlan-insertion-in-ics-scada 

[OtakarKlier]

Hello,

On some devices, I started with something like the following:

Source Zone: trust, Source User: AD group that has access, Destination, Zone and IP address of scada/device, enable threat prevention and disable url filtering.

With this I can limit the traffic to those who have access and then watch and see what applications if any are being discovered, then tune from there.

The other thing I have seen is that some PAN models is that the amount of zones is limited. So I created a zone called something like IOT, and then set policies of source and destination IP's/subnets. Since I have a DENY ALL policy as my last rule, the intra zone traffic is blocked. 

Hope that helps a bit.

[PratheeshP]

thank you for your reply. I agree with your comment on the Zone dependency per FW hardware.

Based on your experience, any comment on the below items:

• What will be the SVI for VLAN for Layer 3 communication to outside segments?
  • I am planning to configure all my OT systems in the current segment to a dedicated VLAN per connected port, trunked to FW (VLAN insertion). Not sure how the SVI Gateway (Layer 3) will be required on the FW?
• How broadcast and multi-cast will be handled?