Overview of Microsegmentation
Definition
Microsegmentation, also called EPG-based secure isolation, groups servers on a data center network based on rules. It applies traffic control policies based on End Point Groups (EPGs) to simplify O&M and implement secure management and control.
Purpose
- Virtual Local Area Network (VLAN) IDs or VXLAN network identifiers (VNIs) can be used to divide subnets for service isolation (for example, isolating services in subnets A and B), but services on servers in the same subnet cannot be isolated. When different subnets share a gateway, servers in these subnets cannot be isolated because the gateway has a route to each subnet.
- ACLs can be configured to isolate servers. However, data center networks contain many servers, and many ACL rules need to be deployed to isolate servers. This complicates configuration and maintenance. In addition, ACL resources of network devices are limited and cannot meet customer requirements.
Microsegmentation addresses the preceding issues. On a VXLAN network, microsegmentation provides grouping rules with finer granularity than subnets. For example, microsegmentation supports IP address-based or IP address segment-based grouping. In addition, microsegmentation is easy to deploy. You only need to add servers on the VXLAN network to EPGs and deploy traffic control policies based on EPGs.
Benefits
Microsegmentation implements service isolation on servers of a VXLAN network and ensures secure management and control for the VXLAN network. The configuration and maintenance are simple, reducing configuration and maintenance costs.