Name: network-segmentation-review
Author: securityskills

Imported from securityskills/skills (network-security/network-segmentation-review/SKILL.md). Install upstream with npx skills add securityskills/skills --skill network-segmentation-review. Copyright stays with the author.

Network Segmentation Review

Verify that intended segmentation boundaries actually hold.

1. Understand the Intended Design

Obtain the network diagram: zones (DMZ, internal, production, corporate, OT), trust levels, intended flows
Map documented allowed flows vs "everything else should be denied"

2. Verify Layer 2/3 Boundaries

VLAN hopping: double-tagging, DTP negotiation on user ports, native VLAN mismatches on trunks
Inter-VLAN routing: which SVIs exist, ACLs between them
Private VLANs / port isolation where host-to-host traffic is unnecessary

3. Firewall and Router Policy

Rulebase review: any-any rules, overly broad source/destination (any→internal), rules by IP instead of objects
Shadowed and unused rules; logging disabled on deny rules
Management access: SSH/admin planes reachable from user segments?

4. Cloud Boundaries

Security groups: per-role groups, no 0.0.0.0/0 ingress on non-web ports
NACLs vs SGs layering; peering/transit gateway route tables leaking broader CIDRs
Egress control: can compromised workload reach arbitrary internet (data exfil path)?

5. Active Validation (authorized testing)

From representative hosts in each zone, attempt connections across boundaries: allowed (should work), denied (should fail and log)
Test both directions and return traffic for stateful devices
Use nmap -PN -sT -p <port> style targeted probes; record device logging the block

Output

A verified flow matrix (source zone × destination zone × port × expected × observed), gaps with device-level evidence, and remediation per boundary.

{ "ocm": "1", "id": "securityskills-skills-network-segmentation-review", "kind": "skill", "name": "network-segmentation-review", "description": "Review network segmentation designs and verify enforcement — VLANs, firewalls, cloud security groups, and zero-trust boundaries. Use when assessing internal network architecture.", "publisher": "securityskills", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Review network segmentation designs and verify enforcement — VLANs, firewalls, cloud security groups, and zero-trust boundaries. Use when assessing internal network architecture." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/securityskills/skills", "path": "network-security/network-segmentation-review/SKILL.md", "ref": "HEAD", "url": "https://github.com/securityskills/skills/blob/HEAD/network-security/network-segmentation-review/SKILL.md", "key": "securityskills/skills/network-security/network-segmentation-review/SKILL.md" } }, "instructions": "# Network Segmentation Review\n\nVerify that intended segmentation boundaries actually hold.\n\n## 1. Understand the Intended Design\n\n- Obtain the network diagram: zones (DMZ, internal, production, corporate, OT), trust levels, intended flows\n- Map documented allowed flows vs \"everything else should be denied\"\n\n## 2. Verify Layer 2/3 Boundaries\n\n- VLAN hopping: double-tagging, DTP negotiation on user ports, native VLAN mismatches on trunks\n- Inter-VLAN routing: which SVIs exist, ACLs between them\n- Private VLANs / port isolation where host-to-host traffic is unnecessary\n\n## 3. Firewall and Router ", "cost": { "context_tokens": 402 } }

network-segmentation-review

About