Companies annually invest enormous budgets in strengthening the IT perimeter by deploying firewalls and intrusion detection systems. Today, however, these measures no longer serve as a guarantee of security. Attack vectors have shifted: hackers increasingly cause damage from inside networks, moving between servers and seizing critical data. A viable solution lies in protecting the network at the virtualization layer.
The Danger Inside the Network
One problem with traditional networks is that virtual machines inside the same L2 domain are not isolated from each other. From a security perspective, this resembles an apartment building with poor sound insulation. Any resident can overhear neighbors, while unauthorized visitors can freely move between floors and test door locks. For virtual machines holding critical data, this creates risks of traffic interception. For an attacker who has gained a foothold, it provides ideal conditions for scanning neighboring nodes and performing lateral movement to spread malware.
Isolation of objects within a single logical network is also necessary because different applications often have varying security requirements. Some require their own “network safe” — complete isolation to prevent any unauthorized access. This applies not only to controlling access to confidential data but also to protecting the environment from “noisy neighbors,” such as virtual machines that aggressively consume traffic.
Implementing such isolation through classic VLANs and static ACLs on physical switches is practically impossible today. Manually managing thousands of rule lines is too time-consuming and expensive, so security is often sacrificed for faster service deployment.
Why the Traditional Approach Is Insufficient
The traditional network protection model follows the “fortress” principle: network engineers configure powerful perimeter firewalls to block external threats. Yet a firewall cannot control traffic inside the network; it is designed to filter traffic between networks, not within them. Modern web applications consist of hundreds of third-party libraries downloaded from the internet that do not always undergo full audits. If even one such library is compromised, malicious code ends up inside the perimeter.
Modern IT systems rarely operate in complete autonomy. They often involve connections to contractor infrastructure and remote workplace architectures, creating multiple additional entry points without breaching multilayer perimeter defenses. The human factor adds further risk. Without internal controls, security of each virtual machine rests on its administrator, who may disable the OS packet filter during debugging and forget to re-enable it.
Limitations of Firewalls
Placing firewalls in front of every network and every virtual machine is impractical. Two virtual machines in the same VLAN do not require a third network node to communicate, so routing traffic through an inspection point would likely cause significant performance degradation. Firewalls also face throughput limits and can become bottlenecks. Since east-west traffic typically accounts for 80 percent of system traffic, firewalls sized for 20 percent north-south traffic would need to handle four times the volume, leading to increased latency and application degradation.
How Microsegmentation Protects the Network from Within
To achieve the required protection level, the network must be flexible enough to be divided into atomic isolated segments with individual security policies. This approach is realized through microsegmentation — a technology that, at the SDN level, breaks VLANs into numerous microsegments down to individual virtual machine ports. For each virtual machine or group, administrators can define allowed or denied traffic by ports, IP addresses, and protocols.
SDN technologies virtualize the packet path, effectively emulating a virtual packet filter at the desired segment. Microsegmentation via SDN installs these filters directly at the network port exit of the virtual machine. The key security advantage is complete independence from actions inside the virtual machine itself. The mechanism cannot be disabled because it operates at the virtualization infrastructure level and executes immediately upon traffic leaving the virtual machine’s network interface, enforcing the Zero Trust principle.
Performance remains unaffected because microsegmentation code runs on the most powerful component — the virtualization server. Scaling is natural: as the number of virtual machines grows, so does the number of hypervisors, keeping filtering load within established limits. All permissions and prohibitions are managed centrally and can change flexibly. One oil-and-gas customer using zVirt creates up to 5,000 new microsegmentation rules per week thanks to a mature open REST API. In traditional networks, such dynamics would slow infrastructure; in an SDN environment, it becomes standard practice.
Why Microsegmentation Is Harder to Bypass
In a traditional network, one successful perimeter breach places an attacker in a “trust zone” where they can move freely. Microsegmentation multiplies the difficulty. Even if one segment is compromised, the attacker remains confined. Any attempt to scan ports or map the network is blocked, and every probe against a closed segment is logged, enabling early detection. Separation of the control plane from the data plane ensures that even root access on a virtual machine does not allow modification of access rules stored on the SDN controller and hypervisor.
This makes microsegmentation a resilient foundation for network security. Its presence does not eliminate the need for perimeter firewalls; external and internal protections must complement each other. The combination of traditional security tools and SDN delivers both high security under Zero Trust and automated network management, removing the need to choose between protection and speed.
