Goodbye VLANs! Zero Trust Identity-Based Segmentation Explained

Transcript:

Segmentation in most campus networks is still tied to VLANs subnets and NAC workflows as users move between wired and Wi-Fi networks or as device appears across different sites. Maintaining consistent policy becomes operationally complex. IT teams often rely on VLAN steering reauthentication workflows or manually manual policy updates to maintain segmentation which introduces policy drift and troubleshooting overhead.

Nile approaches segmentation differently. The zero trust fabric enforces policy based on identity and device context not network location.

Access decisions are applied per flow by the fabric so users and devices retain the correct security posture regardless of how or where they connect. In this demo, I'll show two outcomes.

First, identity based segmentation that follows a user across wired and Wi-Fi networks without relying on VLAN changes.

Second, agentless device classification with automated quarantine where unknown or non-compliant devices are isolated through policy rather than disruptive network changes.

Here's a finance policy group. Membership is driven by IDP.

Now I'll open John's security details to confirm he's classified into the finance group based on identity.

As seen here, he is mapped to the finance policy group. If I click on the details for John, you can see John is connected on the wired and he's authenticated via SSO.

Now, the policy matrix, a single view of segmentation intent across user, device, and application groups. For finance, you can see what's allowed and denied.

Finance can reach finance apps and the internet but cannot reach engineering apps. Also note the baseline. No implicit allow access requires an explicit policy.

Now John reconnects over Wi-Fi on a different subnet and gets a new IP.

Even with this new IP, John stays in finance because policy is identity and device context space, not tied to a to the VLAN or subnet.

As seen here, John is now connected to the employee SSOS SSID and he is authenticated via SSO.

Now we'll switch to a device example.

Here's a speaker policy group based on agentless fingerprinting. Device validation is enabled. This demo uses HTTPS with an ex expected corporate credential.

A rogue speaker is plugged in and because it fails HTTPS credential check, it appears in the quarantine policy group even though the fingerprint for this device matches.

In Nile solution, quarantine is deterministic and policy based. There's no VLAN change, no subnet move, no IP reing and no reauthentication or COA choreography. Same attachment, just a tighter policy posture. In the policy matrix, IT admins can reach quarantine based on the IT admin IDP group and only via approved admin protocols.

Unlike V Mil Vanbased quarantine, Nile's quarantine policy group is not shared pen where bad actors or malware can propagate laterally while Nile zero trust fabric devices in quarantine are isolated from each other eliminating lateral propagation amongst quarantine devices.

After remediation in this case fixing the corporate credential, the device can be revalidated and moved out of quarantine again without disruptive network changes.

To summarize across both scenarios, Nile applies a consistent identity and device aware policy model with perflow verification enforced by fabric without relying on VLAN subnet constructs for security intent.