Labs / cisco security

Network Segmentation: Containing a Compromised Host

beginner EVE-NG / Cisco IOS routers and switches segmentationincident-responsenetwork-security

Scenario

An IoT camera on VLAN 30 is showing signs of compromise (unusual outbound traffic). Security policy says: contain it immediately without physically unplugging it, so the team can still investigate it while it’s isolated from the rest of the network.

Minimal addressing for this AddySec version

VLANNetworkNotes
VLAN 30 (IoT)192.168.30.0/24Contains the suspect camera, 192.168.30.15
VLAN 10 (Finance)192.168.10.0/24Must not be reachable from IoT
Investigator PC192.168.99.10Must still be able to reach the camera for analysis

Step 1 — Confirm the current exposure

Camera# ping 192.168.10.50

This succeeds today — the compromised camera can freely reach Finance, which is the risk you need to shut down immediately.

Step 2 — Build a containment ACL

Deny the IoT VLAN from reaching every other internal network, but explicitly allow the investigator’s PC in so the team can still work.

R1(config)# ip access-list extended CONTAIN-IOT
R1(config-ext-nacl)# permit ip any host 192.168.99.10
R1(config-ext-nacl)# deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
R1(config-ext-nacl)# deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
R1(config-ext-nacl)# permit ip any any

Step 3 — Apply containment on the IoT VLAN interface

R1(config)# interface vlan 30
R1(config-if)# ip access-group CONTAIN-IOT in

Step 4 — Verify containment and investigator access

Camera# ping 192.168.10.50
Camera# ping 192.168.99.10

The first ping should now fail (Finance is unreachable); the second should still succeed (the investigator can still reach the camera to analyse it).

Step 5 — Confirm in the logs

R1# show access-lists CONTAIN-IOT

The match counters on the deny lines increasing confirm the containment is actively blocking real attempted traffic, not just sitting unused — this is the kind of evidence referenced in Security Logging and Monitoring.

Break it

Apply the ACL out instead of in on the VLAN 30 interface and retest. Notice containment doesn’t fully work as expected — direction matters, and this is one of the most common real-world ACL placement mistakes.

Reference

  • AddySec original content — written for the Network Security track, building on Network Segmentation as a Security Control and A Troubleshooting Mindset for Network Security.