Microsegmentation: the practical guide that doesn't break apps

Microsegmentation fails when teams skip discovery. The first 30 days of observation matter more than the firewall you pick.

Discovery

• Map flows for 30 days before any block.
• Tag workloads by app, env, owner.

Policy model

• Default deny inside the data center.
• Allow per-service, not per-IP.

Enforcement

• Hypervisor (NSX), agent (Illumio, Guardicore) or fabric (EVPN GBP).

Rollout

• Detect mode → alert mode → enforce mode per app.
• Roll back fast if business-impacting.

Operations

• Owner reviews quarterly.
• Auto-generate policy from CMDB to avoid drift.

Train segmentation reasoning in a TechLeague tournament.