How Do the Segments Connect?

About this interactive

Segment the network and do nothing else, and the segments cannot reach each other. That may be exactly what you want, but usually some traffic has to cross, or reach the internet. Crossing between networks takes a layer 3 device: a router, a firewall or a layer 3 switch, with an interface in each network. Once it is in place, though, it routes everything. Splitting the broadcast domains removed some layer 2 risks, but the two networks can still reach each other freely, and a firewall whose only rule permits any source to any destination is no different. Security comes from controlling that traffic: an access control list on the router or layer 3 switch, or the rules on a firewall, permitting what is acceptable and denying the rest. So for any two segments ask two questions. Is anything routing between them? If so, is anything filtering what it routes?

What you'll learn

Decide from what joins two segments whether they cannot reach each other (nothing at layer 3 joins them), reach each other freely (a router or layer 3 device with no filtering), or reach each other only as access control lists or firewall rules allow
Explain why a router alone is not security: dividing broadcast domains removes some risks, but traffic between the networks stays free until an ACL or firewall controls it

Aligned to

CompTIA Security+

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Router: A network device that forwards data packets between networks based on IP addresses.
Layer 3 Switch: A network switch that performs routing functions at Layer 3 in addition to standard Layer 2 switching, enabling inter-VLAN and inter-segment communication.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Broadcast Domain: A network segment in which a broadcast sent by one device is received by all other devices within that segment; routers define the boundaries of broadcast domains by not forwarding broadcast traffic.

Topics

Router Layer 3 Switch Access Control List Firewall Network Segmentation Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →