Advanced lesson
Prove Your Network Separation Works
Use a small lab to check that guests, cameras and administrators can reach only their intended services.
Reviewed September 2026 · 3 minute read
Name the boundary and who enforces it
A VLAN separates a local broadcast domain. Routing and firewall rules decide which routed traffic crosses a boundary. Traffic on the same VLAN may never pass through the gateway firewall.
- Guest zoneOutside services only.
- Business zoneApproved work applications.
- Camera zoneRecorder and required supporting services.
- Management zoneApproved administrators and controlled device access.
Identify the actual enforcement point: gateway, Layer 3 switch, endpoint or application. Include VPN, cloud relay and local device-management routes in the design.
Use this access matrix before writing rules
| Practice source → destination | Intended result | Verification |
|---|---|---|
| Guest → camera administration | Deny | An authorized test client cannot establish the management session. |
| Camera → recorder | Allow required traffic only | Recording and playback work at the planned load. |
| Camera → business workstation | Deny unneeded sessions | The explicit test is blocked at the intended control. |
| Approved admin → camera | Allow through the management route | Named login works and activity is recorded. |
| Viewer → recording export | Deny unless the export role is assigned | Test in the recorder application; a firewall alone does not set this permission. |
Include necessary DNS, time, update and integration traffic deliberately. Evaluate IPv4 and IPv6. Choose the rule order and stateful return-traffic behavior for the actual platform; do not paste a universal rule list into production.
A timeout can hide a weak test
Worked example
The guest laptop cannot open the camera page
If the camera is offline, that failure does not prove guest isolation. First establish that the approved management route works. Then test the prohibited route and correlate the result with the relevant rule or logging evidence.
A blocked ping is not the same as a blocked web session. Use the actual service that the policy addresses.
Run a controlled policy lab
Use an isolated practice network you are authorized to change. Define five allowed/denied cases, confirm the test endpoints are working, apply one planned change and record the outcomes. Test an attempted same-VLAN path separately. Finish by checking normal recording and business tasks under the expected load.
What belongs in the result record?
Source, destination, service, address family, expected outcome, observed outcome, enforcement point, time and supporting log or capture reference. Keep real client addressing and captures private.
A ten-minute exercise: find the rule that allowed it
The task: guests may use the internet but must not open the camera viewer. An authorized administrator must be able to view it. Work from this fictional record before touching a configuration.
VLAN 30Router + rules
Which rule matches?Camera viewer
VLAN 40Administrator
VLAN 10
- Confirm the viewer works from the approved administrator device. Record the exact service and destination.
- Test the same service from the guest device. Read the log below.
- Explain which rule needs review, what change you would propose and how you would roll it back.
- In an authorized lab, retest permitted and prohibited paths after the approved change. Include IPv6 if it is in use.
| Source | Result | Matched rule |
|---|---|---|
| Admin 10.10.0.25 | Viewer opens | 10: allow admin to camera viewer |
| Guest 10.30.0.25 | Viewer opens | 20: allow internal networks |
| Guest 10.30.0.25 | Internet works | 40: allow guest internet |
Compare your diagnosis with the worked answer
The broad internal rule permits the guest’s camera connection. A VLAN label did not enforce the restriction. Review rule ordering and scope on the actual platform; propose a guest-to-camera restriction that preserves the approved administrator path and required guest services. A successful recheck would show guest viewing blocked, administrator viewing working and guest internet working, with the expected rule/log evidence.
If the guest test times out while the viewer is offline, the result is inconclusive. Restore a working baseline and repeat. Do not treat a ping-only test as proof of TCP 443 behavior.
Use the downloadable lab and completed example to record the proposed change, approval, rollback and test evidence.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- Check the permitted route and the rule that matched that traffic.
Separate network names and VLANs do not prove routed access is blocked. Inspect the actual path and matched rule.
- No. Bring up a known working target, then compare allowed and prohibited paths.
A failed destination makes a timeout inconclusive. Establish a working baseline before judging the boundary.
- Test required services over both protocols and check any alternate access path.
The policy must cover the protocols and access paths the site actually uses.
Sources and further reading
- Axis: AXIS OS hardening guide
A detailed vendor example of device hardening, restricted services and network separation. Apply the exact guidance for the equipment and supported software in use.
- Ubiquiti: creating virtual networks
Use this for current UniFi implementation details after making the address and access plan.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share the site, the requirement and the next step with our team.