[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FFS6QBFPGS6CGVTDRHW40":3,"skill-same:01M71FFS6QBFPGS6CGVTDRHW40":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M71FFS6QBFPGS6CGVTDRHW40","net-security-firewall",null,"Net Security Firewall.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-security-firewall\u002FSKILL.md",[],[19,20,21,22],"security","firewall","net security firewall","cybersecurity","2026-11-10 10:12:30",false,"---\nname: net-security-firewall\ndescription: \"Net Security Firewall.\"\ndomain: cybersecurity\n---\n\n-|\n| **VLAN Segmentation** | Layer 2 | Subnet-level | Department separation, guest isolation |\n| **Firewall Zones** | Layer 3-7 | Zone-to-zone | Inter-zone policy enforcement |\n| **ACLs on Routers** | Layer 3-4 | Subnet\u002Fport | Quick filtering at routing boundaries |\n| **Microsegmentation** | Layer 3-7 | Workload-level | Zero trust, container environments |\n| **SGT\u002FTrustSec** | Layer 2-7 | Tag-based | Identity-based segmentation |\n\n## Workflow\n\n### Step 1: Map Traffic Flows and Define Zones\n\nBefore implementing segmentation, capture baseline traffic:\n\n```bash\n# Capture NetFlow data to understand existing traffic patterns\nnfdump -R \u002Fvar\u002Fcache\u002Fnfdump\u002F -s srcip\u002Fbytes -n 50\n\n# Identify east-west traffic between subnets\nnfdump -R \u002Fvar\u002Fcache\u002Fnfdump\u002F -s record\u002Fbytes \\\n  'src net 10.0.0.0\u002F8 and dst net 10.0.0.0\u002F8' -n 100\n\n# Map application dependencies\n# Document which servers need to communicate with which other servers\n```\n\n### Step 2: Configure VLANs on Switches\n\n```\n! Core switch VLAN configuration\nvlan 10\n name Management\nvlan 20\n name Corporate-Users\nvlan 30\n name Servers\nvlan 40\n name PCI-CDE\nvlan 50\n name Guest\nvlan 60\n name DMZ\nvlan 99\n name Native-Unused\n\n! Trunk port to firewall\ninterface GigabitEthernet1\u002F0\u002F1\n description Trunk-to-Firewall\n switchport trunk encapsulation dot1q\n switchport mode trunk\n switchport trunk allowed vlan 10,20,30,40,50,60\n switchport trunk native vlan 99\n switchport nonegotiate\n\n! Access port for corporate users\ninterface range GigabitEthernet1\u002F0\u002F2-24\n switchport mode access\n switchport access vlan 20\n spanning-tree portfast\n\n! Access port for servers\ninterface range GigabitEthernet1\u002F0\u002F25-36\n switchport mode access\n switchport access vlan 30\n\n! Prevent VLAN hopping\ninterface range GigabitEthernet1\u002F0\u002F37-48\n switchport mode access\n switchport access vlan 99\n shutdown\n```\n\n### Step 3: Configure Firewall Zone Policies\n\n**Palo Alto zone-based policy:**\n\n```\n# Define zones on firewall sub-interfaces\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.10 tag 10 ip 10.0.10.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.20 tag 20 ip 10.0.20.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.30 tag 30 ip 10.0.30.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.40 tag 40 ip 10.0.40.1\u002F24\n\nset zone Management network layer3 ethernet1\u002F1.10\nset zone Corporate network layer3 ethernet1\u002F1.20\nset zone Servers network layer3 ethernet1\u002F1.30\nset zone PCI-CDE network layer3 ethernet1\u002F1.40\n\n# Inter-zone policies (deny by default, explicitly allow)\n\n# Corporate -> Servers (only specific apps)\nset rulebase security rules Corp-to-Servers from Corporate to Servers\nset rulebase security rules Corp-to-Servers application [ web-browsing ssl dns smtp ]\nset rulebase security rules Corp-to-Servers action allow\nset rulebase security rules Corp-to-Servers profile-setting group Standard-Profiles\n\n# Corporate -> PCI (DENY)\nset rulebase security rules Corp-to-PCI from Corporate to PCI-CDE\nset rulebase security rules Corp-to-PCI action deny log-end yes\n\n# Servers -> PCI (only payment processing)\nset rulebase security rules Servers-to-PCI from Servers to PCI-CDE\nset rulebase security rules Servers-to-PCI source [ 10.0.30.10 ]\nset rulebase security rules Servers-to-PCI destination [ 10.0.40.10 ]\nset rulebase security rules Servers-to-PCI application [ ssl ]\nset rulebase security rules Servers-to-PCI service service-https\nset rulebase security rules Servers-to-PCI action allow\n\n# Management -> All (admin access via jump box)\nset rulebase security rules Mgmt-Admin from Management to [ Servers PCI-CDE ]\nset rulebase security rules Mgmt-Admin source [ 10.0.10.50 ]\nset rulebase security rules Mgmt-Admin application [ ssh rdp ]\nset rulebase security rules Mgmt-Admin source-user [ admin-group ]\nset rulebase security rules Mgmt-Admin action allow\n\n# Intra-zone deny (prevent lateral movement within zone)\nset rulebase security rules Deny-Intrazone from Corporate to Corporate\nset rulebase security rules Deny-Intrazone action deny log-end yes\n\n# Default deny all\nset rulebase security rules Deny-All from any to any\nset rulebase security rules Deny-All action deny log-end yes\n```\n\n### Step 4: Implement Inter-VLAN Routing ACLs\n\nFor additional layer 3 filtering on the router\u002FL3 switch:\n\n```\n! ACL: Corporate can only reach specific server ports\nip access-list extended CORP-TO-SERVERS\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 80\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 443\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 25\n permit udp 10.0.20.0 0.0.0.255 10.0.30.10 0.0.0.0 eq 53\n deny ip 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 log\n\n! ACL: PCI CDE isolation\nip access-list extended PCI-ISOLATION\n permit tcp host 10.0.30.10 host 10.0.40.10 eq 443\n permit tcp 10.0.10.50 0.0.0.0 10.0.40.0 0.0.0.255 eq 22\n deny ip any 10.0.40.0 0.0.0.255 log\n\n! Apply ACLs to VLAN interfaces\ninterface Vlan20\n ip address 10.0.20.1 255.255.255.0\n ip access-group CORP-TO-SERVERS out\n\ninterface Vlan40\n ip address 10.0.40.1 255.255.255.0\n ip access-group PCI-ISOLATION in\n```\n\n### Step 5: Validate Segmentation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Network segmentation validation - tests connectivity between zones.\"\"\"\n\nimport subprocess\nimport sys\nimport json\nfrom datetime import datetime\n\nclass SegmentationValidator:\n    \"\"\"Test network segmentation controls between zones.\"\"\"\n\n    def __init__(self):\n        self.results = []\n\n    def test_connectivity(self, src_desc: str, dst_ip: str, port: int,\n                          protocol: str = \"tcp\", expected: str = \"blocked\"):\n        \"\"\"Test if connectivity exists between source and destination.\"\"\"\n        try:\n            if protocol == \"tcp\":\n                cmd = [\"nc\", \"-z\", \"-w\", \"3\", dst_ip, str(port)]\n            elif protocol == \"udp\":\n                cmd = [\"nc\", \"-z\", \"-u\", \"-w\", \"3\", dst_ip, str(port)]\n            elif protocol == \"icmp\":\n                cmd = [\"ping\", \"-c\", \"1\", \"-W\", \"3\", dst_ip]\n            else:\n                return\n\n            result = subprocess.run(cmd, capture_output=True, timeout=5)\n            actual = \"open\" if result.returncode == 0 else \"blocked\"\n\n        except subprocess.TimeoutExpired:\n            actual = \"blocked\"\n        except FileNotFoundError:\n            actual = \"error\"\n\n        status = \"PASS\" if actual == expected else \"FAIL\"\n\n        self.results.append({\n            \"source\": src_desc,\n            \"destination\": f\"{dst_ip}:{port}\u002F{protocol}\",\n            \"expected\": expected,\n            \"actual\": actual,\n            \"status\": status,\n        })\n\n        symbol = \"[+]\" if status == \"PASS\" else \"[!]\"\n        print(f\"  {symbol} {src_desc} -> {dst_ip}:{port}\u002F{protocol} \"\n              f\"| Expected: {expected} | Actual: {actual} | {status}\")\n\n    def run_validation(self):\n        \"\"\"Run segmentation validation tests.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"NETWORK SEGMENTATION VALIDATION\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\\n\")\n\n        # Tests that SHOULD be blocked\n        print(\"[*] Testing controls that should BLOCK traffic:\")\n        self.test_connectivity(\"Corporate\", \"10.0.40.10\", 443, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Corporate\", \"10.0.40.10\", 22, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Guest\", \"10.0.30.10\", 80, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Guest\", \"10.0.20.1\", 0, \"icmp\", \"blocked\")\n\n        # Tests that SHOULD be allowed\n        print(\"\\n[*] Testing controls that should ALLOW traffic:\")\n        self.test_connectivity(\"Corporate\", \"10.0.30.10\", 443, \"tcp\", \"open\")\n        self.test_connectivity(\"Corporate\", \"10.0.30.10\", 80, \"tcp\", \"open\")\n        self.test_connectivity(\"Management\", \"10.0.30.10\", 22, \"tcp\", \"open\")\n\n        # Summary\n        passed = sum(1 for r in self.results if r[\"status\"] == \"PASS\")\n        failed = sum(1 for r in self.results if r[\"status\"] == \"FAIL\")\n        print(f\"\\n{'='*70}\")\n        print(f\"Results: {passed} PASSED, {failed} FAILED out of {len(self.results)} tests\")\n\n        if failed > 0:\n            print(f\"\\n[!] FAILED TESTS:\")\n            for r in self.results:\n                if r[\"status\"] == \"FAIL\":\n                    print(f\"  - {r['source']} -> {r['destination']}: \"\n                          f\"expected {r['expected']}, got {r['actual']}\")\n\n        # Save report\n        report = {\n            \"date\": datetime.now().isoformat(),\n            \"total_tests\": len(self.results),\n            \"passed\": passed,\n            \"failed\": failed,\n            \"results\": self.results,\n        }\n        report_path = f\"segmentation_test_{datetime.now().strftime('%Y%m%d')}.json\"\n        with open(report_path, 'w') as f:\n            json.dump(report, f, indent=2)\n        print(f\"\\nReport saved to: {report_path}\")\n\nif __name__ == \"__main__\":\n    validator = SegmentationValidator()\n    validator.run_validation()\n```\n\n## Best Practices\n\n- **Default Deny** - Start with deny-all inter-zone rules and explicitly allow required traffic\n- **Document Flows** - Map all legitimate traffic flows before implementing restrictions\n- **Segment by Sensitivity** - Group assets by data classification and compliance scope\n- **Intra-Zone Control** - Block lateral movement within zones, not just between zones\n- **Limit Management Access** - Restrict management plane to a dedicated zone with jump boxes\n- **Regular Validation** - Test segmentation controls quarterly with automated tools\n- **Monitor Denied Traffic** - Log and review denied inter-zone traffic for policy refinement\n- **PCI Scope Reduction** - Use segmentation to minimize PCI DSS Cardholder Data Environment scope\n\n## References\n\n- [CISA Zero Trust Microsegmentation Guidance](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-07\u002FZT-Microsegmentation-Guidance-Part-One_508c.pdf)\n- [NIST SP 800-125B - Secure Virtual Network Configuration](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-125b\u002Ffinal)\n- [PCI DSS v4.0 - Network Segmentation](https:\u002F\u002Fwww.pcisecuritystandards.org\u002F)\n- [Faddom Network Segmentation Best Practices 2025](https:\u002F\u002Ffaddom.com\u002F10-network-segmentation-best-practices-to-know-in-2025\u002F)\n","-|\n| **VLAN Segmentation** | Layer 2 | Subnet-level | Department separation, guest isolation |\n| **Firewall Zones** | Layer 3-7 | Zone-to-zone | Inter-zone policy enforcement |\n| **ACLs on Routers** | Layer 3-4 | Subnet\u002Fport | Quick filtering at routing boundaries |\n| **Microsegmentation** | Layer 3-7 | Workload-level | Zero trust, container environments |\n| **SGT\u002FTrustSec** | Layer 2-7 | Tag-based | Identity-based segmentation |\n\n## Workflow\n\n### Step 1: Map Traffic Flows and Define Zones\n\nBefore implementing segmentation, capture baseline traffic:\n\n```bash\n# Capture NetFlow data to understand existing traffic patterns\nnfdump -R \u002Fvar\u002Fcache\u002Fnfdump\u002F -s srcip\u002Fbytes -n 50\n\n# Identify east-west traffic between subnets\nnfdump -R \u002Fvar\u002Fcache\u002Fnfdump\u002F -s record\u002Fbytes \\\n  'src net 10.0.0.0\u002F8 and dst net 10.0.0.0\u002F8' -n 100\n\n# Map application dependencies\n# Document which servers need to communicate with which other servers\n```\n\n### Step 2: Configure VLANs on Switches\n\n```\n! Core switch VLAN configuration\nvlan 10\n name Management\nvlan 20\n name Corporate-Users\nvlan 30\n name Servers\nvlan 40\n name PCI-CDE\nvlan 50\n name Guest\nvlan 60\n name DMZ\nvlan 99\n name Native-Unused\n\n! Trunk port to firewall\ninterface GigabitEthernet1\u002F0\u002F1\n description Trunk-to-Firewall\n switchport trunk encapsulation dot1q\n switchport mode trunk\n switchport trunk allowed vlan 10,20,30,40,50,60\n switchport trunk native vlan 99\n switchport nonegotiate\n\n! Access port for corporate users\ninterface range GigabitEthernet1\u002F0\u002F2-24\n switchport mode access\n switchport access vlan 20\n spanning-tree portfast\n\n! Access port for servers\ninterface range GigabitEthernet1\u002F0\u002F25-36\n switchport mode access\n switchport access vlan 30\n\n! Prevent VLAN hopping\ninterface range GigabitEthernet1\u002F0\u002F37-48\n switchport mode access\n switchport access vlan 99\n shutdown\n```\n\n### Step 3: Configure Firewall Zone Policies\n\n**Palo Alto zone-based policy:**\n\n```\n# Define zones on firewall sub-interfaces\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.10 tag 10 ip 10.0.10.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.20 tag 20 ip 10.0.20.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.30 tag 30 ip 10.0.30.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 units ethernet1\u002F1.40 tag 40 ip 10.0.40.1\u002F24\n\nset zone Management network layer3 ethernet1\u002F1.10\nset zone Corporate network layer3 ethernet1\u002F1.20\nset zone Servers network layer3 ethernet1\u002F1.30\nset zone PCI-CDE network layer3 ethernet1\u002F1.40\n\n# Inter-zone policies (deny by default, explicitly allow)\n\n# Corporate -> Servers (only specific apps)\nset rulebase security rules Corp-to-Servers from Corporate to Servers\nset rulebase security rules Corp-to-Servers application [ web-browsing ssl dns smtp ]\nset rulebase security rules Corp-to-Servers action allow\nset rulebase security rules Corp-to-Servers profile-setting group Standard-Profiles\n\n# Corporate -> PCI (DENY)\nset rulebase security rules Corp-to-PCI from Corporate to PCI-CDE\nset rulebase security rules Corp-to-PCI action deny log-end yes\n\n# Servers -> PCI (only payment processing)\nset rulebase security rules Servers-to-PCI from Servers to PCI-CDE\nset rulebase security rules Servers-to-PCI source [ 10.0.30.10 ]\nset rulebase security rules Servers-to-PCI destination [ 10.0.40.10 ]\nset rulebase security rules Servers-to-PCI application [ ssl ]\nset rulebase security rules Servers-to-PCI service service-https\nset rulebase security rules Servers-to-PCI action allow\n\n# Management -> All (admin access via jump box)\nset rulebase security rules Mgmt-Admin from Management to [ Servers PCI-CDE ]\nset rulebase security rules Mgmt-Admin source [ 10.0.10.50 ]\nset rulebase security rules Mgmt-Admin application [ ssh rdp ]\nset rulebase security rules Mgmt-Admin source-user [ admin-group ]\nset rulebase security rules Mgmt-Admin action allow\n\n# Intra-zone deny (prevent lateral movement within zone)\nset rulebase security rules Deny-Intrazone from Corporate to Corporate\nset rulebase security rules Deny-Intrazone action deny log-end yes\n\n# Default deny all\nset rulebase security rules Deny-All from any to any\nset rulebase security rules Deny-All action deny log-end yes\n```\n\n### Step 4: Implement Inter-VLAN Routing ACLs\n\nFor additional layer 3 filtering on the router\u002FL3 switch:\n\n```\n! ACL: Corporate can only reach specific server ports\nip access-list extended CORP-TO-SERVERS\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 80\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 443\n permit tcp 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 eq 25\n permit udp 10.0.20.0 0.0.0.255 10.0.30.10 0.0.0.0 eq 53\n deny ip 10.0.20.0 0.0.0.255 10.0.30.0 0.0.0.255 log\n\n! ACL: PCI CDE isolation\nip access-list extended PCI-ISOLATION\n permit tcp host 10.0.30.10 host 10.0.40.10 eq 443\n permit tcp 10.0.10.50 0.0.0.0 10.0.40.0 0.0.0.255 eq 22\n deny ip any 10.0.40.0 0.0.0.255 log\n\n! Apply ACLs to VLAN interfaces\ninterface Vlan20\n ip address 10.0.20.1 255.255.255.0\n ip access-group CORP-TO-SERVERS out\n\ninterface Vlan40\n ip address 10.0.40.1 255.255.255.0\n ip access-group PCI-ISOLATION in\n```\n\n### Step 5: Validate Segmentation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Network segmentation validation - tests connectivity between zones.\"\"\"\n\nimport subprocess\nimport sys\nimport json\nfrom datetime import datetime\n\nclass SegmentationValidator:\n    \"\"\"Test network segmentation controls between zones.\"\"\"\n\n    def __init__(self):\n        self.results = []\n\n    def test_connectivity(self, src_desc: str, dst_ip: str, port: int,\n                          protocol: str = \"tcp\", expected: str = \"blocked\"):\n        \"\"\"Test if connectivity exists between source and destination.\"\"\"\n        try:\n            if protocol == \"tcp\":\n                cmd = [\"nc\", \"-z\", \"-w\", \"3\", dst_ip, str(port)]\n            elif protocol == \"udp\":\n                cmd = [\"nc\", \"-z\", \"-u\", \"-w\", \"3\", dst_ip, str(port)]\n            elif protocol == \"icmp\":\n                cmd = [\"ping\", \"-c\", \"1\", \"-W\", \"3\", dst_ip]\n            else:\n                return\n\n            result = subprocess.run(cmd, capture_output=True, timeout=5)\n            actual = \"open\" if result.returncode == 0 else \"blocked\"\n\n        except subprocess.TimeoutExpired:\n            actual = \"blocked\"\n        except FileNotFoundError:\n            actual = \"error\"\n\n        status = \"PASS\" if actual == expected else \"FAIL\"\n\n        self.results.append({\n            \"source\": src_desc,\n            \"destination\": f\"{dst_ip}:{port}\u002F{protocol}\",\n            \"expected\": expected,\n            \"actual\": actual,\n            \"status\": status,\n        })\n\n        symbol = \"[+]\" if status == \"PASS\" else \"[!]\"\n        print(f\"  {symbol} {src_desc} -> {dst_ip}:{port}\u002F{protocol} \"\n              f\"| Expected: {expected} | Actual: {actual} | {status}\")\n\n    def run_validation(self):\n        \"\"\"Run segmentation validation tests.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"NETWORK SEGMENTATION VALIDATION\")\n        print(f\"{'='*70}\")\n        print(f\"Date: {datetime.now().isoformat()}\\n\")\n\n        # Tests that SHOULD be blocked\n        print(\"[*] Testing controls that should BLOCK traffic:\")\n        self.test_connectivity(\"Corporate\", \"10.0.40.10\", 443, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Corporate\", \"10.0.40.10\", 22, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Guest\", \"10.0.30.10\", 80, \"tcp\", \"blocked\")\n        self.test_connectivity(\"Guest\", \"10.0.20.1\", 0, \"icmp\", \"blocked\")\n\n        # Tests that SHOULD be allowed\n        print(\"\\n[*] Testing controls that should ALLOW traffic:\")\n        self.test_connectivity(\"Corporate\", \"10.0.30.10\", 443, \"tcp\", \"open\")\n        self.test_connectivity(\"Corporate\", \"10.0.30.10\", 80, \"tcp\", \"open\")\n        self.test_connectivity(\"Management\", \"10.0.30.10\", 22, \"tcp\", \"open\")\n\n        # Summary\n        passed = sum(1 for r in self.results if r[\"status\"] == \"PASS\")\n        failed = sum(1 for r in self.results if r[\"status\"] == \"FAIL\")\n        print(f\"\\n{'='*70}\")\n        print(f\"Results: {passed} PASSED, {failed} FAILED out of {len(self.results)} tests\")\n\n        if failed > 0:\n            print(f\"\\n[!] FAILED TESTS:\")\n            for r in self.results:\n                if r[\"status\"] == \"FAIL\":\n                    print(f\"  - {r['source']} -> {r['destination']}: \"\n                          f\"expected {r['expected']}, got {r['actual']}\")\n\n        # Save report\n        report = {\n            \"date\": datetime.now().isoformat(),\n            \"total_tests\": len(self.results),\n            \"passed\": passed,\n            \"failed\": failed,\n            \"results\": self.results,\n        }\n        report_path = f\"segmentation_test_{datetime.now().strftime('%Y%m%d')}.json\"\n        with open(report_path, 'w') as f:\n            json.dump(report, f, indent=2)\n        print(f\"\\nReport saved to: {report_path}\")\n\nif __name__ == \"__main__\":\n    validator = SegmentationValidator()\n    validator.run_validation()\n```\n\n## Best Practices\n\n- **Default Deny** - Start with deny-all inter-zone rules and explicitly allow required traffic\n- **Document Flows** - Map all legitimate traffic flows before implementing restrictions\n- **Segment by Sensitivity** - Group assets by data classification and compliance scope\n- **Intra-Zone Control** - Block lateral movement within zones, not just between zones\n- **Limit Management Access** - Restrict management plane to a dedicated zone with jump boxes\n- **Regular Validation** - Test segmentation controls quarterly with automated tools\n- **Monitor Denied Traffic** - Log and review denied inter-zone traffic for policy refinement\n- **PCI Scope Reduction** - Use segmentation to minimize PCI DSS Cardholder Data Environment scope\n\n## References\n\n- [CISA Zero Trust Microsegmentation Guidance](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-07\u002FZT-Microsegmentation-Guidance-Part-One_508c.pdf)\n- [NIST SP 800-125B - Secure Virtual Network Configuration](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-125b\u002Ffinal)\n- [PCI DSS v4.0 - Network Segmentation](https:\u002F\u002Fwww.pcisecuritystandards.org\u002F)\n- [Faddom Network Segmentation Best Practices 2025](https:\u002F\u002Ffaddom.com\u002F10-network-segmentation-best-practices-to-know-in-2025\u002F)\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnet-security-firewall","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill net-security-firewall",{"tool":41,"command":42},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill net-security-firewall",{"tool":44,"command":45},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill net-security-firewall","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-security-firewall\u002FSKILL.md",true,[49],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"index.json","REFERENCE","参考文档",484,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-security-firewall\u002Findex.json",[56,81,104,126,148,164],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":23},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,22,80],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[88,63,89,66,90,91,92,22,93,94,95,96,97,98,68,99,100,101,102,103],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":23},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[111,112,113,114,115,116,22,93,117,94,118,119,68,101,120,121,122,123,124,125],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":23},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[64,133,134,135,136,137,138,69,139,22,80,140,141,142,143,144,145,146,147,68],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":23},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[155,156,64,157,135,137,158,69,159,139,22,80,94,160,161,162,163,147,68,70],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":23},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[171,64,135,172,158,69,173,174,22,80,175,176,177,178,179,180,68,70,181,182],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]