Your network knows who is every user (SD-WAN Microsegmentation)

Beyond traditional segmentation

Today’s corporate networks face a paradox: the more distributed and diverse the infrastructure, the harder it becomes to control who accesses what. Traditional segmentation based on VLANs and subnets was designed for a static world where users stayed in fixed locations and connected devices were predictable. That world no longer exists.

The proliferation of IoT devices, hybrid work and the coexistence of multi-vendor equipment on the LAN have made the classic segmentation model unworkable. Organizations are finding that maintaining hundreds of VLANs and IP-based access lists is operationally unsustainable and, worse still, ineffective against today’s threats. Even north-south traffic (between sites or to the outside), which is the main flow in distributed networks, is managed with generic policies that do not distinguish between user types or roles. And east-west traffic (between devices within the same network) is left virtually uncontrolled, exposed to attackers’ lateral movement.

Microsegmentation emerges as the answer to these limitations, taking access control to the most granular level possible: the user and their role within the organization. This approach aligns directly with Zero Trust architectures, where access is granted based on verified identity, not on network location.

However, the microsegmentation solutions available on the market typically demand requirements that are hard to meet: LAN equipment from a specific vendor, software agents on every endpoint or full redeployments of the existing infrastructure. For organizations with heterogeneous networks and multiple sites, these demands are an obstacle that holds back the adoption of a technology they recognize as necessary.

Key Benefits of SD-WAN Microsegmentation

Open integration with NAC systems

The system integrates with the leading network access control systems on the market, dynamically retrieving the user identity, role and assigned IP. This multi-vendor integration lets you leverage your existing NAC investment.

Threat containment across the entire network

All inter-site traffic is subject to policies differentiated by the role of the user or device that originates it: no communication is taken as trusted. And where a scenario calls for it, local traffic can also be controlled by routing it through the SD-WAN gateway.

Understanding microsegmentation in SD-WAN networks

Microsegmentation is an evolution of traditional network segmentation that shifts access decisions away from static parameters (VLANs, subnets, IP addresses) and towards the identity of the user or device that generates the traffic. Instead of asking “what subnet is this communication coming from?”, microsegmentation asks “who is the originator and what role do they have?”. This paradigm shift is a cornerstone of Zero Trust architectures.

From static segmentation to dynamic identity

Traditional segmentation groups devices into network segments defined by technical criteria: switch ports, VLANs or IP ranges. This model worked when users and devices were predictable. Today, with hybrid work, the proliferation of IoT devices and multi-site networks, keeping this static segmentation in place is costly and fragile. A user moving between sites or a device that is relocated can end up outside the intended policies.

Microsegmentation solves this problem by tying policies to the user or device, not to their location on the network. An employee in the finance department gets the same access restrictions whether they connect from headquarters, from a branch office or from a remote location. An IoT device (a camera, a sensor, a point-of-sale terminal, etc.) is classified and isolated by its nature, not by the port it plugs into.

Microsegmentation SD-WAN – Use Cases

Massive scaling without overloading the network

Microsegmentation deployment across hundreds of sites without overloading device memory or saturating the network with massive policy propagation.

IoT segmentation across distributed sites

Granular access control for IoT devices, cameras and sensors in branch networks with heterogeneous LAN infrastructure.

Challenge

Organizations with branch networks face a growing variety of connected devices: surveillance cameras, IoT sensors, printers, IP phones and point-of-sale terminals share the same network with corporate user equipment. Traditional VLAN-based segmentation becomes hard to manage at scale, especially when each site has switches from different vendors and models.

Without microsegmentation, a compromised IoT device can become an entry point for an attacker’s lateral movement towards critical corporate resources. The challenge multiplies when the organization runs hundreds of sites where standardizing LAN equipment is unfeasible for operational or financial reasons, and where network administration resources at each location are limited or non-existent.

Solution

SD-WAN microsegmentation automatically assigns a role to each device type based on the information provided by the NAC: cameras, sensors, printers and user equipment receive differentiated policies. Traffic for each role is isolated with no need to create additional VLANs or configure ACLs on the local switches.

The controller distributes to each branch router only the policies that apply to the device types present at its site. Centralized monitoring makes it possible to verify in real time that each device is correctly classified and segmented, with full visibility from the management platform.

Why Teldat?

Teldat applies microsegmentation from the SD-WAN router, without requiring switches from a specific vendor. Integration with multiple NACs on the market allows IoT devices to be classified dynamically, while keeping the existing LAN infrastructure in place and lowering the cost of segmentation.

Controlled access for third parties

Challenge

In practice, most organizations end up granting these users the same access as an internal employee, because implementing site-by-site specific restrictions is operationally unfeasible with traditional segmentation. The result is an enlarged attack surface: third-party credentials with excessive access are a common intrusion vector, and the organization has no visibility into what resources they are actually accessing.

Solution

The centralized management platform provides full visibility of third-party connections: which site they access from, which resources they reach and during which hours. This traceability streamlines security audits and makes it possible to revoke or modify access immediately in response to any incident.

Why Teldat?

Teldat’s integration with multiple NAC systems makes it possible to automatically identify external users and assign them the appropriate role. The policy is enforced from the SD-WAN router at any site, with no intervention from the local team and no additional equipment.

Massive scaling without overloading the network

Microsegmentation deployment across hundreds of sites without overloading device memory or saturating the network with massive policy propagation.

Challenge

Solution

The solution relies on an SD-WAN controller with a centralized data model and full topological visibility of the network. The controller knows which users, roles and policies are relevant to each site and delivers to each gateway only the information that applies to its local context. Changes are propagated selectively, exclusively to the affected nodes, with no unnecessary mass updates. This allows microsegmentation to scale to hundreds of sites while keeping gateway memory consumption and network control traffic low, ensuring stable operation over the long term.

Why Teldat?