Network Segmentation Diagram

A network segmentation diagram shows how a system is divided into zones of different trust, which firewalls sit between them, and exactly which ports are allowed across each boundary. This sample shows a classic DMZ / app / data layout plus a zero-trust path for remote staff. It is a topology diagram, not UML: UML covers software structure and behaviour; topology diagrams are the standard notation used alongside it for networks.

1. The Diagram

Segmented Network: DMZ, App, Data and Management Zones DMZ trust: low App zone trust: medium Data zone trust: high Management zone admins only Zero-trust access identity + device, no VPN Internet Edge FW + WAF, DDoS Load balancer TLS termination Egress proxy allow-list only Internal FW zone ACLs Web tier nginx App services containers PostgreSQL primary + replica Secrets vault KMS-backed Bastion / PAM session recorded SIEM / logs all zones ship here Remote employee managed laptop ZTNA proxy IdP + MFA + posture 443 443 443 8080 8443 mTLS 5432 8200 egress: app -> proxy -> edge 443 + device cert per-app SSH 22 syslog Default deny between every zone; only the labelled ports are open.

Read it left to right:

  1. Traffic from the Internet (red, untrusted) can only reach the edge firewall, which also runs the WAF and DDoS protection. Only port 443 is open.
  2. In the DMZ the load balancer terminates TLS. Nothing in the DMZ holds data; if it is compromised the attacker still faces a second firewall.
  3. The internal firewall enforces zone ACLs: the load balancer may reach the web tier on 8080 and nothing else.
  4. In the app zone the web tier talks to app services over mutual TLS. App services are the only hosts allowed into the data zone, on 5432 (PostgreSQL) and 8200 (Vault).
  5. Outbound traffic (dashed) leaves only through the egress proxy with an allow-list, which blocks data exfiltration and malware call-backs.
  6. Admins reach servers only via the bastion, whose sessions are recorded. Every zone ships logs to the SIEM.
  7. Remote employees never get a network-level VPN. The ZTNA proxy checks identity, MFA and device posture, then forwards to one application at a time (green).

2. How to Read It

Topology Notation Used zone / segment FW firewall / WAF Host server / service untrusted net 443 allowed / admin zero-trust session

Real topology diagrams often use Cisco or cloud-vendor icons; here every device is a labelled shape so the diagram stays readable in any tool. The labels that matter most are the port numbers on the arrows: together they are the firewall rule set, and anything not drawn should be denied.

3. Variant: Zero-Trust Logical View

Variant: Zero-Trust Access (NIST SP 800-207 Roles) Policy Decision Point policy engine + administrator Identity provider users, groups, MFA Device posture MDM, EDR status Employee laptop subject Service A workload SPIFFE identity Policy Enforcement Point access proxy / sidecar request + token mTLS allow? decision Orders app resource Orders DB resource No implicit trust from network location: every request is authenticated, authorized and logged at a PEP.

Zero trust replaces "inside the network = trusted" with per-request decisions. This variant uses the NIST SP 800-207 roles: a policy enforcement point in front of each resource asks a policy decision point, which combines identity, device posture and risk signals. Zones from the main diagram still exist, but they become a second layer rather than the main control.

4. Pros, Cons, and When to Use

Pros

Cons

When to use

When not to use

5. Diagrams-as-Code

Graphviz (DOT) version of the main topology, using clusters for zones:

digraph seg {
  rankdir=LR; node [shape=box];
  internet [shape=ellipse, label="Internet"];
  edge_fw  [label="Edge FW + WAF"];
  subgraph cluster_dmz  { label="DMZ";  lb [label="Load balancer"]; egress [label="Egress proxy"]; }
  int_fw   [label="Internal FW"];
  subgraph cluster_app  { label="App zone";  web [label="Web tier"]; app [label="App services"]; }
  subgraph cluster_data { label="Data zone"; pg [label="PostgreSQL"]; vault [label="Secrets vault"]; }
  subgraph cluster_mgmt { label="Management"; bastion [label="Bastion / PAM"]; siem [label="SIEM"]; }
  subgraph cluster_zt   { label="Zero-trust access"; emp [label="Remote employee"]; ztna [label="ZTNA proxy"]; }
  internet -> edge_fw [label="443"]; edge_fw -> lb [label="443"];
  lb -> int_fw -> web [label="8080"]; web -> app [label="8443 mTLS"];
  app -> pg [label="5432"]; app -> vault [label="8200"];
  app -> egress [style=dashed]; egress -> edge_fw [style=dashed];
  emp -> ztna [label="443 + device cert"]; ztna -> app [color=green];
  bastion -> app [label="SSH 22", style=dashed];
}