Authors: Naveen Reddy Burramukku
Abstract: Modern enterprise networks are increasingly dynamic, driven by virtualization, cloud adoption, and the proliferation of distributed workloads. Traditional network segmentation approaches, which rely primarily on IP addresses, VLANs, and perimeter-based firewalls, are no longer sufficient to protect against sophisticated cyber threats, particularly those involving lateral movement within the data center. As attackers increasingly exploit compromised credentials and trusted internal access, there is a growing need for security models that are both granular and identity-centric.This research explores the concept of identity-aware network segmentation by integrating VMware NSX microsegmentation with Next-Generation Firewalls (NGFWs) to enforce security policies based on user, application, and workload identities rather than static network parameters. The proposed approach aligns with Zero Trust principles by assuming no implicit trust within the network and enforcing continuous verification of identity and context for every communication flow.The study presents an architectural framework that combines NSX’s distributed firewall capabilities with advanced NGFW features such as deep packet inspection, application identification, and user-based policy enforcement. A controlled virtual testbed is used to evaluate the effectiveness of the proposed model in mitigating east-west traffic threats, reducing attack surfaces, and limiting lateral movement within a virtualized data center environment. Performance impacts, scalability considerations, and operational complexity are also assessed to determine the feasibility of large-scale deployment.Results indicate that identity-aware segmentation significantly enhances internal network security by enabling fine-grained, context-aware policy enforcement without introducing substantial performance degradation. The integration of NSX and NGFW technologies provides improved visibility, simplified policy management, and stronger alignment with modern Zero Trust architectures. This research contributes to the growing body of work on software-defined security by demonstrating how identity-driven controls can be practically implemented to strengthen enterprise network defenses in hybrid and cloud-based environments.