Secure Network Design: NAC, DMZ, Zoning & IPSec Explained (2026)

TL;DR

Secure network design is about deliberate segmentation — organizing a network into zones with defined trust levels and enforcing controlled transitions between them. NAC ensures only compliant devices connect. DMZ architecture separates public-facing services from internal systems. Network zoning divides the network by trust level and access requirements. IPSec secures data in transit at the network layer — Authentication Header for integrity, Encapsulation Security Payload for both integrity and encryption. Getting these architectural decisions right determines whether a compromised perimeter device becomes a full network breach or a contained incident.

Introduction

Network components — firewalls, switches, routers — are tools. Secure network design is the architecture that determines how those tools are arranged and what they protect. Two organizations could deploy identical hardware with completely different security outcomes depending on how they segment their network, who they allow to connect, and how they protect traffic in transit.

Segmentation is the core principle: dividing the network into zones with defined trust levels, enforcing that traffic between zones passes through controlled inspection points, and ensuring that a compromise in one zone does not automatically grant access to all zones. This post covers the four architectural patterns that implement this principle: NAC, DMZ, network zoning, and IPSec.

Network Access Control (NAC)

Network Access Control is a security framework — combining protocols, policies, and hardware — that governs which devices are permitted to connect to a network and under what conditions.

The core mechanism is the health check: before a device is granted network access, NAC evaluates it against minimum security requirements. If the device passes — current patches, active and updated antivirus, compliant configuration — it is granted the appropriate level of network access. If it fails, it is quarantined in a restricted network segment where it can receive remediation (patches, antivirus updates) without touching production systems.

What NAC enforces:

Why NAC matters: A network where any device can connect — personal laptops, unpatched equipment, compromised contractor machines — is only as secure as its least-secure connected device. NAC enforces a minimum security posture as a condition of network connectivity, preventing the most common initial access vector: a device that is already compromised or non-compliant connecting to the production network.

Image context: The flowchart shows NAC as a conditional gateway — network access is not a default state but something devices must qualify for by meeting minimum security requirements, with a defined remediation path for non-compliant devices.

Demilitarized Zone (DMZ)

A DMZ is a network segment that sits between the public internet and the internal private network, hosting services that must be publicly accessible while protecting the internal network from direct external exposure.

The term comes from military usage — a buffer zone between opposing forces. In network architecture, the DMZ is the buffer zone between the untrusted internet and the trusted internal network.

Why a DMZ is necessary: Web servers, mail servers, DNS servers, and other public-facing services must accept connections from the internet to function. Placing them directly on the internal network means that any attacker who compromises a public-facing service immediately has access to the full internal network. The DMZ isolates this exposure — a compromised web server in the DMZ leaves the attacker in the DMZ, still separated from internal systems by a firewall.

Two DMZ architectures:

A single-firewall DMZ uses one firewall with three interfaces: one facing the internet, one facing the DMZ, and one facing the internal network. Traffic rules define what can cross between zones. This is simpler and less expensive but creates a single point of failure.

A dual-firewall DMZ places the DMZ between two separate firewalls. The outer firewall allows only specific traffic from the internet into the DMZ. The inner firewall allows only specific traffic from the DMZ into the internal network. Even if the outer firewall is misconfigured or compromised, the inner firewall provides a second barrier.

Image context: The dual-firewall architecture shows why the DMZ provides layered protection — even if an attacker compromises a DMZ server or the outer firewall, Firewall 2 prevents lateral movement into the trusted internal network.

What belongs in a DMZ:

• Web servers serving public websites or APIs
• Mail servers (SMTP gateway)
• Public DNS servers
• VPN concentrators (the public-facing endpoint)
• Reverse proxies fronting internal services

What does not belong in a DMZ:

• Internal databases (unless replicated read-only copies for DMZ services)
• Active Directory domain controllers
• Internal file shares
• Any system with direct access to sensitive internal data

Network Zoning

Network zoning divides an organization's network into segments with defined trust levels, access requirements, and inter-zone communication policies. Each zone has a specific purpose and a specific population of devices and users.

All five network zones compared by access scope, typical population, and trust level:

Image context: The nested rings make the trust hierarchy visual — the innermost zone is most trusted and most protected, with each outer ring representing a progressively less trusted environment separated from the core by additional controls.

Intranet

An intranet is a private network accessible only to the organization's own personnel. Internal employees, internal systems, and authorized devices connect to the intranet. External parties have no access — the intranet is entirely isolated from public access by design.

Internal resources on the intranet — domain controllers, internal file servers, HR systems, financial systems — should never be directly reachable from the DMZ, extranet, or internet.

Extranet

An extranet extends controlled access to specific external parties — vendors, partners, supply chain participants, and select customers. Unlike the intranet, the extranet is accessible from outside the organization, but access is scoped to specific resources and restricted to authenticated external parties.

A manufacturing company might give a key supplier access to inventory data via the extranet. An accounting firm might give clients access to their documents. The key architectural requirement is that extranet access is strictly limited to the specific resources the external party needs — it must not be a path to the intranet.

Guest Network

A guest network provides internet access to visitors — conference attendees, contractors without a domain account, personal devices. The critical requirement is isolation: the guest network must be completely separated from the internal network. A visitor on the guest network should have no path to internal systems, file shares, or any corporate resource.

VLAN segmentation is the standard implementation — guest devices are on a separate VLAN that only permits outbound internet access, with no routing to any internal subnet.

Honeynet

A honeynet is a deliberately configured network segment designed to attract and trap attackers. It appears to contain valuable resources — servers, databases, credentials — but is actually an isolated monitored environment with no legitimate traffic.

Because no legitimate user or system should ever access the honeynet, any traffic to or from it is inherently suspicious. This makes the honeynet an extremely low-noise detection mechanism — every alert is real, because there are no legitimate reasons to be there.

What honeynets reveal: Attackers who reach the honeynet through lateral movement expose their techniques, tools, and objectives while operating in a sandboxed environment. Security teams study the captured activity to improve detection rules and understand the threat actor's methodology.

IPSec — Internet Protocol Security

IPSec is a suite of open, non-proprietary standards that secures data in transit across networks and the internet. Unlike TLS (which secures specific applications), IPSec operates at the network layer — it can secure all IP traffic regardless of application, making it the standard for VPN tunnels between sites and for securing traffic between network segments.

IPSec provides three security services:

• Origin authentication — verifying the traffic came from the claimed source
• Data integrity — detecting any modification to the data in transit
• Replay attack protection — preventing captured packets from being retransmitted by an attacker

These services are delivered through two protocols:

Authentication Header (AH)

AH provides origin authentication, data integrity verification, and protection against replay attacks. It does this by computing a hash over the packet contents — including the IP header — and including that hash in the AH header.

What AH does not provide: Encryption. The data payload is transmitted in cleartext. Anyone who intercepts the traffic can read the contents — AH only proves the data has not been modified and came from the claimed source.

When AH is appropriate: Scenarios where authenticity and integrity are required but confidentiality is not — traffic between trusted internal systems where the content is not sensitive but tamper-detection is needed.

Encapsulation Security Payload (ESP)

ESP provides the same authentication, integrity, and replay protection as AH, plus encryption of the data payload. The payload is encrypted before transmission — intercepted traffic cannot be read without the decryption key.

ESP is the more commonly deployed IPSec protocol because it provides the complete security picture: authenticity, integrity, and confidentiality simultaneously.

Image context: The packet-level comparison shows exactly what each protocol adds to the IP packet — AH adds a verification hash without hiding the content, while ESP both hides and verifies the content, making ESP the correct choice whenever confidentiality is required.

IPSec operating modes:

IPSec operates in two modes that determine how much of the packet is protected:

Transport mode encrypts/authenticates only the payload — the original IP header is preserved. Used for end-to-end communication between two hosts.

Tunnel mode encapsulates the entire original IP packet (header + payload) inside a new IP packet with a new header. Used for VPN tunnels — site-to-site connections where the original packet's source and destination must be hidden from the transit network.

Secure Network Design Cheat Sheet

SECURE NETWORK DESIGN DECISION GUIDE
──────────────────────────────────────────────────────────────────
DEVICE ADMISSION
  Requirement: Control which devices connect to the network
  Solution:    NAC with health checks (802.1X, RADIUS, posture assessment)
  Quarantine:  Isolated VLAN for non-compliant devices during remediation
 
DMZ DESIGN
  Requirement: Host public-facing services without exposing internal network
  Solution:    Place public services in DMZ between two firewalls
  Rule:        DMZ servers must never initiate connections to internal network
               Internal network may pull data from DMZ (approved, specific paths)
 
NETWORK ZONING
  Intranet:    Employees only — isolated from all external zones
  Extranet:    External partners — scoped to specific resources only
  Guest:       Visitors — internet only, zero internal routing
  Honeynet:    Detection trap — any traffic = alert, zero legitimate users
 
IPSEC
  Need integrity + auth only:     Use AH
  Need integrity + auth + privacy: Use ESP (recommended for almost all cases)
  Host-to-host:                   Transport mode
  Site-to-site VPN:               Tunnel mode
  Both AH and ESP:                Can be combined (rare — ESP alone usually sufficient)
 
SEGMENTATION PRINCIPLE
  Default deny between zones — explicit permit only for required traffic
  Minimize the number of open paths between zones
  Log all inter-zone traffic for audit and anomaly detection
──────────────────────────────────────────────────────────────────

Common Mistakes

Placing database servers in the DMZ. A web server in the DMZ legitimately needs to query a database, but that database should not be in the DMZ — it should be in the internal network with a narrow, specific firewall rule permitting the web server's DMZ IP to reach only the database port. Placing the database in the DMZ exposes it directly to the semi-trusted zone and any attacker who has compromised another DMZ server.

Treating the guest network as a convenience rather than a security control. A guest network that has any routing to internal subnets — even "just for printing" — is not a guest network, it is a lateral movement path with friendly branding. Guest network isolation must be absolute: no routes to internal subnets, no access to internal DNS, no shared services. The printer can be on a separate device management VLAN if guest printing is required.

Deploying AH when ESP is needed. AH provides integrity and authentication but no encryption. Choosing AH for traffic that contains sensitive data means any attacker who can capture network traffic can read that data despite the IPSec deployment. ESP is the correct choice whenever traffic content must be protected — which is the overwhelming majority of IPSec use cases.

Treating NAC as a one-time admission check. NAC health checks at connection time establish compliance at that moment — a device that passes the initial check and then has its antivirus disabled or its patches fall out of currency is no longer compliant. Continuous compliance monitoring — re-evaluating device posture periodically during an established session — addresses the gap between initial admission and ongoing state.

Frequently Asked Questions

Conclusion

Secure network design converts individual security components into a coherent architecture where compromise in one zone does not automatically propagate to all others. NAC ensures every connecting device meets a minimum security baseline before touching the production network. DMZ architecture isolates public-facing services from the internal network behind a second firewall barrier. Network zoning enforces trust hierarchies — employees in the intranet, partners in the extranet, visitors in the guest network, attackers in the honeynet. IPSec secures the transit of data between zones and across untrusted networks. Together these patterns implement the principle that should govern every network security decision: every path between zones must be deliberate, controlled, and monitored — because uncontrolled paths are where breaches expand.

Sources

• NIST SP 800-77 — Guide to IPsec VPNs — NIST's definitive reference for IPSec protocol selection, mode configuration, and deployment
• NIST SP 800-41 — Guidelines on Firewalls and Firewall Policy — Covers DMZ architecture and firewall deployment patterns
• CISA — Network Segmentation — Federal guidance on network segmentation and zoning principles
• RFC 4301 — Security Architecture for the Internet Protocol — The foundational IPSec architecture specification
• NIST SP 800-82 — Guide to ICS Security — Contains DMZ and network zoning guidance applicable to enterprise environments