Chapter 5: Selection & Interfaces

Core product introduction, typical wiring and interface logic, and a comprehensive product function comparison table for all key segmentation components.

5.1 Core Product Introduction

The segmentation architecture relies on a set of core security appliances and software platforms, each fulfilling a specific enforcement or visibility function. Product selection must be driven by the technical requirements derived from the zone design — throughput, session capacity, feature set, and operational integration requirements — rather than by vendor preference alone. The following six product categories represent the minimum viable set for a complete segmentation deployment.

Figure 5.1: Core Security Product Lineup — Six key security appliances: Edge NGFW (Palo Alto style), ISFW (Fortinet style), WAF/Reverse Proxy (F5 style), Bastion/PAM server with session recording indicator, SIEM Platform with storage capacity display, and NAC appliance (Cisco ISE style) with 802.1X indicator.

Table 5-1: Core Product Functions and Selection Criteria

5.2 Typical Wiring and Interface Logic

The interface assignment design maps each physical port on a security appliance to a specific zone, with a defined trust level and a set of permitted traffic flows. Correct interface assignment is critical — a misconfigured interface that places a high-trust zone on the wrong port can create an undetected security gap that persists for years. The interface logic diagram below shows the standard port assignments for both the edge NGFW and the ISFW, including the HA sync port, out-of-band management port, and data plane ports.

Figure 5.2: Interface and Connection Logic Diagram — NGFW front panel showing physical port assignments (WAN/orange, DMZ/yellow, Office/blue, Production/green, Management/teal, HA Sync/red, OOB MGMT/gray) with logical zone assignment mapping and trust level badges, plus ISFW interface assignments on the right panel.

Table 5-2: NGFW Interface Assignment Reference

Table 5-3: ISFW Interface Assignment Reference

5.3 Core Product Function Comparison Table

The following comprehensive function table compares the capabilities of the six core product categories across the dimensions most relevant to segmentation deployments. This table is intended to support vendor evaluation and RFP development — each row represents a capability that should be verified during proof-of-concept testing.