A Large U.S. Municipal Government Secures East-West Traffic for 10 Critical SAP Applications With NSX-T Microsegmentation
Key highlights
10 Critical Apps Microsegmented
SAP-based applications now protected by distributed stateful firewalling
Deny Rules In Place
Inbound and outbound deny rules enabled for each full application VM group
Week-Long Functional Testing
Application teams validated every flow, with missing rules added before lock-down
Summary
The Client wanted to restrict lateral movement inside its data center for business-critical applications. Using VMware Aria Network Insight for flow analysis and NSX-T distributed firewall rules, the team microsegmented 10 critical SAP-based applications, enabled deny rules, and completed functional testing with application owners, securing east-west traffic and reducing the attack surface.
Client overview
Containing Threats Inside the Data Center
The Client is the administrative body of a large U.S. city, delivering public safety, utilities, libraries, parks and recreation, and general administration services through a central office and many satellite locations, supported by a workforce numbering in the thousands. To strengthen security, it decided to microsegment its business-critical applications, limiting an attacker's ability to move laterally in the data center even after the perimeter has been breached.
Challenges
Hidden Application Dependencies Across Mixed Platforms
• Outdated Dependency Maps: application dependency mappings had not been kept current across the infrastructure.
• Servers Spread Across Platforms: the servers for a single application often sat on different platforms, making the right dependencies hard to find.
• Legacy Components: many applications included older Solaris database components alongside on-premises VCF and VMware Cloud on AWS workloads.
• Risk of Blocking Valid Traffic: deny rules had to be introduced without interrupting required communication.
Solutions
Flow-Driven Rules, Deny-by-Default Enforcement, and Validation
VMware Aria Network Insight was deployed with data sources including vCenter, Palo Alto, and switches to plan and recommend microsegmentation. VM groups were created as NSX-T security groups, and flow queries by application and port provided the data for distributed firewall rules. Every flow was reviewed with each application team, inbound and outbound deny rules were created and enabled during a maintenance window, and Aria Log Insight tracked drops to catch legitimate traffic. Application teams then ran a week of functional testing, and missing rules were added before the rules were locked down.
Flow Analysis
Aria Network Insight mapped traffic across physical Solaris, on-premises VCF, and cloud-hosted components.
Security Groups and DFW Rules
NSX-T security groups and distributed firewall rules built from analyzed flows and agreed with application teams.
Deny-Rule Enforcement
Inbound and outbound deny rules enabled during maintenance windows for each application group.
Drop Monitoring and Validation
Aria Log Insight tracked drops, and functional testing confirmed required traffic still worked.
Business outcomes
All 10 critical applications are now microsegmented, with deny rules in place for incoming and outgoing traffic across each application's full VM group. East-west traffic is secured, unnecessary traffic is blocked, and threats can be confined to a specific server without affecting the rest of the network, reducing the attack surface and supporting a zero-trust model. City application teams signed off all functional testing as successful. A key lesson was that tackling two or three busy applications at once made flow analysis difficult, so allowing ample time for analysis and setting clear timelines for rule finalization is essential.
