"Zero trust" is the most oversold phrase in networking — but underneath the marketing is a genuinely sound principle: stop trusting a device just because it's on the inside. This is what zero trust actually means for a network, how it differs from a good firewall, and how to map its principles onto gear you already run instead of a six-figure platform.
The old model was a hard shell around a soft centre: a strong perimeter, and inside it, implicit trust — once you're on the LAN, you can reach things. Every modern breach exploits exactly that: phish one laptop, and the flat interior lets the attacker move east-west to everything. Zero trust inverts the assumption — location on the network grants no trust. Every access is authenticated, authorised, and minimal, whether the request comes from the internet or the desk next to the server.
For a network engineer, zero trust is mostly identity-driven microsegmentation: who (or what) you are decides what you can reach, enforced as close to the endpoint as possible, defaulting to deny. You do not need a named ZTNA product to move in this direction — the principles map onto 802.1X, dynamic VLANs, granular segmentation, and default-deny east-west policy. This post separates the principle from the products.
01
Strip the marketing and zero trust is three ideas. Everything else is implementation.
| Principle | What it means on a network |
|---|---|
| Never trust location | Being on the LAN grants nothing — authenticate every device/user |
| Least privilege | Each identity reaches only what it needs, nothing more; default deny |
| Assume breach | Design so a compromised endpoint is contained — verify east-west, log everything |
Notice these are the same instincts as good segmentation and hardening, pushed to their conclusion. Zero trust isn't a new technology so much as a refusal to grant trust by network position — which is why you can adopt it incrementally with tools you already have.
02
Traditional segmentation walls off zones (north-south between them). Microsegmentation goes finer — controlling traffic within a zone, even between two machines on the same VLAN.
Most real attacks, once they have a foothold, spread east-west — machine to machine inside a segment the firewall never inspects. Microsegmentation is the answer: policy between individual workloads, not just between big zones. On classic gear you approximate it with more, smaller VLANs, private VLANs, client isolation, and host-based firewalls; in a data centre you get true per-workload policy from a fabric or hypervisor firewall. The goal is that a compromised reception PC can't freely scan and pivot to the other reception PCs or the server — the lateral movement that turns one phished laptop into a ransomware event has nowhere to go.
You capture most of the benefit without buying a platform: 802.1X so no device gets on a port without authenticating (and RADIUS assigns its VLAN by identity); default-deny inter-segment policy with minimal explicit allows; client isolation within untrusted segments; a locked-down management plane so the network devices themselves aren't the soft target; and logging/flow so lateral movement is visible. That's zero-trust principles on Cisco/MikroTik you already own. A ZTNA product adds identity-aware application proxying and slicker policy — genuinely useful at scale, but not the entry ticket.
03
In zero trust, the control point moves from "which subnet" to "which identity." The network's job is to authenticate the endpoint and enforce a policy tied to who it is, not where it plugged in.
The practical shift: a device authenticates (802.1X with certificates for managed devices, MAB as the grudging fallback for printers and cameras), RADIUS returns not just "allowed" but the VLAN and policy for that identity, and the port is placed accordingly. A contractor's laptop lands in a restricted segment; the finance workstation lands in finance; an unknown device lands in quarantine — all on the same physical switch, decided by identity. This is dynamic segmentation, and it's the piece that makes "least privilege by identity" real at the network layer rather than a slide. It leans entirely on the 802.1X and RADIUS/AAA foundations from earlier posts.
Takeaways
NOCTIS designs identity-driven, microsegmented networks across Crete — 802.1X, dynamic VLANs, default-deny east-west — capturing the zero-trust principles on the gear you own, and telling you honestly where a platform is and isn't worth it.
Book a Discovery Call →