Test a segmentation claim from inside and outside

applied · 80 min · Objective 3.1

Task

Set up two lab segments with a claimed boundary between them, then test that claim from both sides and record exactly what you tried — because the difference between an external and an internal view is itself the finding, and a segmentation claim is verified by testing, not by a diagram. Objective 3.1 covers scanning, and where you scan from is part of the result.

Steps

  1. On the lab you own, build two segments — call them office (10.10.10.0/24) and card (10.10.20.0/24) — with a firewall between them and a written claim: "no traffic from office to card except via the gateway on one port".
  2. From an office host, test reachability into card systematically: which addresses respond, which ports, which protocols. Save to /tmp/office2card.txt.
  3. Test the reverse direction, card to office, and save it — rules are often asymmetric, and the reverse is the one nobody considered.
  4. Record exactly what you tested, because "we could not reach it" must be scoped to what you tried; absence of a reply is not absence of a path.
  5. Compare against the claim, and write the finding — verified, or a specific violation with the port and direction.

Verify

grep -cE "^[0-9.]+:[0-9]+\s+(open|closed|filtered)" /tmp/office2card.txt
test -s /tmp/card2office.txt && echo "reverse direction tested" || echo "MISSING reverse test"
grep -ciE "verified|violation|except via|port" /tmp/finding.md

The first count must be non-zero: you tested reachability across the boundary in a parseable form. The second must confirm the reverse direction was tested — the asymmetric case is exactly the one that gets missed. The third must be non-zero: you wrote the finding as either verified-from-this-position or a specific violation, not a vague impression.

Notes

A clean result here is worth reporting positively — segmentation verified from this position, by these tests, on this date — because clients rarely get told what is working, and it is what makes the negative findings credible. A VLAN separates broadcast domains; isolation depends on what the layer 3 device between segments permits, which is an empirical question. Everything ran on segments you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.