# network-segmentation-review

Inspects traffic boundaries across local networks, firewalls, and cloud environments. It helps engineers spot routing leaks and test zone isolation.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 584 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/network-security/network-segmentation-review/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/network-segmentation-review

## What it does

The skill guides an audit of network boundaries separating environments like DMZ, production, and corporate subnets. It compares architecture diagrams against a default-deny baseline. At layers 2 and 3, the workflow inspects double-tagging risks, trunking negotiation on client switchports, native VLAN mismatches, and missing ACLs on switch virtual interfaces.

Firewall rules and cloud constructs receive equal scrutiny. The skill inspects policies for overly permissive any-to-any entries, shadowed rules, unlogged drops, and exposed administrative interfaces like SSH. In cloud environments, it evaluates security group configurations, transit routing tables, and outbound filters to prevent exfiltration paths.

Active verification relies on authorized probing with targeted commands like `nmap -PN -sT -p <port>`. Both directions and return traffic get checked. The final deliverable includes a structured matrix of tested paths alongside device-level evidence. Probing requires pre-approved testing access from representative hosts in each subnet.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill network-segmentation-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/network-segmentation-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/network-segmentation-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill network-segmentation-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/network-segmentation-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill network-segmentation-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/network-segmentation-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills network-segmentation-review
```

2. **Manually: put the files in place**
- File: `.github/skills/network-segmentation-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill network-segmentation-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path network-security/network-segmentation-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/network-segmentation-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill network-segmentation-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/network-security/network-segmentation-review/SKILL.md

## When to use it
- Audit firewall rulebases for over-permissive any-any filters and shadowed entries
- Detect VLAN hopping vulnerabilities and dynamic trunking misconfigurations
- Identify exposed management planes reachable from untrusted user subnets
- Spot transit routing table leaks and overly broad security group rules in cloud setups
- Validate cross-zone connectivity with directional port probes

## Example prompts
- Audit our core firewall rulebase to identify any-to-any rules reaching the database subnet
- Draft an nmap testing procedure to verify isolation between DMZ and corporate segments
- Review our cloud transit gateway route tables for overlapping CIDR allocations

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md