On this page
Segmentation Intelligence
Overview
Introduced in 5.3.00, TOS analyzes your security zones and subnet definitions in the zone manager and presents the results in a visual and informative way. Segmentation intelligence is the graphical dashboard that shows the results of that analysis. It pinpoints zone configuration caveats and deviations from common best practices and provides insights and recommendations for resolution. The Segmentation intelligence dashboard comprises sections: Executive summary, network coverage breakdown, subnet overlap across zones, network balancing and subnet prefix distribution. Apart from the executive summary, all sections contain one or more key insights and may also contain one or more recommendations. Recommendations may be provided as general recommendations for best practices, even when there are no issues for that category.
General functions
Three buttons appear at the top of the page:
-
Download
-
Refresh
Executive summary
The executive summary consists of five widgets each containing:
-
a graph of the percentage of affected zones
-
the number of affected zones compared to the total number of zones
-
severity based on the relative number of issues
The executive summary widgets are:
Segmentation coverage: Network objects covered by at least one zone
Subnet overlap conflicts: Subnets from one zone overlapping with those of another zone
High concentration zones: Zones containing more than 25% of all network objects
Underutilized zones: Zones containing less than 1% of all monitored subnets
Empty subnets: Subnets with no network objects identified in TOS.
Network coverage breakdown
This graph shows how network objects are included in your defined network zones. There are three types:
Associated: Percentage of network objects that are included in a defined zone
Multizone: Percentage of network objects that are included in more than one defined zone
Unassociated: Percentage of network objects that don't appear in any defined zone.
Subnet overlaps across zones
The first graph shows the percentage of subnets that overlap subnets from other zones. There are two types:
Equal: The percentage of subnets in one zone that are identical to a subnet in another.
Contained: The percentage of subnets that are fully or partly contained in subnets of other zones.
`The second graph is a zone matrix of with color-coded number of overlapping subnets. Hovering over the graph shows the number of overlapping subnets between the two zones.
Network balancing
The first graph - zone distribution by subnet - categorizes zones by the number and size (CIDR) of their associated subnets. The second graph - zone distribution by network coverage - shows for each zone the number of network objects that are covered by it's subnets. The numbers are further broken down into subnets that are associated with a single zone and those associated with multiple zones.
Subnet prefix distribution
The purpose of the subnet prefix distribution graph is to give you insight into the sizes you have defined for your subnets. It shows the number of subnets defined for each range of CIDR and recommends as a best practice to avoid very large subnets.
Configuration
Click on the configuration icon at the top of the page.
Enter the fields as needed and save.
| Field | Description |
|---|---|
| Largest subnet to analyze | The CIDR prefix that defines the largest subnet to analyze |
| Zone analysis mode |
Options:
|
| Excluded zones | Enter the names of any zones to ignore in the analysis or click and select from the list |
| Excluded device models | Start typing and select from the list any device models whose network objects you want to exclude from the analysis |
| Excluded device names | Start typing and select from the list any monitored devices whose network objects you want to exclude from the analysis |
| Ignore external addresses | Check the checkbox to exclude all subnets with addresses outside of your network |
Was this helpful?
Thank you!
We’d love your feedback
We really appreciate your feedback
Send this page to a colleague