Segmentation Intelligence

Overview

Introduced in 5.3.00, TOS analyzes your zone and subnet definitions and presents the data in a visual and informative way. Segmentation intelligence is the graphical dashboard that shows the results of that analysis. It pinpoints zone configuration errors and provides insights and recommendations for resolution. The Segmentation intelligence dashboard comprises sections: Executive summary, network coverage breakdown, subnet overlap across zones, network balancing and subnet prefix distribution. Apart from the executive summary, all sections contain one or more key insights and may also contain one or more recommendations. Recommendations may be provided as general recommendations for best practices, even when there are no issues for that category. Some of the graphs refer to root zones only i.e. not member zones in a zone hierarchy. This is clarified in the explanations or Learn more links.

Executive summary

The executive summary consists of five widgets each containing:

  • a graph of the percentage of affected zones

  • the number of affected zones compared to the total number of zones

  • severity based on the relative number of issues

The executive summary widgets are:

Segmentation coverage: Network objects covered by at least one zone

Subnet overlap conflicts: Subnets from one zone overlapping with those of another zone

High concentration zones: Zones containing more than 25% of all network objects

Underutilized zones: Zones containing less than 1% of all monitored subnets

Empty subnets: Subnets with no network objects identified in TOS.

Network coverage breakdown

This graph shows how network objects are included in your defined network zones. There are three types:

Associated: Percentage of network objects that are included in a defined zone

Multizone: Percentage of network objects that are included in more than one defined zone

Unassociated: Percentage of network objects that don't appear in any defined zone.

Subnet overlaps across zones

The first graph shows the percentage of subnets that overlap subnets from other zones. There are two types:

Equal: The percentage of subnets in one zone that are identical to a subnet in another.

Contained: The percentage of subnets that are fully or partly contained in subnets of other zones.

The second graph is a matrix of overlapping subnets showing the zones and number of overlapping subnets.

Network balancing

The first graph - zone distribution by subnet - categorizes zones by the number of associated subnets. The second graph - zone distribution by network coverage - shows for each zone the split between subnets that are associated with only that zone and those associated also with other zones.

Subnet prefix distribution

The purpose of the subnet prefix distribution graph is to give you insight into the sizes you have defined for your subnets. It shows the number of subnets defined for each range of CIDR and recommends as a best practice to avoid very large subnets.