Why segment
Limit blast radius: one compromised system does not put the whole network at risk. Compliance: PCI-DSS, HIPAA, etc., require isolation of sensitive data. Performance: smaller broadcast domains reduce network congestion. Simpler management: dividing by function makes policy and monitoring easier.
Segmentation strategies
VLAN segmentation: use 802.1Q tags for logical isolation. Subnetting: isolate functional areas with IP address ranges. Firewall segmentation: enforce policy between segments. Zero trust: microsegment down to individual workloads.