Step-by-step: How I isolated our POS systems on their own VLAN.

clara_k · 2026-08-24T01:31:09Z

Having recently completed a segmentation project for a retail client with a complex, legacy POS environment, I believe the methodology employed offers a replicable framework for others facing similar security and compliance mandates. The primary objective was to achieve logical isolation of all point-of-sale terminals and their backend servers from general corporate traffic, thereby reducing the attack surface and simplifying PCI DSS scope. The implementation was executed using a WatchGuard Firebox M570 running Fireware OS. The foundational step was a comprehensive traffic analysis to map all required data flows. This is non-negotiable. We deployed the Firebox's Dimension logging in an aggressive capture mode for a 72-hour period to establish a baseline. The critical flows identified were: * POS terminals to the on-premise POS server (TCP 443, proprietary port 2345) * POS server to the payment processor gateway (TCP 443) * POS server to a dedicated domain controller for POS user authentication (TCP 389, 636, 88) * Periodic terminal updates from an internal WSUS server (TCP 80, 443) * **No** communication was required from POS terminals to general internal resources like file shares, email, or internet browsing. The VLAN architecture was then designed. We created a new VLAN (VLAN 30) exclusively for POS systems. The physical switch ports hosting the terminals and servers were reconfigured as access ports for this VLAN. On the Firebox, a corresponding VLAN interface was configured on the internal (trusted) network with a restrictive IP address scheme (e.g., 10.10.30.0/24). The firewall policies were constructed using a "default deny" principle, only allowing the specific flows cataloged during the analysis. The most nuanced aspect involved policy construction to prevent lateral movement. We did not simply create an "Any" policy from the POS VLAN to the POS server's IP. Instead, we crafted explicit policies: * From VLAN30-POS-Terminals to POS-Server-IP for the specific required ports. * From POS-Server-IP to Payment-Gateway-External-IP on TCP 443. * From POS-Server-IP to POS-Domain-Controller-IP for LDAP/LDAPS and Kerberos. We utilized aliases for these device groups to maintain readability. Crucially, a rule was added at the end of the policy set to explicitly **DROP** all traffic from the POS VLAN to the corporate internal networks, creating a hard boundary. Stateful inspection on the permitted flows was, of course, enabled. Post-implementation validation involved both connectivity testing and a review of the policy hit counts in Dimension. We verified that the permitted policies were being hit as expected and, more importantly, that the explicit DROP rule was logging attempted violations (which revealed several misconfigured legacy terminal services that were attempting to phone home to unauthorized internal addresses). The final step was updating all network diagrams and firewall documentation to reflect the new segmentation model, which is now a required artifact for the client's annual PCI audit.

Page 2 / 2 Prev

WatchGuard Firebox Reviews

Last Post by cloud_cost_watcher 1 month ago

16 Posts

15 Users

0 Reactions

42 Views

RSS

cloud_cost_watcher

(@cloud_cost_watcher)

Honorable Member

Joined: 7 months ago

Posts: 386

24/08/2026 9:01 pm

Good question. We did ask for vendor documentation, but as others have hinted, it was incomplete. The pattern in the logs showed consistent, low-bandwidth TCP connections on 2345 from all terminals to a single internal server during nightly reconciliation. That suggested a control channel, not data transfer.

We still had to open a ticket with the vendor to get a definitive answer. They confirmed it was a legacy "health check" service, but they also warned it could dynamically shift to a higher port for diagnostic dumps during support sessions. That meant our rule had to be bidirectional and stateful, not just a simple allow.

CloudCostHawk

ReplyQuote

Page 2 / 2 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed