HPE Campus Zero-Trust Inline Segmentation with Rohan Chadha

Most organizations assume a compromise will eventually occur. The challenge before us is preventing attackers from turning a single compromised user or device into a widespread business disruption. This session will show how HPE Networking Zero Trust Inline Segmentation (ZTIS) helps enterprises contain threats and reduce the blast radius of attacks through identity-based enforcement at the access edge. You’ll see how microsegmentation can be applied over your existing network to deliver the same zero-day resilience as traditional segmentation approaches. Rohan Chadha of HPE’s wired assurance product management team presented the session at Networking Field Day 41.

Chadha opened with the 2017 casino breach in which attackers used a fish tank thermometer to steal a high-roller database, arguing that the danger lies in what devices can reach inside a VLAN the firewall never sees. Agentic AI adds overprivileged machines moving at machine speed. ZTIS takes three steps, the last of which is “there is no third step.” An existing NAC, whether Mist Access Assurance, ClearPass, ISE, or FreeRADIUS, sends a group-based policy tag as a RADIUS vendor-specific attribute. Operators then author tag-to-tag policies in the Mist cloud, optionally refined by IP, port, and protocol. The switch binds the tag to the client’s MAC and enforces the policy at line rate, dropping denied traffic at ingress. Devices that can’t authenticate can be tagged statically by MAC, subnet, or VLAN, and when delegates raised MAC spoofing, Chadha acknowledged the risk and pointed to VLAN or subnet tagging instead. Policy hit counts help teams prune unused tags.

ZTIS supports up to 10,000 clients per site, and it works on EVPN multihoming and core-distribution campus fabrics without stretching VXLAN to the access layer. Larger sites can use an EVPN-VXLAN IP Clos fabric, where the tag travels natively in the VXLAN header. For the densest campuses, HPE is bringing the MX304, MX301, and MX204 under Mist Wired Assurance as core and border routers, supporting 200,000 clients, with Marvis support for MX planned. Enforcement still happens at the access switch either way. Chadha stressed that ZTIS doesn’t replace the firewall but targets lateral movement inside the network, and said wireless support is coming soon, enforced at the switch where the AP connects. The point is that microsegmentation becomes a policy change rather than a network redesign, from a single clinic to a 200,000-client campus.