IT‑IS‑Networking
Technology › Network Architecture

Network Segmentation

Separating traffic that must not mix — done for regulatory reasons years before the industry settled on micro-segmentation and zero trust as words for it.

Also known as Micro-segmentation, Zero Trust

Left to right is time. Each row is one of the 17 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Compliance-driven isolation for workloads under conflicting regulatory regimes on shared infrastructure: criminal justice records under CJIS, patient information under HIPAA on the Fire and Rescue side, court records and elections data, each with different access, retention and disposition rules.

That included full isolation between the city government and the Sheriff’s Office sharing one physical plant, so neither tenant inherited the other’s regulatory exposure. The design predated the vocabulary — it was built years before micro-segmentation and zero trust became the terms for it.

Applied in

  • Enterprise Agreement Pursuit — Global AutomotivePursuit March–April 2025 · headquarters session May 2025 · relationship carried forwardCisco services subject-matter expert on a bid for a global automotive manufacturer's North American arm — a two-day clarification window, an affiliate's engineering bench as the differentiator, a loss, and a headquarters meeting four weeks later.
  • Casino Surveillance Network Design and Segmentation2024–2026Surveillance refresh and segmentation for a metropolitan casino property — designed as Principal Architect and governed as Director, through a phased implementation and a mid-program re-scope.
  • Multi-Property Gaming Group2024–2026Four properties for a regional casino group — security and segmentation, core refresh, wireless, surveillance separation and firewall consolidation.
  • Healthcare Estates2024–2026Five providers — firewall and intrusion-prevention upgrades against an active vendor advisory, a multi-site data center fabric on standing retainer, and segmentation with virtual desktop.
  • State and Local Government Delivery2025–2026A state transportation department data center relocation inside a single summer window, and county switching, firewall and platform replacement alongside it.
  • Utility OT/IT Engagement2024–2026A natural gas and electric utility, carried from review of the SCADA statement of work through firewall and switch delivery.
  • Firewall Refresh and Intrusion Response2025A multi-site next-generation firewall refresh for a nonprofit health provider — and an intrusion the night after cutover, met with geo-fencing and containment run alongside day-one support.
  • Consolidated CAD/911 Dispatch System2016–2024Two agencies with separate commands onto one dispatch platform, cutting response times from five to ten minutes down to one to two.
  • Enterprise Core Network2005–2024The city's core network across nineteen years — architecture, standards and, when it mattered, hands on the equipment.
  • Security Posture, Incidents and Federal Liaison2012–2024Working directly with the City's Chief Security Officer on posture, governance, attacks and breaches — and alongside Homeland Security and the FBI when an incident reached that far.
  • Fourteen Weeks on the ToolsApril – August 2024The densest hands-on stretch of the NRI tenure — seven client engagements worked personally, in the configuration and the peer reviews and the customer calls, while taking over a team from the second day.
  • Enterprise Multi-Tenant Firewall Architecture2020–2024Six independently governed agencies on shared infrastructure, none able to reach, disrupt or inherit the regulatory exposure of any other.
  • Citrix Published Application Estate2005–2023Eighteen years, five platform generations and roughly 4,000 billed seats — with a per-seat price an agency could argue with.
  • Clerk of the Court Filtering and DMZ Architecture2016–2023A separate filtering estate and demilitarized zone for an independently governed constitutional officer sharing City facilities.
  • Port-Level Authentication: The 2006 Position2006–2023An argument made in 2006 that securing ports by MAC address was not the answer — held across four platform generations, and in production fifteen years later by a route other than the one proposed.
  • Enterprise Web Filtering and Content Security2005–2023 · final platform decision scored 17 May 2023Eighteen years and five vendor generations, split two ways between a government workplace and a public library on the same infrastructure.
  • Fire & Rescue Mobile Gateway and SD-WAN Overlay2012–2023Three hundred apparatus turned into routed nodes on the enterprise network — dual carriers on private APNs, head-ends behind two providers, and a zero-trust overlay behind a firewall virtual system built for the fleet.
  • ISP Cutover, Public IP Renumbering and WAN Modernization2022–2023An estate moved to a new provider and a new public address space, then modernized for remote and hosted working without dropping the applications the business ran on.
  • Jacksonville Public Library Network2005–2023Eighteen years and two full redesigns of a central library and its branches, from the Main Library's opening to the carrier handoff.
  • JTA and Downtown Transit Connectivity2006–2023Seventeen years on the boundary between two public agencies that could not direct one another — first as the city's architecture review on transit proposals, then as owner of the interconnect itself.
  • Oracle ERP Program — RFP to Cloud Go-Live2011–2023Twelve years from the 2011 request for proposal to a 2020 cloud go-live — the cost model that had to exist first, and a cutover instrumented so neither side could blame the other.
  • NFL Stadium Cybersecurity Review2022–2023A league Internal Audit assessment of the city-owned stadium against the Department of Homeland Security's stadium cybersecurity guidelines, reaching the building's control systems as much as its enterprise IT.
  • Enterprise Network Access Control2016–2022Seven years from vendor evaluation to a control that could quarantine a port anywhere in the city — and the federated exception handling that made enforcement survivable in a building shared with four other agencies.
  • Juniper Enterprise Security Suite2009 – 2021A security platform rather than a firewall — selected on an instrument written before anyone knew who would win, operated for twelve years, and retired in stages on a plan the same team wrote.
  • Republican National Convention — National Special Security EventJune – October 2020Critical Infrastructure Subcommittee for a national special security event relocated to the city eight weeks into planning — first-responder mobility, venue design, carrier redundancy, and federal sensors landed on a municipal estate.
  • Public Access Wireless Program2005–2019Fourteen years and four program names — JaxWiz, municipal Wi-Fi, public wireless, Downtown Wi-Fi — from inheriting somebody else's pilot to a signed, mapped downtown build still being extended four years later.
  • Annex to Main Data Center Consolidation2010–2018Moving one data center into another with the estate live throughout, on three design documents at revisions ten, twelve and ten.
  • Enterprise Firewall Policy and OperationsMay 2009 – March 2017Eight years running the rule base directly across two platform generations — every rule, change and upgrade — then handing it down to a dedicated post rather than holding it.
  • One Spark Festival Wireless2013–2015Forty-two access points in downtown traffic signal cabinets, backhauled over the fiber that runs the lights, with Ubiquiti mesh between intersections as the fallback and a tenfold internet burst for the week.
  • Telemedicine Program with Hospital PartnersMay 2014 – August 2015Duval County Jail to UF Health — fifteen months from vendor presentation to completed pilot, opened with a business case rather than with equipment.
  • Biochemical Manufacturer Converged Network2010–2012Headquarters, an affiliated business and a plant site joined over encrypted tunnels on consumer DSL — where the reliability had to come from the design, because it was not coming from the circuits.
  • Duval County Courthouse Technology Program2008–2012A $12M IT program inside a $350M, 800,000 square foot capital facility, cut over live to a fixed date.
  • Internet Perimeter Firewall Replacement2006 – 2008An unsupported, undocumented Check Point estate replaced with firewall blades in the core — held as a stated performance objective, carried from written justification to floor-by-floor cutover, with no vendor producing a design at any point.
  • Georgia-Pacific IT/OT Convergence2002–2004Process control and SCADA alongside HVAC, access control and video on the enterprise network — before the industry had words for it.
  • JEA Power Quality Metering Network2001–2004Voltage sags, swells and harmonics measured at ten substations — one template design, an addressing plan built for it, and fiber off the ground grid, before the data was aggregated into the PIE SCADA platform.
  • JEA Utility SCADA and Redundant Control Sites2000–2004SCADA across 24 treatment plant sites on a SONET and ATM core — water and wastewater engineered as separate systems, with the control network separated from the corporate one two decades before the industry had a name for it.
  • Insurance Carrier E-Commerce Platform2001–2003Mainframe to public web in 2001, across a colocation tunnel and two firewalls — where the deliverable was the boundary, not the website, and the documentation reached revision 243.

Career

Documents

Attested by

  • CCIE #100422002 · Lifetime EmeritusCisco Certified Internetwork Expert, earned August 4, 2002, maintained for twenty years and carried to Lifetime Emeritus in August 2022.
  • JNCIP-SEC2012 · LapsedJuniper Networks Certified Professional, Security — the professional tier of the Juniper security track.

See also

Also searched as

  • OT security
  • ICS security
  • Purdue model
  • IT/OT segmentation
  • zero trust
  • ZTNA
  • microsegmentation
  • least privilege network

Compliance-driven isolation and per-tenant policy, designed under regulatory constraint before the vocabulary existed.