mcrsgm-grdcr

name	mcrsgm-grdcr
description	Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.
domain	cybersecurity
subdomain	zero-trust-architecture
tags	["microsegmentation","guardicore","akamai","zero-trust","east-west-traffic","network-segmentation","lateral-movement"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"]

Implementing Microsegmentation with Guardicore

When to Use

• When implementing east-west traffic controls to prevent lateral movement within data centers
• When needing application-level visibility into network communication patterns before writing segmentation policies
• When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)
• When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation
• When deploying zero trust at the network layer with process-level granularity

Do not use for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs/security groups suffice, or when network team lacks capacity for ongoing policy management.

Prerequisites

• Akamai Guardicore Segmentation license (Enterprise or Premium)
• Guardicore Management Server deployed (on-prem or SaaS)
• Agent deployment access to target workloads (Linux, Windows, Kubernetes)
• Network visibility: SPAN/TAP ports or VPC flow logs for agentless collection
• Application owner engagement for dependency validation

Workflow

Step 1: Deploy Guardicore Agents on Workloads

Install agents to collect process-level network communication data.

# Linux agent installation
curl -sSL https://management.guardicore.com/api/v3.0/agents/download/linux \
  -H "Authorization: Bearer ${GC_API_TOKEN}" \
  -o gc-agent-installer.sh
chmod +x gc-agent-installer.sh
sudo ./gc-agent-installer.sh \
  --management-url=https://management.guardicore.com \
  --site-id=datacenter-east \
  --label="web-tier"

# Windows agent installation (PowerShell)
# Invoke-WebRequest -Uri "https://management.guardicore.com/api/v3.0/agents/download/windows" `
#   -Headers @{"Authorization"="Bearer $GC_API_TOKEN"} `
#   -OutFile gc-agent-installer.exe
# Start-Process -FilePath .\gc-agent-installer.exe `
#   -ArgumentList "--management-url=https://management.guardicore.com","--site-id=datacenter-east" `
#   -Wait

# Kubernetes DaemonSet deployment
cat > gc-daemonset.yaml << 
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: guardicore-agent
  namespace: guardicore
spec:
  selector:
    matchLabels:
      app: gc-agent
  template:
    metadata:
      labels:
        app: gc-agent
    spec:
      hostNetwork: 
      hostPID: 
      containers:
      - name: gc-agent
        image: guardicore/agent:latest
        securityContext:
          privileged: 
        :
        - name: GC_MANAGEMENT_URL
          value: 
        - name: GC_API_KEY
          valueFrom:
            secretKeyRef:
              name: gc-credentials
              key: api-key
        volumeMounts:
        - mountPath: /host
          name: host-root
      volumes:
      - name: host-root
        hostPath:
          path: /
EOF
kubectl apply -f gc-daemonset.yaml


curl -s  \
  -H  | python3 -m json.tool