Network security comparison: the architecture forks and the products on each side

A network security comparison usually turns into a brand argument. The useful version compares architectures: flat against segmented, perimeter against identity, a box you configure against a console someone else hosts. Named products matter only once you have picked the shape.

Below are the real forks, the products that sit on each side, and the failure each choice prevents. Read them as decisions, not a ranking.

What to take away

Flat or segmented

A flat network lets every device reach every other. A segmented one groups devices and writes rules between the groups.

Choose flat only when every device is a patched laptop, there are no printers, cameras or building systems, and no guest ever connects. That describes almost nobody.

Choose segmented in every other case. The cost is an evening, described in network security. The return is that a compromised camera becomes a nuisance instead of a route to the accounts machine.

Perimeter or identity-centered

The perimeter model trusts what is inside the wall. Get past the firewall by wire or by VPN and the network believes you.

The identity-centered model trusts nothing by location. Every request is checked against who is asking, from what device, in what state. The United States National Institute of Standards and Technology's zero trust architecture is the formal statement, and it is more readable than its reputation.

Choose the perimeter when all work happens on desktops that never leave and applications live on servers in the building.

Choose identity-centered when laptops travel and applications live in other people's data centers.

Most small businesses now run both: an identity check on every application, and a segmented office network for devices that cannot take part in identity checks at all.

A VPN or an identity-aware proxy

Both let someone outside reach something inside. A VPN puts their device on the network. An identity-aware proxy publishes one application at a time behind a login, and the device never joins anything.

Choose the VPN when people need a whole segment: a file server, a database, an application that is not web-based. OpenVPN Access Server and WireGuard are the common small-business picks. OpenVPN Access Server is licensed per concurrent connection; WireGuard is free and needs a management layer you supply yourself.

Choose the proxy when people need a list of specific applications and you would rather a lost laptop reached nothing than reached a segment. Cloudflare Access and Tailscale both do this.

Cloudflare Access is priced per user per month and bundles into Cloudflare's Zero Trust tier; Tailscale is free for a small user count and paid per user above it.

Login security is the same question in both cases, addressed in identity and access.

Configured on the box or in a cloud console

A box configured locally keeps working whatever happens to anyone's cloud, and it is only reachable from inside. A cloud console lets you manage several sites from one screen and change rules from a phone, and it stops being manageable when the console is unreachable.

Choose local when there is one site, one administrator, and the console login would be one more credential to defend. pfSense and OPNsense both run this way, free on your own hardware, with paid support available.

Choose the cloud console when there are several sites or a managed provider does the work. Ubiquiti UniFi and TP-Link Omada both put firewall, switch and wireless under one console. Protect that console login as the most powerful credential in the network, because it is.

Inspect traffic or filter names

Inline inspection reads what passes and blocks by pattern. Name filtering refuses to resolve known-bad destinations and reads nothing.

Choose name filtering first, always. It takes fifteen minutes, covers devices you cannot install anything on, and follows laptops home if done through a service rather than the router.

Cloudflare Gateway and Cisco Umbrella both do this, priced per user per month. Choose inspection in addition when a named person will read what it reports and when the box has the capacity with inspection on, which is the question the datasheet avoids.

One box or separate firewall, switch and access points

An all-in-one device does routing, wireless and switching together. Separate devices do one job each and can be replaced or upgraded independently.

For a small office with a handful of devices and one wireless area, choose one box. A UniFi Dream Machine or an Omada router does this at consumer-adjacent pricing.

Choose separate components when the building needs several access points or the switch must enforce segments on wired ports. Choose them when you want to replace the firewall without replacing the wireless. The United Kingdom National Cyber Security Centre's guidance on architecture and configuration makes the general case for designing the pieces so one can change without the others.

Consumer or business-grade

The pair everyone argues about and the one that matters least. A business-grade device supports more segments, per-user wireless, configuration export, and longer support. A consumer device may support a guest network and not much else.

Choose consumer when the office is very small, the device still receives updates, and the flat-or-segmented fork above came out flat. Choose business-grade when you need a device segment, because that is the feature consumer equipment most often lacks.

The forks side by side

What the forks do not decide

None of them decide whether anybody maintains the result. A segmented, identity-centered, cloud-managed network with rules nobody has read for two years is in worse shape than a flat one whose owner checks the forwarding list quarterly.

The recurring checks matter more than the shape, and the discipline for keeping them is the subject of security foundations controls. Nor do they decide the order in which to spend limited attention; on that, security foundations puts email, accounts and backups first, and the network after.

Common questions

Can we be identity-centered and still have a firewall?

Yes, and you should. The firewall segments the devices that cannot take part in identity checks, such as cameras and printers. The identity layer covers the people who can.

Is a cloud console less secure than a local box?

It is a different risk. The local box is reachable only from inside, which is safer and less convenient. The console is reachable from anywhere by whoever holds the login, which is convenient and exactly as safe as that login.

We chose the wrong side of a fork years ago. How hard is it to change?

Flat to segmented is an evening on a bench and a planned cutover. VPN to proxy is a month of parallel running. Box to console is a purchase. The method for all three is in network security migration.

Which fork should a ten-person business decide first?

Flat or segmented, because it changes what an incident can reach, and because deciding it forces the drawing every other fork depends on.