{"id":43685,"date":"2025-07-01T18:28:06","date_gmt":"2025-07-01T22:28:06","guid":{"rendered":"https:\/\/netfoundry.io\/?p=43685"},"modified":"2025-09-12T20:20:14","modified_gmt":"2025-09-13T00:20:14","slug":"extending-microsegmentation-to-non-identity-aware-devices","status":"publish","type":"post","link":"https:\/\/netfoundry.io\/zero-trust\/extending-microsegmentation-to-non-identity-aware-devices\/","title":{"rendered":"Extending microsegmentation to non-identity-aware devices"},"content":{"rendered":"\n

Introduction:<\/h3>\n\n\n\n

Enterprises in the OT and IIoT sectors are increasingly adopting identity-based, secure private zero trust networking. A foundational element in this journey is the implementation of least privilege access<\/strong> and microsegmentation<\/strong> to achieve granular access control. This requires that all communicating entities\u2014whether users, devices, or applications\u2014be assigned unique identities. However, a significant challenge arises when dealing with machines that are unable to support the installation of software clients or tunneling agents that enforce identity-based access.<\/p>\n\n\n\n

As we have engaged closely with our customers, a common need has emerged: a solution to extend zero trust access to non-identity-aware machines<\/strong>. These are typically legacy or specialized OT devices that cannot host identity clients yet still require secure, policy-driven communication. Addressing this need is essential to achieving comprehensive zero trust coverage across heterogeneous environments.<\/p>\n\n\n\n

What is it?<\/h3>\n\n\n\n

Before diving into implementation details, let\u2019s first understand the concept. In industrial environments, edge or industrial compute devices typically serve as network gateways<\/strong>, connecting to machines such as PLCs, sensors, actuators, and other OT assets. These gateways generally run a standard operating system and possess sufficient compute resources to host NetFoundry edge software<\/strong>.<\/p>\n\n\n\n

In this architecture, the gateway acts as the identity-bearing entity\u2014running the NetFoundry tunneler\/router<\/strong>\u2014while the connected machines communicate with cloud services, applications, and other machines through the identity of the gateway<\/strong>. The core objective is to implement a mechanism that controls and restricts which specific machines behind the gateway can access designated resources<\/strong>, even though they themselves may not have individual identities or tunneling capabilities. This enables enforcement of zero trust principles<\/strong> such as least privilege and segmentation, even for non-identity-aware devices.<\/p>\n\n\n\n

Scenario:<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

The following are the communication objectives we want to achieve:<\/strong><\/p>\n\n\n\n