How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen have centered on locally defined firewall rules or had dozens of group policies.

I have been thinking it would make sense to extrapolate my rules endpoints into three broad categories, much as the Open PCI Scoping Toolkit does and creating only four general rules.

The groups would be :

L1: PCI servers and workstations
L2: Support servers and IS workstations
L3: General users and tertiary servers  

The four rules sets would be:


I'm thinking that from here I should be able to simply list all services that might be installed and running on a given level to grant access as outlined above.

L2: SQL, IIS, APP1, APP2, etc

Is there any security problem with defining only four rule sets as outlined using these three levels?

1 Answer 1


As a former PCI QSA, I would not recommend using the built-in Windows Firewall to segment your card holder environment. The reason being is that this control will only apply to Windows based hosts which are receiving the GPO, in my opinion the control will not provide adequate coverage for the entire card holder environment.

From a coverage standpoint, you are relying on a Windows only control. So unless a separate control is in place to prevent a non Windows computer from obtaining an IP address (e.g., NAC), you could have a OS X or other non Windows device on your network with access to your card holder data.

From a completeness standpoint, you are assuming that every in-scope Windows computer is joined to the domain and will receive the appropriate GPO. So assuming your firewall rules will be limited by individual subnets (e.g.,, there is a chance that a Windows computer NOT receiving the GPO could reside on a subnet that has access to the card holder environment.

My suggestion would be to use a proper firewall with a stateful packet inspection capability to properly segment your network.

Please note: This is my interpretation, another PCI QSA may have a different interpretation of your approach (which is one of the problems of PCI).

  • Once segmented only Windows systems would be part of the cardholder environment. By using Windows Advanced Firewall + IPSEC it isn't possible for non authenticated systems (my Linux and OSX boxes included) to access the cardholder environment. Mar 5, 2013 at 16:06
  • OK. I write another answer based on this new information.
    – Joe Gatt
    Mar 6, 2013 at 21:18
  • The rules are based on security groups in Active Directory, not subnets. There isn't a way for a given IP (windows and joined to our domain or otherwise) to get access without successful authentication (by being a member of the approved group in AD). Mar 6, 2013 at 21:21
  • OK. New answer submitted, I hope it helps.
    – Joe Gatt
    Mar 7, 2013 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .