Arista Multi-Domain Segmentation (MSS)

Arista Multi-Domain Segmentation Services (MSS) enforces zero trust microperimeters directly in the EOS fabric at the switch ASIC, at wire speed without endpoint agents or proprietary overlay protocols. MSS binds endpoints, workloads, and network segments to microperimeter tags through CloudVision's NetDL pipeline, then enforces the resulting segmentation policy at every connected port across the fabric, covering managed devices and unmanaged assets IoT sensors, building automation systems, and operational technology that cannot run endpoint agents.

Policy enforcement is stateless and wire-speed: MSS acts at the ingress switch port before a packet reaches any other device on the network. There is no dedicated enforcement appliance in the forwarding path and no throughput ceiling other than the aggregate capacity of the switching fabric itself. Continuous traffic monitoring through CloudVision provides real-time visibility into policy violations, enabling security teams to investigate events without waiting for batch log collection from a separate monitoring system.

Integration with NAC systems, CMDBs, and virtualization platforms such as VMware vSphere allows MSS to consume identity and context from existing enterprise inventory systems, avoiding the need to rebuild device identity from scratch in a parallel database. When a device's authorization state changes in an upstream system due to a failed posture check, a changed role, or a detected infection the change flows into MSS tag assignment through CloudVision's NetDL pipeline and takes effect at the forwarding plane without requiring manual rule changes on individual switches.