it's 2024! if you run your own infrastructure in your own DC and your defaults are NOT: - to heavily VLAN via load type/department/importance/whatever your org

it's 2024! if you run your own infrastructure in your own DC and your defaults are NOT: - to heavily VLAN via load type/department/importance/whatever your org prefers - default denying everything except common infra like DNS/NTP/maybe ICMP/maybe proxy arp/etc between those VLANs - every proto/port hole poked through is a security-reviewed request then you are doing it wrong. "ahh but these ACL request reviews take too long and slow down our devs" -- fix the review process, it can be done. spend the time on speeding up the security review, not on increasing your infrastructure's attack surface.