A customer has a functional requirement that states HR systems within a data center should be segmented from other systems that reside in the same data center and same VLAN. The systems run legacy…

Perimeter firewalling protects the data center boundary from external threats but does not provide intra-VLAN segmentation between systems residing on the same Layer 2 segment.

Routed firewalls operate at Layer 3 and require systems to be placed in different subnets, which would necessitate IP address changes that are incompatible with the legacy hard-coded IP addresses.

VACLs can filter traffic within a VLAN but are stateless ACL-based constructs that lack the stateful inspection and scalable policy management a firewall provides for fine-grained segmentation.

Transparent firewalls operate in Layer 2 bridging mode, acting as a bump-in-the-wire between systems without altering the IP addressing scheme. This allows HR systems with hard-coded IPs to be segmented from other systems in the same VLAN because no subnet or IP reconfiguration is required. It is scalable because additional security policies can be enforced without redesigning the network topology.