How to use the VLAN Network Segmentation agent skill

What the skill makes the agent do

The skill covers VLAN-based (802.1Q) segmentation for enterprise networks. Its workflow has five steps: design the VLAN architecture, configure VLANs on a Cisco Catalyst switch, harden the switch against VLAN hopping, configure inter-VLAN routing with ACLs, and set up DHCP and DNS per VLAN.

The skill's example VLAN plan includes CORPORATE (VLAN 10), SERVERS (20), DMZ (30), GUEST (40), IOT (50), VOIP (60), MANAGEMENT (100), NATIVE_UNUSED (998) and QUARANTINE (999), along with a traffic-flow matrix such as CORPORATE to GUEST denied and GUEST to any internal network denied.

Its hardening section covers measures such as disabling DTP on ports, moving the native VLAN to an unused VLAN, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, port security, transparent VTP mode, BPDU Guard and storm control.

Install the skill

Option 1, for a single user: download the ZIP from this page and unzip it into ~/.claude/skills/ in your home directory.

Option 2, for one project: download the ZIP and unzip it into the .claude/skills/ folder inside your project.

Option 3, in the Claude apps: upload the ZIP under Settings, then Capabilities, then Skills.

Trigger the skill with natural requests

You do not need a special command. Describe the segmentation task in plain language and mention the goal, the devices and any compliance driver. The skill's description names segmenting an enterprise network into security zones, meeting PCI-DSS, HIPAA or SOC 2 isolation rules, and reducing blast radius after an incident, so requests in those terms are the best match.

• Design a VLAN plan for a company with corporate, server, guest and IoT zones.
• Write Cisco Catalyst configuration to create VLANs and access ports for our workstations.
• Review our switch hardening against VLAN hopping: DTP, native VLAN, port security and storm control.
• Draft inter-VLAN ACLs so guest Wi-Fi can reach the internet but not internal hosts.
• Help document network isolation for a SOC 2 audit.

Example: what a good result looks like

Ask for a plan first, then configuration. The agent should return a VLAN table with subnets and purposes, a traffic-flow matrix, and then per-device commands. Check that the output matches your addressing and port layout before using it, because the skill's examples use placeholder subnets such as 10.10.10.0/24 and interface names such as GigabitEthernet1/0/1-24.

The skill's Python script can also be used directly. Its API reference documents a CLI with --host, --username, --password and --audit-only options, where --audit-only reads the VLAN configuration without changing it.

What you need before you start

The skill lists these requirements: Python 3, the netmiko and napalm Python libraries, SSH access to managed switches with privileged credentials, and a managed switch that supports 802.1Q, such as Cisco Catalyst, HP Aruba or Juniper EX. The API reference lists netmiko and napalm at version 4.0 or later.

The skill's prerequisites also call for a Layer 3 switch or firewall for inter-VLAN routing, a network design document with VLAN assignments and subnets, and an understanding of 802.1Q trunking, STP and inter-VLAN routing.

Safety notes for scripts and network access

This skill runs scripts and uses the network. The Python script connects to switches over SSH and can change their configuration. The skill's own guidance says the commands can disconnect users or break routing if applied incorrectly, so test in a lab or change window first.

The skill also says not to use VLANs alone as a security control, not to use them for networks that must be air-gapped, and not to skip switch hardening against VLAN hopping. Run audit-only mode before any full configuration run.

• Use a lab switch or a maintenance window for any change.
• Keep a copy of the current running configuration so you can roll back.
• Use the least-privileged account that still allows the change, and never paste real passwords into shared chats.

Tips for better results

Give the agent your real port ranges, subnets, uplink ports and device models. The sample configs use placeholders and the agent will adapt more accurately with real values.

Ask for the traffic-flow matrix before the switch commands, so you can review the policy with your security team.

Ask the agent to note which parts are Cisco-specific. The skill's configuration examples are written for Cisco Catalyst, and the script's device types include cisco_ios, cisco_nxos, arista_eos and juniper_junos.