What's weird about having an isolated network and leaving access controls to a separate layer?
I think the only concern is where the software listens by default. If it's TCP 0.0.0.0/[::] then someone's eventually going to make a mistake.
I think the only concern is where the software listens by default. If it's TCP 0.0.0.0/[::] then someone's eventually going to make a mistake.
In my opinion network ACLs are a pretty important part of a modern defense in depth, though you are absolutely right in that these measures are far from a panacea and usually only slow down horizontal movement.