I’m currently getting myself up to speed with Cisco SD-Access. Particularly policy enforcement.

Am I right in saying that as SD-Access utilises VNIs and SGTs from which to enforce policies. Then only these can be used within the fabric to enforce policies and not source/destination IP addresses?

I’m guessing that you can (use source/destination IP addresses) but then that would negate a number of its benefits?

1 Answer 1


Correct. The point of SD-Access is to be agnostic, using security at the endpoint/user layer instead of IP.

You should attend the Cisco SD-Access learning courses through their digital learning very helpful.


costs a few CLC for a years subscription.

Ideally, you want to ID all the endpoints and interactions with users groups/AD groups to assign the SGTs and limit your VNIs to roughly 3-4. however you need satisfy the minimum pre'reqs of specific version releases DNA/Switches/ISE and built out your underlay network before you can implement anythying.

There is quite a bit of planning involved before you can deploy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.