Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I’m currently getting myself up to speed with Cisco SD-Access. Particularly policy enforcement.
Am I right in saying that as SD-Access utilises VNIs and SGTs from which to enforce policies. Then only these can be used within the fabric to enforce policies and not source/destination IP addresses?
I’m guessing that you can (use source/destination IP addresses) but then that would negate a number of its benefits?
Correct. The point of SD-Access is to be agnostic, using security at the endpoint/user layer instead of IP.
You should attend the Cisco SD-Access learning courses through their digital learning very helpful.
costs a few CLC for a years subscription.
Ideally, you want to ID all the endpoints and interactions with users groups/AD groups to assign the SGTs and limit your VNIs to roughly 3-4. however you need satisfy the minimum pre'reqs of specific version releases DNA/Switches/ISE and built out your underlay network before you can implement anythying.
There is quite a bit of planning involved before you can deploy.
