topic Re: Enforcing external SDA fabric traffic in Network Access Control

Enforcing external SDA fabric traffic

Dolevha — Mon, 29 Mar 2021 12:40:35 GMT

Hey all,

I'm learning how to enforce a network with Trustsec. I understand how to enforce within the fabric, but I don't fully understand enforcing outside the fabric.

My goal is to deny a certain SGT from communicating with anything outside the fabric (towards the internet for example) while allowing other SGTs to do so.

Currently, I'm denying certain services to the internet with my dACL enforcement, using "deny ip any any" at the end.

Is this possible to do this with Trustsec? Do I have to configure this on my perimeter firewall?

Thanks!

Dolev

Re: Enforcing external SDA fabric traffic

Mike.Cifelli — Thu, 22 Apr 2021 17:20:45 GMT

Take a look at the CTS allow-list model (default deny IP) with SDA: Cisco ISE TrustSec Allow-List Model (Default Deny IP) With SDA - Cisco

HTH!

Re: Enforcing external SDA fabric traffic

Damien Miller — Thu, 22 Apr 2021 17:29:10 GMT

That's a serious world of hurt I wouldn't wish on anyone.