TrustSec SGACL

dm2020 — Mon, 23 May 2022 16:48:59 GMT

Hi All,

I am currently lab testing TrustSec and I have a question regarding the use and configuration of SGACLs.

For basic testing I have an SGT named 'Monitoring_Servers' and an SGT named 'Clients'. I want to configured an SGACL and Policy to allow the Monitoring_Servers to access the Clients using TCP/SSH but deny all traffic from the Clients to the Monitoring_Servers.

Based on my testing SGACLs seem to be stateless so I need two SGACLs and two policies to achieve the above

SGACL: ACL_Monitoring_Servers_to_Clients

permit tcp dst eq 22 log
deny ip log

SGACL: ACL_Clients_to_Monitoring_Servers

permit tcp src eq 22 log
deny ip log

Policy

1 - Monitoring_Servers to Clients -> ACL_Monitoring_Servers_to_Clients

2 - Clients to Monitoring_Servers -> ACL_Clients_to_Monitoring_Servers

Is this the correct approach to achieve what I need?

Re: TrustSec SGACL

thomas — Mon, 30 May 2022 14:56:41 GMT

Yes, sounds correct.

Also see https://cs.co/ise-resources#Segmentation > Group Based Policy Fundamentals for background in TrustSec that should help.

topic TrustSec SGACL in Network Access Control

TrustSec SGACL

Re: TrustSec SGACL