topic Re: Isolation inside DNA Scalable Group? in Software-Defined Access (SD-Access)

Isolation inside DNA Scalable Group?

JAN DEVOS — Wed, 05 Jan 2022 17:18:42 GMT

Hello,

Is there a means to deny traffic between endpoints belonging to the same Scalable Group? This for the obvious reason to prevent lateral movement between SG members. I am looking for the lookalike of ACI's 'Intra EPG isolation'.

Re: Isolation inside DNA Scalable Group?

Flavio Miranda — Wed, 05 Jan 2022 17:55:09 GMT

Dont think so. The permit or deny happens actually on the Access Contract which is associated to a Scalable Grupo. I mean, in order do differentiate devices, you´ll need differentiate Scalable Grupo.

Re: Isolation inside DNA Scalable Group?

Roddie Hasan — Wed, 05 Jan 2022 18:43:05 GMT

Hi Jan,

Yes, this has been fully-supported since Day 1. It is a very common strategy in guest networks where you don't want guest endpoints talking to each other. It's simply a matter of creating a deny policy using the same SGT for source and destination.

I hope that helps.

Roddie

Re: Isolation inside DNA Scalable Group?

JAN DEVOS — Thu, 06 Jan 2022 15:55:43 GMT

Tx, Roddie. This way of defining intra-SG-isolation (by deny any <SG> <SG>, where SG is one and the same scalable group) sounds logic. I did not think enough 'out of the box'., to find this solution by myself This merits to be documented somewhere, no?

Re: Isolation inside DNA Scalable Group?

Roddie Hasan — Thu, 06 Jan 2022 17:14:35 GMT

> This merits to be documented somewhere, no?

You're right, it should be - It's been a while since I looked at any of our guidance around policy, but I will do some digging to see if we have a CVD for it.

This strategy is definitely used widely.

Roddie