topic Re: About Default egress rule in Software-Defined Access (SD-Access)

About Default egress rule

Keisuke.I — Wed, 19 Jun 2019 03:52:12 GMT

If FinalCatchAllRule in Default egress rule is set to Deny_IP on TrustSec EgressPolicy Matrix screen, it seems that not only overlay but also underlay communication will be denied.

I want to know the setting that only overlay communication is rejected by default without affecting underlay communication.

Regards

Re: About Default egress rule

ldanny — Thu, 20 Jun 2019 18:57:54 GMT

As long as you have "no cts role-based enforcement" on the port config or no cts configured at all on the port you there shouldnt be a problem.

Re: About Default egress rule

Keisuke.I — Mon, 24 Jun 2019 04:54:52 GMT

Thank you for the information.

Currently, “cts role-based enforcement” is set to the physical port.

Neither “cts role-based enforcement” nor “no cts role-based enforcement” is set for VLAN.

And, the following two lines are input in configuration mode:

cts role-based enforcement

cts role-based enforcement vlan-list 1023

By setting “no cts role-based enforcement” to the physical port, does it mean that the default EgressPolicy can be reflected only on the overlay without affecting the underlay?