topic Re: SD-Access and IP-ACL in Software-Defined Access (SD-Access)

SD-Access and IP-ACL

markus.forrer — Wed, 27 Nov 2019 20:14:07 GMT

If you have an IP-ACL on an SVI Interface today. How can I implement it into a SD-Access Fabric?

I'm not meaning a micro segmentation. Just for example deny any icmp traffic for a specific device.

No Firewall in front of the site. Do DACL does the job for me and are they supported?

Kind regards

Markus

Re: SD-Access and IP-ACL

sandjose — Thu, 28 Nov 2019 02:12:57 GMT

Create a static IP to SGT mapping for the destination and define the policy on the ISE to block ICMP from the source SGT to DGT

Re: SD-Access and IP-ACL

markus.forrer — Thu, 28 Nov 2019 06:14:00 GMT

But where will this policy be applied? As I know with GBACL they will be enforced on the outgoing interface inside the fabric.
But my destination is outside the fabric.

Re: SD-Access and IP-ACL

sandjose — Thu, 28 Nov 2019 06:56:50 GMT

it will be enforced on the vlan as we push the following config as part of fabric

cts role-based enforcement
cts role-based enforcement vlan-list

Re: SD-Access and IP-ACL

Heriberto Diaz — Sun, 01 Dec 2019 20:44:17 GMT

The best place to deploy is on Border or Fusion.

https://community.cisco.com/t5/security-documents/policy-enforcement-within-sda-border/ta-p/3646816

Regards.