Broadcast control with SGTs and microsegmentation

[Antonio Macia]

Hi,

In a Trustsec environment where devices within the same VLAN are not allowed to communicate, layer two traffic like ARP would be also blocked, right? This approach would allow us to have larger subnets without the caveats of the increase on the broadcast traffic that endpoints would have to process, is that correct?

Thanks.

[Mohammed al Baqari]

Not exactly. So punted traffic toCPU won't be blocked by SGACLs. But
hardware switched traffic will be blocked by SGACLs.

**** please remember to rate useful posts

[Antonio Macia]

For traffic destined to the switch itself I understand it will be punted to the CPU, but from the endpoints perspective they won't receive other's ARP traffic if not allowed by the matrix, right?

[thomas]

Traffic not allowed to destination groups by the TrustSec matrix... should not be allowed (or received) by the destination endpoints.