ISE SGACL not completely pushed to NAD

[OrkhanRustamli]

Hey All,

I have fabric network where ISE is Policy enforcer not DNAC. I have more than 150 SGACL in ISE and pushed. When I check the NAD I do not see all of them. What can be reason for this?

[Damien Miller · Accepted solution]

You should only see the SGACL's specific to the traffic/enforcement required by the switch. This is done by design of TrustSec for scalability reasons, you do not wan't to know every SGACL if that NAD won't ever see many of the traffic flows.

A NAD will only know what it needs to know. If you have a new SGT-DGT flow, then the NAD will request the SGACL and install it.