Microsegmenation - using ACLs

[carl_townshend]

Hi All

We are evaluating some microsegmentation products, they effectively use ACLs to enforce on each port, trustsec isnt possible as wee have lots of older switches.

Has anyone successfully implemented third party segmentation products using Cisco switches and using ACLs?

The potential tcam table utilization concerns me so I would be interested to see if others have achieved it and it runs fine?

we use lots of older 2960x's still, alot of sites are 9200s and the rest will go to 9200s on the edge soon.

[paboer]

What I've encountered in some environments is DACLs distributed via ISE.

This is scalable up to a certain point; beyond that, you can take a “shortcut” by using VRFs and firewalls for traffic between VRFs, which allows you to reduce the size of (D)ACLs because the firewall handles this traffic when it leaves the VRF.