SGACL state-less / stateful?

[rmueller@cisco.com]

Hi all,

to my knowledge, SGACLs are normally statless, which means that I have to explictly allow return traffic in cases where SGACLs are used.

Are there any devices (besides ASA/FTD) which are stateful when using SGACLs?

Roland

[jeaves@cisco.com · Accepted solution]

Hi Roland,

all devices downloading SGACLs from ISE are stateless (switches, routers, AP's via WLC).

As you say, firewalls offer stateful inspection but they use SGFW rules, they don't download SGACLs from ISE.

Routers can offer stateful operation while using SGT's in zone based firewall setup but again, SGACLs are not downloaded for this function.