Blocking traffic between 2 SGT in the same VN.

[pham duy hiep]

Hi all.

I plan to design a new VN in my Fabric, wich has 2 subnets for user and server. 2 subnets will have different SGT. But I want the users can't access to the server (I know that all endpoints in the same VN can communicate with each other by default).

So how can I do it with the easiest way?

Thank you.

[Deepak Kumar]

Hello,

In your policy configuration, make action Default or allow to Deny from your Group1 to Group1 or Gorup2 as you need. 

[pham duy hiep]

Hi DeepPak,

Thank for your response.

Now, I'm waiting for testing environment to confirm it but this exactly is what I need to do, right?

Login to DNAC -> choose policy -> create a new policy with option deny IP between 2 Scalable Groups.

Thanks again.

[Deepak Kumar · Accepted solution]

Login to DNAC -> choose policy -> Group-based-Access control

In my above LAB, you can see I have two groups (custom created) IT DATA1 and IT DATA2. You can click on the required control Box and there will a popup. You can select as "DENY" or "DENY with logs" option as your need. 

Save .. Deploy...

[pham duy hiep]

Hi Deepak.

Thank you so much.