Hi All,   I am new to TrustSec and i'm trying to determine if enforcing the following policy with SGTs is the best method.   From our CCTV network, we need to permit access to host 10.1.1.1 on port 8443, and to host 10.1.1.2 on port 2222, and then deny traffic to all other networks. Devices on the CCTV network have been classified and assigned an SGT of 'CCTV' using ISE. Hosts 10.1.1.1 and 10.1.1.2, have been assigned to two different SGTs (CCTV_Server1, CCTV_Server2). The required security group ACLs and policies have been configured to permit the above access. CCTV to SGT 'unknown' is then used to block all other traffic.   This works ok and fulfils the requirements, however, I have to put the hosts into two separate SGTs to keep access to ports 8443 and 2222 strictly to the required host.    Is there a better way of doing this as assigning SGTs on a per host/IP basis doesn't seem very scalable. Are SGTs intended for this purpose or is using a standard ACL better?   Thank you         ... View more

Hi All,   I'm new to ACI and have a couple of questions regarding Intra-EPG isolation.    1) Is it possible to force endpoints that are connected to the same EPG to communicate via an external firewall instead of directly?    2) Is it possible to allow two endpoints that are connected to the same EPG to communicate directly via certain protocols, such as ICMP and dns etc, and then force all other communication via an external firewall?   Thanks  ... View more

Hi All,   I have a design question that I'm hoping that someone can help with.   I have a new DC that consists of two Nexus 9K core switches and two 9K access switches. The core and access switches are connected together using a back-to-back vPC. The core switches only have SFP+ ports and the access switches have 1000Base-T ports.   I have to connect the Cisco ASA firewalls and WAN routers to the topology. I'm wondering if its best to connect these directly to the core, and purchase some GLC-T modules for these, or if there are no issues connecting directly to the access switches? I have seen lots of designs where these devices either connect to the core or connect to a WAN aggregation switch which is connected to the core in a similar back-to-back vPC fashion.   Any guidance would be appreciated   Thank you ... View more

Hi All,   I have 8 x C9300 switches that need to be stack but I only have the 0.5 meter cables that ship with the devices. In the past I stacked the 3750s/3850s in a ring topology by connecting the top and bottom switches in a stack using a 1m or larger cable. I have heard that it is possible to connect 5 and larger switch stacks using a braided ring which allows the use of the 0.5 cables but I have not seen any official Cisco documentation to confirm this. Is this possible with the Cat 9k and is it supported? As long that there is a path between all switches, does it matter? ... View more

Hi All,   I'm looking to configure DMVPN on a Cisco 2921 router but I only have the IP base license installed. I do not need to configure IPSec, only basic multipoint GRE tunnels and NHRP. Will the IP base license be ok for this?   Thank you ... View more

Hi All,   I need to size a UPS for a Cisco 3850-48P switch which has a 715W PSU installed in by default. From what I can see in the datasheet, the maximum power consumption of this switch is 125W, and then with a PoE budget of 435W on top, would total 560W. Is that correct and is this what I need to use for UPS sizing? ... View more

Hi All,   Is there any need to run BFD when using dark fibre between two L3 switches? I have customer that wants to set this up but I would have the thought that the inherent capabilities of the switch to quickly detect a link failure, notify the IGP (OSPF in this case) to tear down the adjacency, and then re-converge as required, will be more than adequate. Will BFD do anything to aid this?   Thanks, ... View more