Question

A data center engineer is deploying Cisco TrustSec on a pair of Nexus 9000 switches to segment east-west traffic between application tiers. Endpoints are classified into Security Group Tags (SGTs) at the ingress switch, and the security policy must be enforced so that 'Web' servers (SGT 10) can never initiate connections to 'Database' servers (SGT 30). Where in the TrustSec architecture is this restriction actually enforced, and what construct defines the permit/deny behavior?

Accepted Answer

The restriction is enforced at the egress switch using an SGACL bound to the source SGT / destination SGT pair

Answer

The restriction is enforced at the ingress switch using a traditional IP-based ACL applied inbound on the endpoint port

Answer

The restriction is enforced by the ISE server, which drops the packets in-line before they reach the destination switch

Answer

The restriction is enforced within the MACsec (CTS SAP) session by encrypting only traffic between authorized SGTs