Question

A data center team wants to enforce east-west traffic controls between servers regardless of their IP subnet or VLAN, so that policy remains consistent even when workloads move or are re-addressed. They already run Cisco ISE and TrustSec-capable switches. Which approach best meets this requirement?

Accepted Answer

Assign Security Group Tags (SGTs) to workloads and enforce Security Group ACLs (SGACLs) in the TrustSec policy matrix

Answer

Configure extended IP ACLs on each switch SVI to permit or deny traffic between server subnets

Answer

Create separate VLANs for each application tier and route all inter-VLAN traffic through a firewall for inspection

Answer

Enable private VLANs on the access switches to isolate servers within the same broadcast domain