Question

A security engineer has deployed Cisco TrustSec across the campus. Endpoints are assigned SGTs by ISE at authentication, and SGTs are propagated to the data center switches. The engineer needs to ensure that traffic from the 'Contractors' SGT (15) is blocked from reaching the 'Financial_Servers' SGT (100), while all other traffic is permitted. Where and how should this policy be enforced in the TrustSec architecture?

Accepted Answer

Configure an SGACL in ISE and map it to the source SGT 15 / destination SGT 100 cell of the egress policy matrix, then push it to the enforcement switch

Answer

Configure a dACL in the Contractors authorization profile that denies the Financial_Servers subnet, applied at the ingress access switch

Answer

Create an inbound port ACL on the data center switch uplink referencing the Contractor IP address range

Answer

Assign the Contractors endpoints to a separate VLAN and use an SVI ACL to block the Financial_Servers subnet at the distribution layer