network · deep · draft
Zero-trust / microsegmentation placement
Vendor banner: Cisco Zero Trust Network/Cloud DG + SD-Access / TrustSec. Placement of north–south edge firewalls, east–west inter-VN fusion, and fabric-native SGT microsegmentation — not a Zscaler/ZTNA product catalog.
In one sentence. Flat trust-inside-perimeter models fail against lateral movement; VLAN-only segmentation does not express identity; hairpinning all east–west through a single firewall pair does not scale.
Why it exists
Vendor banner: Cisco-documented campus/DC placement — identity from ISE, macro-segmentation with VRFs/Virtual Networks, micro-segmentation with Security Group Tags (SGACLs), and Secure Firewall where inspection and inter-VN policy require it. This is architecture placement teaching, not a ZTNA SaaS product tour. Cross-link `/architectures/evpn-vxlan/` for overlay fabrics and `/architectures/sd-wan-overlay/` for WAN edge handoff.
Visual walkthrough
Access auth binds user/device posture via ISE before fabric forwarding. Identity is part of the published zero-trust composition.
ISE assigns dynamic source SGTs (e.g. eng vs iot). Keep the role set on the order of tens of well-defined classes — not hundreds of ad-hoc tags.
VN/VRF isolation is macro-segmentation. Virtualize only when needed — do not use VN count as fake microseg.
Control vs data plane
Control plane
ISE supplies dynamic source SGT from user/device posture; RADIUS/pxGrid/SXP distribute identity and tags to switches and firewalls. SD-Access VN ↔ VRF isolation in control and data planes. Borders map SGT↔inline CMD or SXP outside the fabric. Exact fallback policy when ISE is down is design-dependent → known unknown.
Data plane
North–south: edge firewalls inspect user↔Internet and partner flows. East–west same VN: TrustSec-capable switches may enforce SGACL without hairpin. East–west different VN: route-leak / fusion via external firewall when inter-VN is required. Deep packet inspection sits on firewall boundaries — not on every Clos hop.
Request / packet path
North–south
Access auth (ISE) → campus fabric → edge firewall → Internet/partner. Perimeter alone is not a zero-trust claim; identity + microseg + inspection compose the published pattern.
East–west
Same VN, different SGT: switch SGACL may deny without hairpin. Different VN: hairpin via firewall/fusion device. Option C — host/agent zero-trust beyond fabric — is out of detailed scope here (unknown product matrix).
Scaling & math
SDA design guidance: many deployments use on the order of tens of well-defined SGTs (roles/device classes), not hundreds — qualitative operational guidance. Firewall throughput and concurrent sessions are platform datasheet unknowns. Fabric oversubscription remains a Clos/campus fabric topic (see spine-leaf / collapsed-core).
When it breaks
- North–south loss; east–west may continue if not hairpinned through the edge pair.
Cause. Edge firewall pair down or mis-routed.
Mitigation. HA firewall pairs; keep E–W fabric paths independent of N–S inspection where design allows.
- Inter-VN blackhole; intra-VN traffic OK.
Cause. Fusion / inter-VN firewall unavailable.
Mitigation. Treat inter-VN firewall as a critical path; prefer fewer well-defined VN boundaries.
- Unexpected permit/deny as tags missing or stale; fallback posture applies.
Cause. ISE / tagging / SXP failure.
Mitigation. Monitor identity infrastructure SLOs; document fallback SGACL posture — exact default is design-specific.
- Lateral movement allowed despite “microseg” labels.
Cause. Over-broad permit SGACL or role sprawl.
Mitigation. Keep SGT role set small and well-defined; audit permits as carefully as VN count.
- Operational overload from too many Virtual Networks used as fake microseg.
Cause. Treating VN count as microsegmentation.
Mitigation. Virtualize (VN/VRF) only when needed; use SGT inside a VN for group policy.
Misconceptions
- “Perimeter firewalls alone equal zero trust.” — Cisco ZT DG combines identity, microseg, and inspection.
- “Hairpin every east–west flow through a firewall in a large Clos.” — Does not scale; prefer fabric SGACL + selective inter-VN firewall.
- “This page is a ZTNA product comparison.” — Placement of N–S / E–W / SGT only; SaaS ZTNA vendors are out of scope unless separately sourced.
Reference expression
Primary: Cisco Zero Trust Network and Cloud Security Design Guide; SD-Access Design Guide (HTML/PDF); TrustSec campus fabric SGT-over-VXLAN guide; SD-Access validated profile. review: draft. When to choose: identity-aware macro + microseg with firewalls at N–S and inter-VN boundaries. When not: firewall on every east–west Clos path without capacity planning; perimeter-only “zero trust”; inventing company zone matrices without policy ownership.
Standards & sources
- cisco-zt-network-cloud-dg · Identity + microseg + firewall placementPrimary source, retrieved 2026-09-20. Zero Trust: Network and Cloud Security Design GuideZero Trust: Network and Cloud Security Design Guide — Identity + microseg + firewall placement
- cisco-sda-design-guide · VN/VRF + SGT operational guidancePrimary source, retrieved 2026-09-20. Cisco Software-Defined Access Solution Design GuideCisco Software-Defined Access Solution Design Guide — VN/VRF + SGT operational guidance
- cisco-sda-design-guide-pdf · SD-Access Design Guide PDFPrimary source, retrieved 2026-09-20. Cisco SD-Access Solution Design Guide (PDF)Cisco SD-Access Solution Design Guide (PDF) — SD-Access Design Guide PDF
- cisco-trustsec-campus-fabric · SGT over VXLAN / inter-VNPrimary source, retrieved 2026-09-20. Wireless Campus Design Guide for Security Group Tags over VXLANWireless Campus Design Guide for Security Group Tags over VXLAN — SGT over VXLAN / inter-VN
- cisco-sda-validated-profile · SD-Access validated deployment profilePrimary source, retrieved 2026-09-20. SD-Access Deployment Using Cisco Catalyst Center (Validated Profile)SD-Access Deployment Using Cisco Catalyst Center (Validated Profile) — SD-Access validated deployment profile
Known unknowns
- Exact ISE-down fallback SGACL defaults are design-specific.
- Firewall platform throughput/session limits are datasheet-specific.
- Host/agent zero-trust products beyond fabric scope are not catalogued here.
- Non-Cisco microsegmentation products are out of scope on this page.
Check yourself
East–west traffic in the same VN between different SGTs is often enforced by…
- Only the Internet edge firewall
- Switch SGACL without requiring a hairpin
- DNS anycast
- OMP TLOC color alone
Answer: Switch SGACL without requiring a hairpin. ZT DG / TrustSec: fabric-native microseg inside a VN.
Inter-VN communication typically requires…
- Nothing — VNs automatically mesh
- An external firewall / fusion device for policy and inspection
- Disabling ISE
- Stretching STP across the WAN
Answer: An external firewall / fusion device for policy and inspection. SDA/TrustSec: inter-VN via external device when needed.
SDA operational guidance on SGT count emphasizes…
- Hundreds of ad-hoc tags as default
- On the order of tens of well-defined roles/device classes
- Exactly one SGT forever
- SGT only on spines
Answer: On the order of tens of well-defined roles/device classes. SDA design guide qualitative guidance.
When should you avoid inserting a firewall on every east–west Clos hop?
- Never avoid it
- When capacity planning cannot support hairpin scale — prefer fabric microseg + selective boundaries
- Only in labs
- Only when using copper
Answer: When capacity planning cannot support hairpin scale — prefer fabric microseg + selective boundaries. When-not: firewall-every-path does not scale.
Dynamic source SGT commonly comes from…
- Public DNS TXT records
- ISE based on user/device posture
- STP root ID
- CloudFront behaviors
Answer: ISE based on user/device posture. Cisco ZT DG: ISE posture → SGT.
Macro-segmentation in this Cisco pattern is primarily…
- VN / VRF isolation
- Only host antivirus
- Anycast PoP lists
- OMP site-id alone
Answer: VN / VRF isolation. VN/VRF macro; SGT micro inside.
Is this page a ZTNA vendor bake-off?
- Yes — all SaaS ZTNA products are ranked
- No — it teaches N–S / E–W / SGT placement from Cisco primary guides
- Yes — with invented company matrices
- Only for Starlink
Answer: No — it teaches N–S / E–W / SGT placement from Cisco primary guides. Ship rule: placement, not product tour.
Perimeter-only firewalls for “zero trust” claims are…
- Sufficient per Cisco ZT DG
- Insufficient — identity + microseg + inspection are part of the published composition
- Required to disable SGACL
- The same as Open Connect steering
Answer: Insufficient — identity + microseg + inspection are part of the published composition. Misconception called out from ZT DG composition.