Presenter mode

Zero-trust / microsegmentation placement

Full page · Paths

Walkthrough

North–south via edge firewall

User authenticates (ISE), traverses campus fabric, then edge firewall inspection toward the Internet. Perimeter alone is not zero trust.

Step 1 / 3
User / deviceAccess (ISE auth)ISE authCampus fabricEdge firewallInternet

Access auth binds user/device posture via ISE before fabric forwarding. Identity is part of the published zero-trust composition.

Walkthrough

East–west same VN · SGT / SGACL

Different SGTs inside one VN: TrustSec-capable switches can deny with SGACL without hairpinning to a firewall.

Step 1 / 3
Host A · SGT engHost B · SGT iotTrustSec switchISE (SGT)dynamic SGTSGACL deny (no hairpin)

ISE assigns dynamic source SGTs (e.g. eng vs iot). Keep the role set on the order of tens of well-defined classes — not hundreds of ad-hoc tags.

Walkthrough

East–west different VN · fusion firewall

Macro-segmentation (VN/VRF) isolates tenants; inter-VN communication hairpins via an external firewall for policy and deep inspection.

Step 1 / 3
VN / VRF AmacroVN / VRF BmacroFabric leafFusion firewallShared service

VN/VRF isolation is macro-segmentation. Virtualize only when needed — do not use VN count as fake microseg.