DNA Center enables you to create policies that reflect your organization's business intent for a particular aspect of the network, such as network access. DNA Center takes the information collected in a policy and translates it into network-specific and device-specific configurations required by the different types, makes, models, operating systems, roles, and resource constraints of your network devices.

Using DNA Center, you can create virtual networks, access control policies, and traffic copy policies.

The Policy Dashboard window shows the number of virtual networks, group-based access control policies, traffic copy policies, and scalable groups that you have created. In addition, it shows the number of policies that have failed to deploy.

The Policy Dashboard window provides a list of policies and the following information about each policy:

• Policy Name—Name of policy.

• Policy Type—Type of policy. Valid types are access control and traffic copy policies.

• Policy Version—Iteration of policy. Each time a policy is changed and saved, it is incremented by one version. For example, you create a policy and save it. The policy is at version 1. If you change the policy and save it again, the version of the policy is incremented to version 2.

• Modified By—User who modified the particular version of a policy.

• Description—Word or phrase that identifies a policy.

• Policy Scope—User and device groups or applications that a policy affects.

• Timestamp—Date and time when a particular version of a policy was saved.

Virtual networks are isolated routing and switching environments. By default, hosts that exists within separate virtual networks cannot communicate with each other. You can use virtual networks to segment your physical network into multiple logical networks.

A typical use case is for segmenting guests, employees, and contractors into separate groups so that you can allow and restrict access to parts of the network. The different types of networks are:

• Guest network—Network connections provided by a company to enable their guests to gain access to the Internet and their own enterprise without compromising the security of the host enterprise network. Guests can access the internet but cannot access internal applications that are hosted in the data center.

• Employee network—Network connections that allow access to the Internet and internal applications. This group can be segmented further to allow or restrict access within the enterprise network, for example, to specific internal applications, lab environments, and servers. For example, a finance employee does not need access to the development lab. Likewise, a developer does not need access to a sales forcasting application. These might be good candidates to segment into separate virtual networks.

• Contractor network—Network connections that allow users to access the Internet and contractor-specific applications within the enterprise network.

A virtual network may span across multiple site locations and across network domains (wireless, campus, and WAN).

Group-based access control policies are Security Group Access Control Lists (SGACLs). DNA Center integrates with Cisco ISE to simplify the process of creating and maintaining SGACLs.

During the initial DNA Center and Cisco ISE integration, scalable groups and policies that are present in Cisco ISE are propagated to DNA Center and placed in the default virtual network.

Note	DNA Center does not support access control policies with logging as an action. Therefore, Cisco ISE does not propagate any such policies to DNA Center.

Depending on your organization's configuration and its access requirements and restrictions, you can segregate the scalable groups into different virtual networks to provide further segmentation.

The access contracts that you create in DNA Center define the rules that make up the group-based access control policies. They define the actions (permit/deny) performed when traffic matches a specific port or protocol and the implicit actions (permit/deny) performed when no other rules match.

After you create a group-based access control policy, DNA Center translates the policy into an SGACL, which is ultimately deployed on a device.

The following example shows the process of authentication and access control that a user experiences when logging in to the network:

1. A user connects to a port on a switch and provides his or her credentials.

2. The switch contacts Cisco ISE.

3. Cisco ISE authenticates the user and downloads the SGACLs to the port to which the user is connected.

4. The user is granted or denied access to specific users or devices (servers) based on the access granted in the SGACLs.