Leaf switches identify the source and destination endpoint groups of traffic and consistently enforce security policies for unicast and multicast flows.
Security policy enforcement validates traffic against the policies defined between endpoint groups (EPGs) as packets traverse the leaf switches.
-
The ingress leaf switch marks each packet with its source EPG.
-
A forwarding lookup identifies the destination EPG and endpoint location.
-
The ingress or egress leaf switch enforces the policy, depending on where the destination EPG is identified.
Traffic forwarding and policy enforcement
A leaf switch performs a forwarding lookup for the destination IP address. The lookup can produce the following results:
-
A unicast /32 match identifies the destination endpoint EPG and either the local interface or the virtual tunnel endpoint (VTEP) IP address of the remote leaf switch.
-
A unicast subnet-prefix match identifies the destination subnet EPG and either the local interface or the VTEP IP address of the remote leaf switch.
-
A multicast match identifies the local interfaces of local receivers, the outer destination IP address for Virtual Extensible LAN (VXLAN) encapsulation, and the EPG of the multicast group.
If the forwarding-table lookup does not find a match, the leaf switch sends the packet to the forwarding proxy on a spine switch. If the spine switch finds a match, it forwards the packet to the egress leaf switch. The egress leaf switch enforces the security policy by using the EPG information in the fabric header. If the spine switch does not find a match, it drops the packet.
The egress leaf switch learns and stores the source information. Because most traffic flows are bidirectional, the forwarding tables on both sides are populated, which enables ingress policy enforcement in both directions.
Multicast and external router subnets always produce a match on the ingress leaf switch. The ingress leaf switch enforces the security policy as soon as it identifies the destination EPG.