Leaf switches enforce security policies by identifying the source and destination endpoint groups (EPGs) of traffic that enters the fabric.
Security policy enforcement evaluates traffic against the policies that apply between its source and destination EPGs.
-
The ingress leaf switch identifies the source EPG and adds the source EPG information to the fabric header.
-
The leaf switch performs a forwarding lookup to identify the destination location and destination EPG.
-
The ingress or egress leaf switch enforces the security policy as soon as it identifies the destination EPG.
Forwarding lookup results
The destination lookup can produce the following results:
|
Lookup result |
Information provided |
|---|---|
|
Unicast endpoint hit |
A unicast |
|
Unicast subnet-prefix hit |
A unicast subnet-prefix hit identifies the EPG of the destination prefix and either its local interface or the VTEP IP address of the remote leaf switch. |
|
Multicast hit |
A multicast hit identifies the local receiver interfaces, the outer destination IP address for VXLAN encapsulation, and the EPG of the multicast group. |
Multicast destinations and external-router subnets always produce a hit on the ingress leaf switch. The ingress leaf switch enforces the security policy after it identifies the destination EPG.
Forwarding proxy behavior
If the forwarding-table lookup misses on the ingress leaf switch, the switch sends the packet to the forwarding proxy on a spine switch.
-
If the forwarding-proxy lookup also misses, the spine switch drops the packet.
-
If the lookup succeeds, the spine switch forwards the packet to the egress leaf switch that contains the destination endpoint.
-
The spine switch preserves the source EPG information in the fabric header while forwarding the packet.
-
The egress leaf switch uses the source EPG from the fabric header and the destination EPG from its local lookup to enforce the security policy.
Bidirectional learning
The egress leaf switch learns the source IP address, source VTEP, and source EPG and stores the information in its local forwarding table. Because most traffic flows are bidirectional, return traffic populates the forwarding tables on both sides of the flow. After the entries are learned, each ingress leaf switch can enforce the security policy locally for its direction of the flow.