nx.os.and.cisco.nexus.switching.2nd.edition.1587143046

NX7K-SGA#
The next thing to do is to create Security Group Access Control Lists (SGACL) that will be
used to create security policy.
Policy Component: SGACL Creation
1. Go to Policy >Policy Elements >Results >Security Group Access > Security
Group ACLs.
2. Enter WebServers for the name and then the SGACL to permit http, https, dns, icmp
(ping), and deny RDP traffic (3389), as demonstrated in Example 5-35.
Example 5-35. Policy Created for Web and Database Servers
WebServers
permit tcp dst eq 80
permit tcp dst eq 443
permit udp dst eq 53
permit icmp
deny tcp dst eq 3389
Database Servers
permit tcp dst eq 1433
3. Click Push to deploy the security group ACLs.
Now that you have SGT and SGACLs defined, you need to construct the Egress policy:
1. Go to Policy > Security Group Access > Egress Policy.
2. Click Add Security Group ACL Mapping.
3. Select Source Security Group as IT_Servers and Destination Security Group as
Finance_Servers.
For the Assigned Security Group ACLs, you need to enforce the SGACL policy created on
ISE, as demonstrated in Example 5-36.
Example 5-36. Enforcing the SGACL Policy on the Nexus 7000
Click here to view code image
NX7K-SGA# conf t
Enter configuration commands, one per line. End with
CNTL/Z.
NX7K-SGA(config)# cts role-based enforcement
NX7K-SGA(config)# cts role-based counters enable
Note: Clearing previously collected counters...