Deployment of Micro-Segmentation in Cisco NX-OS VXLAN EVPN Fabrics with VXLAN Group Policy Option (GPO) - BRKDCN-2933#
Cisco Live Europe 2025 (Amsterdam) digest Program Core pick Amsterdam · 9–14 February 2025
Speakers: Max Ardica (Cisco)
- Why: East-west micro-segmentation in DC fabrics is a core security-plus-fabric problem, and GPO is an IETF-draft-track mechanism for carrying policy through VXLAN itself — an alternative to firewall-per-everything that's worth understanding on its merits.
- What: How to implement micro-segmentation in NX-OS VXLAN EVPN fabrics using security groups and security group ACLs carried via VXLAN Group Policy Option (IETF draft-smith-vxlan-group-policy-05), covering control-plane and data-plane components, common use cases, and service-chaining simplification. (from abstract only)
- How: GPO piggybacks a group policy ID in the VXLAN header, so every packet carries its source's security group; enforcement happens on group-tagged ACLs at the destination leaf rather than mid-fabric firewalls, decoupling policy from IP/subnet and following workloads anywhere in the fabric.
- Where applicable: NX-OS VXLAN EVPN fabrics specifically (Cisco implementation of a draft-stage IETF mechanism — note it's not yet a ratified standard). The policy-follows-workload pattern is general, but interop across vendors is limited while the draft is immature.