Skip to content

Designing Zero Trust Data Center Segmentation Architecture - BRKDCN-2930#

Cisco Live Europe 2026 (Amsterdam) digest Program Core pick Amsterdam · 9–13 February 2026

Abstract

Cesar Obediente (Cisco), Brenden Buresh (Cisco)

  • Why: A structured progression from traditional DC firewalling to layered zero-trust segmentation, and it notably brings DPU/SmartSwitch and host-based (Isovalent/Cilium-lineage) enforcement into the same policy model as the fabric — the network/host security convergence this PM tracks.
  • What: How to build DC segmentation in layers on a Nexus 9K VXLAN EVPN baseline: macro-segmentation with VRFs, micro-segmentation with VXLAN GPO (L4 stateless), then adding DPU SmartSwitch and Isovalent host-based agents for L4 stateful controls, culminating in a hybrid mesh firewall concept with one central security controller authoring policy across network, host, and appliance enforcement points (from abstract only).
  • How: Incremental architecture: each layer adds enforcement capability without discarding the previous; single policy authority distributed to multiple enforcement points.
  • Where applicable: Nexus 9K + Cisco DPU/Isovalent stack for the full vision, but the macro/micro-segmentation layering pattern is general. The "hybrid mesh firewall" portion is Cisco's emerging architecture — treat as direction-setting rather than proven production pattern.