Skip to content

Deployment of Micro-Segmentation in Cisco NX-OS VXLAN EVPN Fabrics with VXLAN Group Policy Option (GPO) - BRKDCN-2633#

Cisco Live US 2025 (San Diego) digest Program Core pick San Diego · 8–12 June 2025

Abstract

Max Ardica (Cisco)

  • Why: East-west segmentation enforced in the fabric itself — the intersection of the PM's network security and DC overlay interests — and grounded in an IETF draft rather than a purely proprietary mechanism.
  • What: Micro-segmentation using security groups and security group ACLs in NX-OS VXLAN EVPN fabrics via VXLAN Group Policy Option (IETF draft-smith-vxlan-group-policy-05), covering the control- and data-plane components of the implementation and common use cases including service-chaining simplification (from abstract only).
  • How: Group policy conveyed in the VXLAN header so per-application policy follows the workload anywhere in the fabric, replacing perimeter-centric inspection.
  • Where applicable: NX-OS EVPN fabrics; the mechanism follows an IETF draft so the concept is portable, but the described implementation is Cisco-specific.