Integration of Security Functions in EVPN/VXLAN Using Group-Based Policy#

Nicola Modena

• Why: Sits exactly at this PM's intersection of DC fabric and network security: enforcing policy inside the EVPN/VXLAN overlay rather than bolting on perimeter appliances.
• What: An approach to integrating security functions into EVPN/VXLAN fabrics using Group-Based Policy. (title only)
• How: GBP as a technology tags traffic with policy-group identifiers carried in the VXLAN header so the fabric itself enforces segmentation; expect the talk to cover where security functions hook into that model — the deck has the specifics.
• Where applicable: EVPN/VXLAN DC fabrics. GBP support is uneven across NOS/silicon (strongest on Cisco platforms), so check which parts are portable before assuming multi-vendor applicability.