In a distributed overlay fabric, how would you explain the role of policy enforcement with Group Based Policy ID?

In a distributed overlay fabric, how would you explain the role of policy enforcement with Group Based Policy ID?

• A. Group Based Policy ID is applied on egress VTEP after device authentication and policy is enforced on ingress VTEP
• B. Role-based policies are tied to IP addresses and are sent between VTEPs
• C. Group Based Policy ID is applied on ingress VTEP after device authentication and policy is enforced on egress VTEP
• D. Role-based policies protect policy traffic with IPsec

Answer: (C)

In a distributed overlay fabric, policy decisions are driven by a Group Based Policy ID that travels with the device's traffic. When a device connects at the edge, the ingress VTEP authenticates it and assigns a GBP ID to that device’s traffic. That GBP ID identifies which policy applies to that device. The enforcement itself happens at the egress VTEP. As traffic is forwarded across the VXLAN overlay and leaves toward its destination, the egress VTEP applies the policy tied to the GBP ID. This arrangement ensures the policy is consistently enforced at the point where the traffic exits the overlay toward the target network, regardless of the path taken inside the fabric. GBP isn’t solely about IP addresses, nor is it primarily about protecting policy traffic with IPsec. The key idea is mapping the authenticated device to a GBP ID at ingress and enforcing the corresponding policy at the egress.

In a distributed overlay fabric, policy decisions are driven by a Group Based Policy ID that travels with the device's traffic. When a device connects at the edge, the ingress VTEP authenticates it and assigns a GBP ID to that device’s traffic. That GBP ID identifies which policy applies to that device.

The enforcement itself happens at the egress VTEP. As traffic is forwarded across the VXLAN overlay and leaves toward its destination, the egress VTEP applies the policy tied to the GBP ID. This arrangement ensures the policy is consistently enforced at the point where the traffic exits the overlay toward the target network, regardless of the path taken inside the fabric.

GBP isn’t solely about IP addresses, nor is it primarily about protecting policy traffic with IPsec. The key idea is mapping the authenticated device to a GBP ID at ingress and enforcing the corresponding policy at the egress.