How is end-to-end microsegmentation enforced in a Cisco SD-Access architecture?

VLANs provide Layer 2 segmentation, but they are not the primary mechanism for end-to-end, identity-based microsegmentation across the entire SD-Access fabric.

While 5-tuples and ACLs can permit or deny traffic, they are static and IP-address dependent, which makes them less scalable and dynamic compared to the SGT/SGTACL approach for microsegmentation in SD-Access.

Cisco SD-Access achieves end-to-end microsegmentation by assigning Security Group Tags (SGTs) to classify endpoints into logical security groups. Access control between these groups is then enforced by Security Group Access Control Lists (SGTACLs), which specify granular 'who can talk to whom' policies irrespective of network topology.

VRFs (Virtual Routing and Forwarding) provide macro-segmentation by separating Layer 3 routing domains, but they do not offer the fine-grained, identity-based microsegmentation that SGTs provide within those segments.