Which SDP component terminates network traffic and enforces communication policies?

The SDP Client runs on the end-user device and initiates connections, but it does not terminate traffic or enforce communication policies.

Access Manager is not a standard component in the CSA SDP specification - access policy decisions are handled by the Controller.

The SDP Gateway sits between the client and protected resources, terminating inbound network connections and enforcing access and communication policies as specified by the SDP Controller. It acts as the enforcement point that only allows pre-authorized, authenticated traffic through to backend services, effectively making those services invisible to unauthorized parties.

A firewall is a traditional network security device separate from the SDP architecture, though SDP may complement or replace firewall-based controls.

The Controller authenticates clients and determines which Gateways they may access, but it does not itself terminate network traffic or enforce communication policies.