As your business evolves and adds devices, applying group policies to maintain security becomes increasingly difficult as the network expands. Adaptive Policy architecture helps to address this issue with three key components:
Identity classification and propagation: A tag is applied to frames from a source device and acts as an identity or grouping for a user/device.
Security policy definition: A policy comprised of a source tag, destination tag, and the permissions between them.
Security policy definition: An engine that implements the policy on supported network devices.
Adaptive policy leverages inline traffic tagging to provide the source's group identity to the next hop in the path, adding an ether-type before the IP header of the packet. The specific ether-type that is added in this process is called Cisco MetaData (CMD). Within the CMD header, the Security Group Tag (SGT) identifies the group that the source belongs to.
Inline tagging encapsulates every packet from a source. The encapsulation is maintained on a per-hop basis from the network device the source is connected to, to the network device the destination is connected to. The policy is enforced at the network device the destination is connected to. Once the Adaptive Policy tags are defined in Dashboard the actual policy can be written and applied to the network infrastructure.
