A campus refresh uses access switches that stamp SGTs into frames inline, while the data-center ToR switches forward plain IP and cannot mark tags. The servers behind them must still present an SGT to the SGT-aware firewall. Which propagation method should carry those server bindings?
Select an answer to reveal the explanation.
Short Explanation
Your ToR switches can't stamp tags into frames, so the tag has to travel as a lookup instead. SXP carries each learned address-to-SGT binding to the firewall, which checks that mapping before it filters.
Full Explanation
SXP is the appropriate propagation method because the access switches already learn and apply SGTs, while the data-center ToRs carry only plain IP traffic. SXP conveys the learned IP-to-SGT bindings over a control-plane connection to the SGT-aware firewall, so the firewall can classify server traffic without requiring the ToRs to insert or understand inline tags. Static firewall entries can associate known server IPs with SGTs, but they replace propagation of learned bindings with manual configuration; they may also become stale when addresses or assignments change. pxGrid can distribute identity and policy context to integrated systems, but it is not the SXP binding exchange requested here, and a firewall must specifically support the relevant pxGrid integration to consume that data. Mapping a dedicated VLAN or subnet to an SGT is a common coarse-grained classification technique, but it assigns identity by network location rather than carrying each server's learned IP-to-SGT binding; it is unsuitable when individual server bindings must be preserved. Exam caveat: SXP transports bindings, not inline tags, so it does not make a non-tagging ToR insert SGTs into frames. Practical check: verify that the access switch learns the expected server IP-to-SGT entries and that the firewall's SXP session is up and shows those bindings.