After 802.1X or similar authentication, a civic endpoint should land in a GBP group that drives allow/deny policy in the fabric. What concept is being applied?
Select an answer to reveal the explanation.
Short Explanation
Auth says who you are; the GBP group says which club badge you wear on the network. Policy then keys off that badge—not off inventing a new ASN for every laptop.
Full Explanation
After 802.1X or similar authentication, when a civic endpoint should land in a GBP group that drives allow and deny policy in the fabric, the concept being applied is classifying the endpoint into a GBP group so subsequent fabric policy uses that group membership. Accurate classification is the foundation of group-based microsegmentation: identity results inform which group tag the leaf associates with the endpoint, and inter-group policy then permits or denies east-west sessions accordingly. Underlay BFD session grouping for spine liveliness only addresses forwarding-plane liveliness detection, not overlay group membership for municipal workloads. Mapping the endpoint into a MAC VRF solely based on DSCP rewrite confuses QoS marking with GBP classification. Assigning a unique underlay ASN per endpoint instead of a group tag invents an unscalable underlay identity scheme unrelated to EVPN-VXLAN GBP. Exam caveat: tie authentication or identity outcomes to GBP group assignment at the describe level without inventing vendor-specific RADIUS attribute trivia. Operational check: authenticate a test civic endpoint, confirm it receives the intended GBP group, attempt an inter-group flow that policy should deny, and verify the leaf enforces the deny while a correctly grouped peer flow succeeds.