Trustsec SGACL

[Vadim Starovoytov]

I am creating rules (SGACL) for a trustsec matrix.

I found a variation on how to permit and deny service ports.

Please tell me if there is a way to deny and permit ip addresses of hosts?

[Damien Miller · Accepted solution]

SGACLs are IP agnostic other than the extent where they can apply to all, or selectively to ipv4/ipv6 traffic. You cannot directly place an IP address within an SGACL, it is strictly SGT to SGT enforcement.