How many Policy Domains? One or many?

[Robert_Fredette]

I wanted to get opinions on setting up Policy domains for our environment. We have a very simple set of requirements which boil down to this:

• a set of policies for Edge Switches
• a different set of policies with very little duplication for Top of Rack switches
• a completely different set of policies for our Core Switches

What is the feeling? Is it better to have ONE policy domain for all switches and only apply the Rules to ports as needed? Or is it better to have three policy domains in our case?

None of the switches would qualify to be in more than one of the domains if we went the multiple domain route.

[Jeremy_Gibbs]

Hmm... what are you doing at the core that is very special? Spanning tree is a pain in the rear!

[Jeremy_Gibbs]

I use the global rule container to make rules and use them between various policy domains. Also, depending on the capabilities of the equipment, it may be easier to have separate domains. We don't use policy at the ToR or Core, just at the edge.