topic ISE SXP domains: can not have overlapping IPs ? in Network Access Control

ISE SXP domains: can not have overlapping IPs ?

Michal Garcarz — Fri, 07 Sep 2018 08:46:37 GMT

Hello Team,

I have SXP domain customer1 with mapping for ip 8.8.8.32.

And i can not add static mapping for the same ip for different SXP domain:

I would call it a bug - not a feature (since we have VPN domains for SXP for such a separation - right ?).

Could you please confirm ?

Do we have the same problem for dynamic mappings ? (received from network devices which belong to different SXP domains)

Thanks,

Michal

Re: ISE SXP domains: can not have overlapping IPs ?

kvenkata1 — Fri, 07 Sep 2018 20:29:01 GMT

I don't see any reference where we claim overlapping IP support in ISE SXP. The only reference I could find is in VRF aware SXP in IOS.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cts/configuration/xe-3s/sec-usr-cts-xe-3s-book/cts-sxp-ipv4.html#GUID-FB372893-786F-495B-912B-172DF3AE1972

- Krish

Re: ISE SXP domains: can not have overlapping IPs ?

Michal Garcarz — Fri, 07 Sep 2018 20:43:02 GMT

Hi Krish,

Thanks for the help.

VRF for SXP is nice - but a bit different.

We do not mention explicitly that we do support overlapping IPs - but that might be the perception - because of support for multiple SXP VPN domains (and domain filters).

Why do we support SXP VPN domains + filters if those are not really separated/independent ?

Thanks,

Re: ISE SXP domains: can not have overlapping IPs ?

kvenkata1 — Fri, 07 Sep 2018 21:56:34 GMT

Hi Michael,

I won't take this as a implicit feature as you mention. Unless the specific use case is tested & validated (& documented) it can't be declared as supported. Since I don't see it documented, I would say it is not supported.

Please feel free to reach out to the Segmentation PM team to further the discussion.

- Krish

Re: ISE SXP domains: can not have overlapping IPs ?

hslai — Sat, 08 Sep 2018 02:43:32 GMT

See ISE -SXP domain construct is not allowing Duplicated IP-SGT mappings

Re: ISE SXP domains: can not have overlapping IPs ?

jeaves@cisco.com — Mon, 10 Sep 2018 11:48:29 GMT

Agreed, this is all allowed on the switch infrastructure, it's just an ISE implementation anomaly.

You can of course just edit the one mapping entry in ISE and enter more SXP domain destinations.

A fix for individual entries needs to be tracked under CSCuz00603 (multiple exceptions in log with unified ip-sgt functional).