topic Re: Cisco ISE - TrustSec Guide in Network Access Control

Cisco ISE - TrustSec Guide

cammy.busto — Fri, 21 Feb 2020 18:46:01 GMT

Hi,

Is anyone can share the docs/guideline on how to configure Cisco TrustSec. Also, is Cisco 2960-x is supported with TrustSec? No "cts credentials id" in statement in C2960.

Thanks

Re: Cisco ISE - TrustSec Guide

Rob Ingram — Mon, 19 Feb 2018 13:32:52 GMT

Hi,

Check out the TrustSec matrix, this will help you identify which devices support which features. The 2960x does not support enforcement or inline tagging, only SXP. I would have though the command "cts credentials" would not be available on this model.

These links are useful for TrustSec

Re: Cisco ISE - TrustSec Guide

cammy.busto — Mon, 19 Feb 2018 13:38:16 GMT

Hi RJI,

Thanks for the reply. So the switch configuration is

SWITCH# cts sxp connection peer <ISE PSN IP> password default mode local speaker

Re: Cisco ISE - TrustSec Guide

Rob Ingram — Mon, 19 Feb 2018 13:44:53 GMT

The 2960x has to send it's SXP bindings somewhere upstream in order for enforcement to take place, eg on a Distribution layer/WAN layer switch/router, not the ISE PSN (as per your example). The 2960x switch will learn the SGT's when a device/user is authenticated and assigned a SGT, SXP is used to transport the bindings over the network in order for enforcement to take place.

HTH

Re: Cisco ISE - TrustSec Guide

cammy.busto — Mon, 19 Feb 2018 13:51:48 GMT

Thanks for the reply RJ.

So meaning if this is my diagram

C2960 -->C4500x --->NXS9k <--- ISE PSN

C2960 is connected to 4500 - sxp connection peer is C4500

C4500 will be the enforcer - role-base enforcement

ISE is connected to Nexus 9k. Traditional nexus 9k is not supported.

Re: Cisco ISE - TrustSec Guide

Rob Ingram — Mon, 19 Feb 2018 13:58:23 GMT

Yes, the 4500x supports enforcement so you could peer all 2960x switches to it an enforce on the 4500x.

Check out the platform scalability table in this link for the number of SXP connections and number of SGT bindings the 4500x supports and whether this will be suitable for your environment.

Also make sure the 2960x/4500x are all running the recommended version in the links I provided.

Re: Cisco ISE - TrustSec Guide

cammy.busto — Mon, 19 Feb 2018 14:02:06 GMT

Thank you so much RJ.

I already saw the link and all C2960 is supported. Cisco TrustSec Guideline is very limited that's why is really hard for me on how to start the configuration 😞