topic Re: Cisco Trustsec Implmentation in Network Access Control

Cisco Trustsec Implmentation

chong.eric — Fri, 21 Feb 2020 18:34:28 GMT

Hi,

I would like to implement Cisco Trustsec on Catalyst 6500 Series Supervisor Engine 2T to control access between the PCI system and non PCI system in the same subnet/VLAN.

Question: Can you configure classfication/progatation/enforcement in a single device?

Please refer to attached diagram.

Regards,

Eric

Re: Cisco Trustsec Implmentation

Rob Ingram — Thu, 21 Sep 2017 18:03:23 GMT

Hi Eric,

Yes, I don't see why not. As long as the 6500 has the IP to SGT bindings and an SGACL then yes you can enforce. You'd probably want to confirm you are running a validated firmware as per the trustsec matrix https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/platform-capability-matrix.pdf

HTH

Re: Cisco Trustsec Implmentation

chong.eric — Fri, 22 Sep 2017 05:13:20 GMT

Will you able to share the configuration please?

Re: Cisco Trustsec Implmentation

Rob Ingram — Fri, 22 Sep 2017 18:47:14 GMT

Are you planning to use ISE to propagate the SGT Mappings/SGACL or are you just going to statically define them on the switch?

Re: Cisco Trustsec Implmentation

chong.eric — Sat, 23 Sep 2017 01:44:29 GMT

I am planning to configure in switch statically

Re: Cisco Trustsec Implmentation

Rob Ingram — Sat, 23 Sep 2017 10:00:11 GMT

I don't have a 6500 to verify this configuration, but the following commands work on a CSR with Loopback interfaces. Note the ACL below is not a standard/extended ACL but rather a role-based ACL.

ip access-list role-based DENY
deny ip

cts role-based sgt-map 192.168.1.10 sgt 10
cts role-based sgt-map 192.168.1.20 sgt 20
cts role-based sgt-map 192.168.1.30 sgt 30
cts role-based permissions from 10 to 20 DENY
cts role-based permissions from 10 to 30 DENY
cts role-based enforcement

Use the commands "show cts role-based counters" to verify hits increase for denies.

Any traffic not explictly denied is permitted.

I'd suggest obviously to test the commands in the lab before implementing in production.

Re: Cisco Trustsec Implmentation

chong.eric — Mon, 25 Sep 2017 09:07:40 GMT

Thanks. It works on 6506 too.