topic Re: Subnet to SGT mapping on ISE in Network Access Control

Subnet to SGT mapping on ISE

Antonio Macia — Mon, 23 May 2022 07:09:56 GMT

Hi,

Although I can statically map a subnet to an SGT on the "IP SGT Static Mapping" section on ISE, this is not been advertised via SXP to the devices, only /32 IPs are advertised. It is not possible to publish /24 subnets?

Regards,

Re: Subnet to SGT mapping on ISE

andrewswanson — Mon, 23 May 2022 09:14:58 GMT

What version of SXP are you using? Cisco documentation states:

SXP Version 3
Adds support for Subnet-SGT binding propagation. If speaking to a lower version then the subnet will be expanded to individual IP-SGT entries.

N.B. Subnet expansion needs to be enabled by the use of "cts sxp mapping network-map x" where x is the maximum number of host expansions and x=0 means no expansion

hth
Andy

Re: Subnet to SGT mapping on ISE

Antonio Macia — Tue, 24 May 2022 08:22:58 GMT

Thx @andrewswanson, you're right. I confirmed with a Cat9300 that subnets are advertised running SXP ver 4.

I first tried with an old ASA version compatible with version 2 only .