topic Re: Cisco Trustsec Dynamic SGT Assignment in Network Access Control

Cisco Trustsec Dynamic SGT Assignment

Newbie..9109 — Mon, 24 Mar 2025 00:43:48 GMT

Hi,

There are two types of assignment of SGT : dynamic and static.

Static assignment, ISE will use SXP to inform switch.

How about dynamic (user use 801.x for auth)? Will ISE use SXP or not?

manvik — Mon, 24 Mar 2025 04:27:56 GMT

What is your deployment ?? ISE has any PxGrid integration??
ISE can SGT info even for 802.1x users.

Newbie..9109 — Mon, 24 Mar 2025 04:34:05 GMT

I mean when user authenticate using 802.1x will ISE use SXP to inform switch? Or only radius auth no SXP

manvik — Mon, 24 Mar 2025 05:06:02 GMT

802.1x is an authentication protocol only. it has no relation with SXP.

ISE uses Trustsec/SXP service to inform switches on the SGT tags. Check below doc - https://www.lookingpoint.com/blog/cisco-ise-trustsec-propagation

Newbie..9109 — Mon, 24 Mar 2025 05:40:15 GMT

The link you sent to me mention for dynamic SGT assignment, ISE will use Radius authorization to tell the switch about SGT, not using SXP