topic Re: CTS authorization list in Network Access Control

CTS authorization list

iores — Thu, 15 May 2025 08:15:30 GMT

Hi,

I have two questions regarding:

cts authorization list mlist
aaa authorization network mlist group radius

1. What is the exact purpose of cts authorization list?

2. What mlist stands for?

I know that mlist stands for The Cisco TrustSec AAA server group but I am not sure what exactly should be put instead of mlist.

Re: CTS authorization list

Rob Ingram — Thu, 15 May 2025 08:26:50 GMT

@iores "mlist" is the name of the method list used by trustsec for authorisation, "mlist" could be named anything you want. The CTS list is used to identify the ISE PSN nodes used by trustsec.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/17-17/configuration_guide/cts/b_1717_cts_9400_cg/cisco_trustsec_overview.html

Re: CTS authorization list

Torbjørn — Thu, 15 May 2025 08:27:23 GMT

1. This enables SGACL download from ISE

2. mlist here is just the name of a AAA server group. You should here put the name of the server group of your ISE servers.

Re: CTS authorization list

iores — Thu, 15 May 2025 18:11:56 GMT

So mlist contains the same value for both commands, and that is the name of AAA server group which contains PSN with TrustSec?

Re: CTS authorization list

iores — Thu, 15 May 2025 18:13:58 GMT

Not sure I understand you. Could you, please, provide some actual configuration?

Re: CTS authorization list

Rob Ingram — Thu, 15 May 2025 18:24:11 GMT

@iores example

Re: CTS authorization list

Torbjørn — Thu, 15 May 2025 18:39:55 GMT

That's correct. I recommend having a look at the materials that @Rob Ingram have linked here. They're both great resources for CTS config!