Buy or Renew
Buy or Renew
Cisco DNA Center is now Catalyst Center. New name, same great product. Learn more about Catalyst Center here.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1504
Views
0
Helpful
5
Replies

TrustSec not working!

OrkhanRustamli
Level 1
Level 1

‎10-22-2019 03:03 AM

Hi All,

In my fabric network Trustsec policies are not working in inter-VN traffic. I investigated and figured out that traffic from Border to Fusion passes without tagged. As I understood after Border decapsulates VXLAN it does not add CMD SGT Values.

 

What is the solution?

Labels:
0 Helpful
5 Replies 5

Preston Chilcote
Cisco Employee
Cisco Employee

‎10-22-2019 08:40 AM

I think this explains the issue and will give you some options:
https://community.cisco.com/t5/security-documents/policy-enforcement-within-sda-border/ta-p/3646816
0 Helpful

OrkhanRustamli
Level 1
Level 1
In response to Preston Chilcote

‎10-22-2019 10:07 AM

Hi Preston,

Thank you, for your help. But I have already thought about this solution with static mapping. The problem is I do not not use static IP. I have a lot of IP devices which Although sits in same subnet their SGT values are different. For example in A subnet I have SGT 1 and 2 and in B I have 3 and 4. No for writing SGACL in border I have to know which IP particular device has but is is.not solution because IPs change always.

0 Helpful

Preston Chilcote
Cisco Employee
Cisco Employee
In response to OrkhanRustamli

‎10-22-2019 11:12 AM

I believe SXP is the answer:

 

"Policy mapping—The fabric border node also maps SGT information from within the fabric to be appropriately maintained when exiting that fabric. SGT information is propagated from the fabric border node to the network external to the fabric, either by transporting the tags to Cisco TrustSec-aware devices using SGT ExchangeProtocol (SXP) or by directly mapping SGTs into the Cisco metadata field in a packet, using inline tagging capabilities implemented for connections to the border node."

 

- from https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Design-Guide-2019SEP.pdf

0 Helpful

OrkhanRustamli
Level 1
Level 1
In response to Preston Chilcote

‎10-24-2019 12:17 AM

Hi,

The problem still remains for me how I will leak mapping between VRFs? For instance when border forwards traffic from one VRF to another it sends it Fusion with Source VRF. But Border, inside that VRF is not aware another VRF`s mappings

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents