Default Policy between SGTs

[jnfern1589]

Hi,

Evaluating TrustSec / ISE prior to deployment, I've already come across the pitfalls of using a "default deny" / deny policy with the 'unknown' destination SGT - as the DGT is only known at the destination (but enforced at the source).

Is there any way to create a policy that applies to 'all known SGTs' so we could default-deny traffic between devices that have been classified and assigned SGTs without having to manually create the policy (or programatically via the API etc) and update each time we create a new SGT?

Example scenario is NAC/TrustSec across campus where we don't want east-west communication, but off-campus traffic (DC, Internet etc) doesn't get SGTs and is allowed within TrustSec land (using external firewalls to actually police this).

Cheers,

-Jeff

[jeaves@cisco.com]

Hi Jeff,

let's start with asking if you're familiar with using 'unknown' in the TrustSec policy matrix.

See unknown as both a SGT choice and a DGT choice in the matrix:

Does this help with a default deny whereby you can assign permits if the destination is unknown?

Firewalls also support the concept of unknown SGT (it is SGT 0).

Let us know.

Thanks.

[jnfern1589]

Hi,

Thanks. Adding a matrix of permit from every SGT to <unknown> destination would work (although feels a little clunky). As a side problem, our 4500-X are having issues with BFD when a PERMIT trustsec policy is applies to the NDAC SGT (support case is currently open on this).

Our firewall isn't TrustSec aware / capable, so we're not able to use anything within this.

Cheers,

-Jeff

[jeaves@cisco.com]

If you forward the support case reference for the 4500-X BFD issue I'll take a look.

Would like to know the software release running.

[jnfern1589]

I've finally got the case raised to TAC - reference number is SR682886788.

[jnfern1589]

We're running 3.8.4 on the 4500-X (a VSS pair). The support request is currently with our provider, so I don't have a Cisco TAC reference to give you (yet).