Enabling TrustSec "Inline Tagging" for sub-interfaces of CSR1000v

[rezaalikhani]

Hi all;

Consider the following scenario:

I this scenario I configured the router with 2 sub-interfaces with the following configuration:

• WebSRV is 192.168.100.100 GW: 192.168.100.1
• DBSRV is 192.168.100.1 GW: 192.168.100.1
• FTPSRV is 192.168.101.100 GW: 192.168.101.1

With this configuration everything works fines and the servers can ping each other:

I have also configured the router to interact with ISE:

I do not have enabled "enforcement" on the router:

I use the nearly current version if CSR1000v:

Now I decide to enable "Inline Tagging" on the subinterfaces for the purpose of "SGT over Ethernet" functionality. So, I execute the "cts manual" command on the subinterfaces:

As you can see above, doing so forces the parent interface to bounce.

Now for the testing operation, I encounter the following problem:

As you can see above, any routing operation has failed.

Any ideas?

Thanks

[Nancy Saini]

With just "cts manual" pings should not be dropped. Have you propagated different SGTs for servers? If yes, check if the traffic (ICMP) between the SGTs is allowed.

[rezaalikhani]

Thanks for your reply.

As I said, I have not configured any ACL on the switch (local ACL or SGACL).

[Damien Miller]

Does the underlying host you're running the 1000v on support inline tagging? Anytime I have seen this done with a virtual router it's with SXP connections because native inline tagging is not supported. 

When you configure cts manual you're changing the layer 2 frame ethertype and adding a new Cisco Metadata field in. A lot of Cisco hardware supports this, but this isn't usually the case with anything virtualized. 

[rezaalikhani · Accepted solution]

I run this scenario on EVE-NG.

According to the following post, because I use subinterfaces on my CSR1000v router, I do not need to execute the "cts manual" command. After executing highlighted command below, the router stared to tag inline packets and advertise them using SXP to ISE.

http://www.network-node.com/blog/2019/3/31/154-digging-into-sgt-bindings-priority-and-sxp