SGT mapping to pxGrid learned users (Citrix TS agent example)

[Istvan Segyik]

Dear Colleagues,

I learned yesterday that our Terminal Services agent actually CAN put 'IP:port«»user' mapping data into pxGrid and WSA 11.8 is going to be able to read and use that data along AD group info taken through pxGrid 2.0. At least as far as I understood from the CX NPI training.

However as far as I understood SGT is not mapped to the user. I know that in TrustSec SGT can only be mapped to IP. But if the customer is using SGT aware Firewall or WSA Access rules where SGT is queried along with the user anyway, could we make ISE possible to add SGTs to these TS Agent published mappings somehow? Or could we make TS agent able to handle multiple SGTs and IP addresses and PAT the Virtual Desktop to the IP:SGT pair based on user attributes.

It might be a roadmap item to consider. 

Istvan

[kthumula]

Istvan, very good question. As you said we are working towards a solution or rather I call an agent which would work with MS term sever or Citrix Environment where multiple users coming with a single IP would be allocated an IP per user from the proposed agent. ISE can then assign the SGTs for the users and in turn share those IP-SGT mappings via SXP and pxGrid to the rest of the network.

As far as timelines are concerned I cannot provide an estimate but it is in development.

[netadmin111112]

Hi kthumula,

is there any news on this topic?

Is this already possible?

Best regards

Ralph

[marce1000]

     >.... I cannot provide an estimate but it is in development.

[wagner]

Do you need someone for testing?

[thomas · Accepted solution]

Yes, there is a REST API to map an IP:port to a Username for virtual desktop environments or terminal services for Passive IDentity.  See Cisco Identity Services Engine Passive Identity Connector Administrator Guide, Release 3.1 > Providers > API Calls

SGT represent a security group. The security group can represent any group of user or endpoints - it is up to you own how you define it.   Typically ISE assigns an SGT based on an 802.1X Authentication but can be from any ISE Authorization Rule.

The terminal service or VDI system needs to send this information to ISE in order for it to propogate the information to a Firewall or WSA or other pxGrid Client.