Trustsec and PSN failure

[AntonioMacia]

Hi,

We are considering the use of a SGT to port map on every access switchport to enforce the traffic of the non-authenticated devices.  Once the device is authenticated it will get a dynamic SGT that will override the static mapping. The question is, how can we allow the traffic in the worst scenario when the PSNs are down. Before Trustsec we have the the concept of critical VLAN. Is there a similar "critical SGT" in TrustSec?

Regards.

[Rob Ingram · Accepted solution]

@AntonioMacia yes there is a "Critical SGT", you can use IBNS 2.0 to assign a critical SGT when the AAA server is down.

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

You can create a local SGACL to reference that critical SGT. An SGACL learned from ISE would have priority over a local SGACL, so the local SGACL would only apply when ISE is down. - https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/dna-center/215516-trustsec-whitelist-model-with-sda.html#anc18

The guide above is for a DNAC SDA deployment, but no reason why you cannot manually create everything locally if not in an SDA environment.

[AntonioMacia]

Thank you Rob. 

That was the information I was looking for.