TrustSec Notifications and Updates

[REJR77]

Hi,

We have 4 ISE (2 PAN/MNT) and 2 PSN and a DNA Center.

SGT are created on DNA center, which informs ISE and then ISE pushes them to the Switches.

All looks fine as we can see SGT on switches, but can't figure out the magic ....

I created a SGT on DNAC, and on ISE I use the Push option (top right of the Webui)

If I run a TCPDUMP on the PSN I see that the SGT list is learnt by the NAD

If I run a TCPDUMP on the PAN, I see a CoA from the PAN to the NAD with something like "update-cts-environment-data" (but no SGT list).=> what i the need for this?

Is there a dcumentation that explain the role of each component PSN/PAN in the SGT Notifications and updates.

Thanks

[Xividar]

There are quite a few commands with CTS; three of the most useful are; in terms of the inner workings though - I haven't found a singe document that covers everything though.

show authentication sessions interface
show cts environmental-data
sh cts role-based sgt-map all
sh cts role-based permission