TrustSec without MacSec (only SGT and Enforcement)

[nuno.santos]

Is it possible to perform SGT propagation only using cts manual with sap no-encapsulation keeping the enforcement? Ideia is on LAN Uplinks to use only SGT without any kind of macsec (authentication and/or encryption).

Thanks,

Nuno

[Rob Ingram · Accepted solution]

Yes, you can propgate SGTs via inline tagging (cts manual command) or SXP. You don't need to use MACSec. Checkout the TrustSec matrix for info on what devices support inline tagging and enforcement http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/platform-capability-matrix.pdf