Wireless Trustsec Enforcement - Troubleshooting in SD-Access

[Johannes_Grimm1]

Hello all,

is there a way to troubleshoot the enforcement of policies in the wireless environment within an SD-Access Fabric? Especially from wireless to wireless and without additional tools like Secure Network Analytics.

On my test environment (Catalyst 9115) I could not get any local logs and no output on debugs like cts enforcement or parser.

Best regards,

Johannes

[Andrii Oliinyk]

u could use tcpdump on the ports to APs to catch VXLAN-traffic to see if target SGT is in VXLAN-header at least. not sure u can do more...

[Preston Chilcote]

"show cts role-base counters" is probably the most popular way to troubleshoot, but of course show commands don't scale too well.  

SNA is currently the state of the art method for a scalable method, specifically the SGT Analytics feature:
https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/sna-trustsec-matrix-analytics-report-aag.html

P.S.  wireless and wired SGT enforcement occurs on Fabric Edge, so you should be able to analyze wired user policies the same as wireless (part of the value of SDA is having the same policy enforcement for both)