cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
222
Views
0
Helpful
3
Replies
Highlighted
Beginner

TrustSec Local Authentication on Cat3K

Dear all, 

 

I would just like to confirm the following mismatched specification on Cat3K different version.

So normally in my understanding when locally DOT1X authentication success then the switches learn & create IP-SGT mapping table below but according to IOS-XE-Ver.16.X suddenly it can not learn with IOS-XE.Ver.3.X same configuration.

 

*IOS-XE-Ver.03.07.05.E

Cat3650#sh cts role-based sgt-map all
Active IPv4-SGT Bindings Information

IP Address SGT Source
============================================
1.1.1.1 12 SXP
10.0.40.1 201 LOCAL

 

*IOS-XE-Ver.16.03.06

Cat3650#sh cts role-based sgt-map all
Active IPv4-SGT Bindings Information

IP Address SGT Source
============================================
1.1.1.1 12 SXP

 

So I appreciate if there is any additional configuration or specification from 16.X.

 

Best Regard,

 

Masanobu Hiyoshi

 

 

 

 

 

Everyone's tags (1)
3 REPLIES 3
VIP Mentor

Re: TrustSec Local Authentication on Cat3K

Hello,

 

how did you configure CTS in 3.x ?

VIP Mentor

Re: TrustSec Local Authentication on Cat3K

Hello,

 

not sure if this applies to you, but check the bug below:

 

CTS Untrusted Port with SGT not updated by SISF for IP-SGT
CSCuw77872
Description
Symptom:
IP-SGT mappings are not made for IP hosts learnt on interfaces that are not configured as trusted under cts-manual sub-mode.

Conditions:
When an interface is configured with 'cts manual' without an explicit 'trusted' keyword as in "policy static sgt trusted"

Workaround:
Configure the interface as trusted using 'policy static sgt trusted" configuration under cts manual sub-mode

Beginner

Re: TrustSec Local Authentication on Cat3K

Hi Georg,

 

Thank you very much!

I think the bug is very similar to my verification however the following output occur that Dot1x auth can not co-exist with cts manual configuration below.

 

Cat3650#sh run int Gi1/0/1
*omit
!
interface GigabitEthernet1/0/1
description ###### HOST #####
switchport access vlan 40
switchport mode access
authentication port-control auto
dot1x pae authenticator
end

Cat3650#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Cat3650(config)#int Gi1/0/1
Cat3650(config-if)#cts manual
Command rejected (Gi1/0/1): conflict with Dot1x Auth

 

Best Regards,

 

Masanobu Hiyoshi

 

 

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards