I had always thought that CTS binding priority was the same throughout TrustSec until recently I discovered that isn't true. Below is the SGT Binding priority that I have always worked with. 1.VLAN - Bindings learned from snooped ARP packets on a VLAN that has VLAN-SGT mapping configured 2.CLI - Address bindings configured using the IP_SGT form of the "cts role-based sgt-map" global configuration command 3.Layer 3 Interface - Bindings added du to FIB forwarding entries that have paths through one or more interfaces with consistent L3IF-SGT mapping or Identity Port Mapping on routed ports. 4.SXP - Bindings learned from SXP peers 5.IP_ARP - Bindings learned when tagged ARP packets are received on a CTS capable link 6.LOCAL - Bindings of authenticated hosts which are learned via device tracking. These type of binding also includes individual hosts that are learned via ARP snooping on L2 ports. Direct switch enforcement. These fall under dynamic classification. 7.INTERNAL - Bindings between locally configured IP addresses and the devices own SGT. So, things like loopback addresses or addresses that are locally configured on the device can have and SGT assigned to them.   Now, I have found out that for Nexus NX-OS devices the priority isn't the same. This appears to be the Nexus priority. 1.Cisco Fabric Services (CFS) - CTS IP-SGT bindings learnt on vPC peer. This is applicable only to vPC peer devices. 2.VLAN-SGT - Bindings learned from snooped ARP or DHCP packets on a VLAN that is configured with a VLAN-SGT mapping. 3 . SGT-caching - IP-SGT bindings learnt on a VLAN or VRF, where SGT-caching is configured. 4. SXP - Bindings learned from SXP peers. 5.Learnt on interface - Bindings of authenticated hosts which are learned via EPM and device tracking. This type of binding also include individual hosts that are learned via ARP snooping on L2 [I]PM configured ports. 6.CLI - Address bindings configured using the IP-SGT form of the cts role-based sgt-map global configuration command. 7.Port ASIC - SGT bindings derived inline or directly from the port, based on CTS trusted or untrusted configuration. Question: Is there anyone at Cisco that can provide a listing of priorities based on platform since it appears that this is not standard across all devices participating in TrustSec? ... View more

I am currently deploying TrustSec in an environment and I am looking for documentation for how to deal with Bluecoat Proxies,  SilverPeak WAN Optimization using WCCP and Citrix NetScaler Load Balancing. I think SGT Caching is answer but looking for other opinions as well as documentation that may show/explain how this works. Has anyone experienced this? ... View more