Based on my experience deploying SGT Tagging in production it's always best to start off starting with a single non-seed device (access-switch) and one seed device (core/distro) and ensure authentication and traffic flow is working to include egress ...