About Antonio Macia

Antonio Macia · 05-11-2023

Hi,After running the cts role-based enforcement vlan-list 200 in an access switch, the devices can no longer reach its gateway (SVI in a distribution switch) Without reachability to the gateway, outside connectivity is also lost.The uplink between th...

Antonio Macia · 04-18-2023

Hi,I'm struggling understanding the inline SGT propagation commands when there is a device that does not support or does not have CTS enabled. Two scenarios here:Let's say I have an access switch with Trustsec enabled and a third party distribution s...

Antonio Macia · 10-03-2022

Hi, We are migrating APs from a 2504 to a vWLC controller. Both on the same version. Doing test with a single AP by manually changing the WLC IP on the AP, it is not joining the vWLC. We have accepted the EULA to avoid licenses issues. These is the o...

Antonio Macia · 06-30-2022

Hi, In a Trustsec environment where devices within the same VLAN are not allowed to communicate, layer two traffic like ARP would be also blocked, right? This approach would allow us to have larger subnets without the caveats of the increase on the...

Antonio Macia · 06-22-2022

Hi, I'm trying to create an account for the integration in pxGrid of the Palo Alto's TrustSec plug-in but I'm getting an error saying that the service is not available. This is the first pxGrid client I'm registering in ISE. I run a diagnostic tes...

Antonio Macia · 05-11-2023

The SGT is 94 and the intent is to block horizontal traffic while allowing north-south:show cts role-based permissions from 94 to 94IPv4 Role-based permissions from group 94:DUMMY_SGT to group 94:DUMMY_SGT:Deny IP-00show cts rbaclCTS RBACL Policy====...

Antonio Macia · 04-19-2023

Hi Damien,For the first scenario, I was testing this and north-south traffic is getting dropped. That's why I assumed that the "no sgt propagation" command is needed. Are you sure it is not? Non-CTS enabled devices ignore the CMD and forward the traf...

Antonio Macia · 10-03-2022

Hi, It doesn't work. I tried adding the MAC even if there is no AP policy configuration. Thx.

Antonio Macia · 07-01-2022

For traffic destined to the switch itself I understand it will be punted to the CPU, but from the endpoints perspective they won't receive other's ARP traffic if not allowed by the matrix, right?

Antonio Macia · 06-23-2022

No firewall. Running the command returns "2.0" That might be the issue. The Palo Alto plug-in is compatible with version 1.0 only....

Member Since	‎01-18-2010 02:18 PM
Date Last Visited	‎05-17-2023 12:01 AM
Posts	229
Total Helpful Votes Received	26

User Statistics

User Activity

VLAN SVI unreachable after enabling CTS VLAN enforcement

Inline tagging propagation

AP not joining WLC

Broadcast control with SGTs and microsegmentation

pxGrid - 503 Service unavailable

Re: VLAN SVI unreachable after enabling CTS VLAN enforcement

Re: Inline tagging propagation

Re: AP not joining WLC

Re: Broadcast control with SGTs and microsegmentation

Re: pxGrid - 503 Service unavailable