Hi, I have very similar question also. Let's say, we have next topology:web-srv<-->L2sw(cts_enforcement)<-->ISR_G2(inline_tagging)<-->ASA(Remote-access)<-->InetRA users authenticated via RADIUS by ISE, SGT tags are assigned as part of authorization. ...