Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About kthumula
Stats
Member since
11-18-2015
35
Posts
41
Helpful
13
Solutions
Created by
kthumula
in Policy and Access
in Policy and Access
05-31-2018
12:44 PM
05-31-2018
12:44 PM
Sure Damien. We can discuss offline. I will be there at Cisco Live.
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-31-2018
12:26 PM
05-31-2018
12:26 PM
John, Make sure to enable path length filtering on the routers if you are planning to go with the SXP reflectors route. I would recommend configuring the maximum paths as 2. cts sxp limit export peer-sequence-nodes 2 cts sxp limit import peer-sequence-nodes 2
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-31-2018
12:23 PM
05-31-2018
12:23 PM
Damien, I totally understand your frustration. I hope things are fine after the path length filtering you enabled on those SXP reflectors. Let me know if you have any other scaling issues with SXP.
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-23-2018
10:12 AM
05-23-2018
10:12 AM
Totally agree Marvin. Provided the feedback to the PMs.
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-22-2018
10:38 AM
05-22-2018
10:38 AM
Marvin, As the rest of the folks stated in the thread, that is the limitation today with the security groups where we don't have inheritance. But one way to workaround that is by using ISE authZ policies with multiple AD groups added to one condition and assign an SGT based on that. Also complement that by auto-SGT assignment we have in ISE. This is not the best method and not scalable as you said.
... View more
08-04-2017
01:25 PM
Software-Defined Segmentation with SGACL Enforcement on the Access Points
... View more
Labels:
08-04-2017
09:13 AM
Check out this video of the capabilities in wireless 8.4. If you have any questions, just reply to this post and we'll answer.
... View more
Labels:
07-21-2017
12:44 PM
Jason, Good question but we need a protocol to propagate the tags which is SXP (uses TCP) in this case. Also think of this, what mappings would ASA need? Do we really need to send all the mappings or some. You are just thinking of ASA perspective which don't have much scaling limitations but what if I have a 3k? With SXP we have an option to send the selective mappings to the NADs as well from ISE. I understand the Capex but we recommend dedicated node mainly for scaling but if you have a radius PSN acting also as an SXP node then it would obviously scale less.
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
07-21-2017
12:27 PM
07-21-2017
12:27 PM
Gary, Yes that is one thing which we are planning for the future releases. I don't have the time frame but I would expect some time next year.
... View more
07-21-2017
12:24 PM
Jason, Two ways to propagate the tags in TrustSec: First with InlineTagging: If the ASA is connected to some NAD then via Inline Tagging it could receive the source Tags of the endpoints from that NAD. Next with SXP if the ASA is peered (listener) via SXP with a NAD (speaker) then it would receive the IP-SGT mappings from the NAD. Optionally if you are using ISE to share the mappings, like in your case then you need to create the SXP peering with ISE where ISE acting as the SXP Speaker would share the bindings of the endpoints and servers to the ASA. As far as the performance impact on ISE is considered we recommend a dedicated SXP node on ISE which could scale upto 250,000 IP-SGT bindings with 250 concurrent SXP connections.
... View more
06-06-2017
10:13 AM
Hi Mark, I dont think of any caveats except the fact that SGT cannot be propagated if the ASA is running NAT. Other than that you should be good. Thanks Karthik
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-02-2017
08:17 AM
05-02-2017
08:17 AM
I checked on Spark but couldn't locate you. Could you provide the email address? I can send that offline.
... View more
Created by
kthumula
in Policy and Access
in Policy and Access
05-02-2017
08:08 AM
05-02-2017
08:08 AM
Derrick, You are spot on with SGT Caching. That would strip out the SGT while entering the blue-coat proxies or SilverPeak WAN and will coming out would reattach the tag. We don't have specific deployment guide on this. But if you would like I can share a slide with you on Spark.
... View more
Created by
kthumula
in Security Documents
09-21-2016
09-21-2016
TrustSec-ACI Policy Plane Integration helps in addressing the breaches,
segmentation & compliance ch...
Public Statistics
| Date Registered | 11-18-2015 10:59 AM |
| Date Last Visited | 08-15-2019 11:36 PM |
| Total Messages Posted | 35 |
| Total Helpful Votes Received | 41 |
Helpful Votes From
.jpg "VIP Advocate"){kind=icon}
