EasyManua.ls Logo

Cisco TrustSec User Manual

Cisco TrustSec
208 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #196 background imageLoading...
Page #196 background image
C-2
Cisco TrustSec Configuration Guide
OL-22192-01
Appendix C Notes for Catalyst 6500 Series Switches
Flexible NetFlow Support
Flexible NetFlow can account for packets dropped by SGACL enforcement when SGT and DGT flow
objects are configured in the flow record with the standard 5-tuple flow objects
Use the flow record
and flow exporter global configuration commands to configure a flow record, and
a flow exporter, then use the flow monitor command to add them to a flow monitor. Use the show flow
show commands to verify your configurations.
To collect only SGACL dropped packets, use the [no] cts role-based {ip | ipv6} flow monitor dropped
global configuration command.
For Flexible NetFlow overview and configuration information, see the following documents:
Flexible NetFlow Configuration Guide, Cisco IOS Release 15S
http://www.cisco.com/en/US/docs/ios-xml/ios/fnetflow/configuration/15-s/fnf-15-s-book.html
Catalyst 6500 Release 15.0SY Software Configuration Guide
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/15_0_sy_
swcg.html
Sample Configurations
Configuration Excerpt of an IPV4 Flow Record (5-tuple, direction, SGT, DGT)
router(config)# flow record cts-record-ipv4
router(config-flow-record)# match ipv4 protocol
router(config-flow-record)# match ipv4 source address
router(config-flow-record)# match ipv4 destination address
router(config-flow-record)# match transport source-port
router(config-flow-record)# match transport destination-port
router(config-flow-record)# match flow direction
router(config-flow-record)# match flow cts source group-tag
router(config-flow-record)# match flow cts destination group-tag
router(config-flow-record)# collect counter packets
Configuration Excerpt of an IPV6 Flow Record (5-tuple, direction, SGT, DGT)
router(config)# flow record cts-record-ipv6
router(config-flow-record)# match ipv6 protocol
router(config-flow-record)# match ipv6 source address
router(config-flow-record)# match ipv6 destination address
router(config-flow-record)# match transport source-port
router(config-flow-record)# match transport destination-port
router(config-flow-record)# match flow direction
router(config-flow-record)# match flow cts source group-tag
router(config-flow-record)# match flow cts destination group-tag
router(config-flow-record)# collect counter packets
Configuration Excerpt of an IPv4 Flow Monitor
router(config)# flow monitor cts-monitor-ipv4
router(config-flow-monitor)# record cts-record-ipv4

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco TrustSec and is the answer not in the manual?

Cisco TrustSec Specifications

General IconGeneral
CategoryNetwork Security
FunctionalityProvides role-based access control, network segmentation, and policy enforcement.
Key ComponentsSecurity Group Tags (SGT), Security Exchange Protocol (SXP).
Authentication Methods802.1X, MAC Authentication Bypass (MAB), Web Authentication
Security Group Tagging (SGT)Assigns security group tags to users and devices for identity-based segmentation.
Security Exchange Protocol (SXP)A protocol used to propagate SGT information across network devices.
Policy EnforcementEnforces security policies based on SGTs and SGACLs.
BenefitsEnhanced security, simplified policy management, and improved compliance.
EncryptionSupports encryption for data in transit through IPsec and MACsec.
ScalabilityScalable to large enterprise networks with thousands of devices.
CompatibilityCompatible with a wide range of Cisco network devices.
DescriptionCisco TrustSec is a security architecture framework designed to build secure networks. It uses identity-based access control to segment the network and enforce policies based on user roles and device types, rather than relying solely on IP addresses.

Summary

Cisco TrustSec Overview

Information about Cisco TrustSec Architecture

Describes the elements and processes that create the Cisco TrustSec network.

Authentication

Covers topics related to device and user authentication within Cisco TrustSec.

Security Group-Based Access Control

Details access control policies based on security groups and SGTs.

Configuring the Cisco TrustSec Solution

Configuring Identities, Connections, and SGTs

Configuring Credentials and AAA for a Cisco TrustSec Seed Device

Details steps to configure credentials and AAA for a Cisco TrustSec seed device.

Configuring Credentials and AAA for a Cisco TrustSec Non-Seed Device

Details steps to configure credentials and AAA for a Cisco TrustSec non-seed device.

Enabling Cisco TrustSec Authentication and MACsec in 802.1X Mode on an Uplink Port

Explains how to enable TrustSec authentication and MACsec using 802.1X on an uplink port.

Configuring Cisco TrustSec and MACsec in Manual Mode on an Uplink Port

Guides on manually configuring Cisco TrustSec and MACsec on an uplink port.

Manually Configuring IP-Address-to-SGT Mapping

Discusses mapping IP addresses to SGTs manually.

Subnet to SGT Mapping

Details mapping SGTs to all host addresses within a specified subnet.

VLAN to SGT Mapping

Explains binding SGTs to packets from a specified VLAN.

Layer 3 Logical Interface to SGT Mapping (L3IF–SGT Mapping)

Maps SGTs to traffic of any Layer 3 interface.

Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport

Configuring Cisco TrustSec SXP

Describes how to configure the SGT Exchange Protocol (SXP) on switches.

Configuring an SXP Peer Connection

Details how to configure SXP peer connections on both devices.

Configuring Layer 3 SGT Transport Between Cisco TrustSec Domains

Guides on configuring Layer 3 SGT Transport for cross-domain traffic.

Configuring SGACL Policies

SGACL Policy Configuration Process

Outlines the steps to configure and enable Cisco TrustSec SGACL policies.

Manually Configuring SGACL Policies

Guides on manually configuring SGACL policies by binding ACLs to SGTs.

Configuring Endpoint Admission Control

Information About Endpoint Admission Control

Explains endpoint authentication and authorization methods in TrustSec networks.

802.1X Authentication Configuration

Details the basic 802.1X configuration for a Gigabit Ethernet port.

MAC Authentication Bypass Configuration

Explains MAC Authentication Bypass (MAB) for non-802.1X capable clients.

Cisco TrustSec Command Summary

Related product manuals