Cisco TrustSec User Manual

C-3
Cisco TrustSec Configuration Guide
OL-22192-01
Appendix C Notes for Catalyst 6500 Series Switches
Flexible NetFlow Support
Configuration Excerpt of an IPv6 Flow Monitor
router(config)# flow monitor cts-monitor-ipv6
router(config-flow-monitor)# record cts-record-ipv6
Configuration Excerpt of the Global Flow Monitor (IPv4 and IPv6)
The following configuration applies the Flow Monitor to packets dropped by Role-Based Access Control
Lists (RBACLs) for all TrustSec interfaces on the router or switch:
router(config)# cts role-based ip flow monitor cts-monitor-ipv4 dropped
router(config)# cts role-based ipv6 flow monitor cts-monitor-ipv6 dropped
Configuration Excerpt of the Interface Monitor
The Flow Monitor can be attached per interface, configured to filter for combinations of ingress (input),
egress (output), multicast, unicast, or Layer2 switched traffic.
For IPv6, flow monitor is supported only for routed traffic in Cisco IOS Release 12.2(50)SY.
router(config)# interface TenGigabitEthernet 8/1
router(config-if)# ip address 192.1.1.1 255.255.255.0
;; Ingress IPv4 unicast only and egress unicast only
router(config-if)# ip flow monitor cts-monitor-ipv4 unicast input
router(config-if)# ip flow monitor cts-monitor-ipv4 unicast output
;; Ingress IPV4 L2-switched traffic only
router(config-if)# ip flow monitor cts-monitor-ipv4 layer2-switched input
;; Ingress Ipv4 multicast and egress IPv4 multicast traffic only
router(config-if)# ip flow monitor cts-monitor-ipv4 multicast input
router(config-if)# ip flow monitor cts-monitor-ipv4 multicast output
;; For both Unicast/multicast egress traffic
router(config-if)# ip flow monitor cts-monitor-ipv4 output
;; For both Unicast/multicast ingress traffic
router(config-if)# ip flow monitor cts-monitor-ipv4 input
;; For Ipv6 only the following are supported in Cisco IOS Release 12.2(50)SY
router(config-if)# ipv6 address 2022::22:1:1:11/64
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 input
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 unicast input
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 output
router(config-if)# ipv6 flow monitor cts-monitor-ipv6 unicast output
Flexible NetFlow Show Commands
show flow record
show flow monitor
show flow exporter
show flow interface
show cts role-based counters
show flow monitor <monitor_name> cache

Cisco TrustSec Specifications

General

Category	Network Security
Functionality	Provides role-based access control, network segmentation, and policy enforcement.
Key Components	Security Group Tags (SGT), Security Exchange Protocol (SXP).
Authentication Methods	802.1X, MAC Authentication Bypass (MAB), Web Authentication
Security Group Tagging (SGT)	Assigns security group tags to users and devices for identity-based segmentation.
Security Exchange Protocol (SXP)	A protocol used to propagate SGT information across network devices.
Policy Enforcement	Enforces security policies based on SGTs and SGACLs.
Benefits	Enhanced security, simplified policy management, and improved compliance.
Encryption	Supports encryption for data in transit through IPsec and MACsec.
Scalability	Scalable to large enterprise networks with thousands of devices.
Compatibility	Compatible with a wide range of Cisco network devices.
Description	Cisco TrustSec is a security architecture framework designed to build secure networks. It uses identity-based access control to segment the network and enforce policies based on user roles and device types, rather than relying solely on IP addresses.