EasyManua.ls Logo

Cisco TrustSec User Manual

Cisco TrustSec
208 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #64 background imageLoading...
Page #64 background image
4-4
Cisco TrustSec Configuration Guide
OL-22192-01
Chapter 4 Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport
Configuring the Default SXP Password
Router(config)# cts sxp default source-ip 10.20.2.2
Router(config)# cts sxp connection peer 10.10.1.1 password default mode local listener
Configuring the Default SXP Password
By default, SXP uses no password when setting up connections. You can configure a default SXP
password for the switch. In Cisco IOS Release 12.2(50)SY and later releases, you can specify an
encrypted password for the SXP default password.
To configure a default SXP password, perform this task:
Detailed Steps for Catalyst 6500
This example shows how to configure a default SXP password:
Router# configure terminal
Router(config)# cts sxp default password Cisco123
Configuring the Default SXP Source IP Address
SXP uses the default source IP address for all new TCP connections where a source IP address is not
specified. There is no effect on existing TCP connections when you configure the default SXP source IP
address.
To configure a default SXP source IP address, perform this task:
Detailed Steps for Catalyst 6500
This example shows how to configure an SXP default source IP address:
Router# configure terminal
Router(config)# cts sxp default source-ip 10.20.2.2
Command Purpose
Step 1
Router# configure terminal
Enters configuration mode.
Step 2
Router(config)# cts sxp default password
[0 | 6 | 7] password
Configures the SXP default password. You can enter
either a clear text password (using the 0 or no option)
or an encrypted password (using the 6 or 7 option).
The maximum password length is 32 characters.
Step 3
Router(config)# exit#
Exits configuration mode.
Command Purpose
Step 1
Router# configure terminal
Enters configuration mode.
Step 2
Router(config)# cts sxp default
source-ip src-ip-addr
Configures the SXP default source IP address.
Step 3
Router(config)# exit
Exits configuration mode.

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco TrustSec and is the answer not in the manual?

Cisco TrustSec Specifications

General IconGeneral
CategoryNetwork Security
FunctionalityProvides role-based access control, network segmentation, and policy enforcement.
Key ComponentsSecurity Group Tags (SGT), Security Exchange Protocol (SXP).
Authentication Methods802.1X, MAC Authentication Bypass (MAB), Web Authentication
Security Group Tagging (SGT)Assigns security group tags to users and devices for identity-based segmentation.
Security Exchange Protocol (SXP)A protocol used to propagate SGT information across network devices.
Policy EnforcementEnforces security policies based on SGTs and SGACLs.
BenefitsEnhanced security, simplified policy management, and improved compliance.
EncryptionSupports encryption for data in transit through IPsec and MACsec.
ScalabilityScalable to large enterprise networks with thousands of devices.
CompatibilityCompatible with a wide range of Cisco network devices.
DescriptionCisco TrustSec is a security architecture framework designed to build secure networks. It uses identity-based access control to segment the network and enforce policies based on user roles and device types, rather than relying solely on IP addresses.

Summary

Cisco TrustSec Overview

Information about Cisco TrustSec Architecture

Describes the elements and processes that create the Cisco TrustSec network.

Authentication

Covers topics related to device and user authentication within Cisco TrustSec.

Security Group-Based Access Control

Details access control policies based on security groups and SGTs.

Configuring the Cisco TrustSec Solution

Configuring Identities, Connections, and SGTs

Configuring Credentials and AAA for a Cisco TrustSec Seed Device

Details steps to configure credentials and AAA for a Cisco TrustSec seed device.

Configuring Credentials and AAA for a Cisco TrustSec Non-Seed Device

Details steps to configure credentials and AAA for a Cisco TrustSec non-seed device.

Enabling Cisco TrustSec Authentication and MACsec in 802.1X Mode on an Uplink Port

Explains how to enable TrustSec authentication and MACsec using 802.1X on an uplink port.

Configuring Cisco TrustSec and MACsec in Manual Mode on an Uplink Port

Guides on manually configuring Cisco TrustSec and MACsec on an uplink port.

Manually Configuring IP-Address-to-SGT Mapping

Discusses mapping IP addresses to SGTs manually.

Subnet to SGT Mapping

Details mapping SGTs to all host addresses within a specified subnet.

VLAN to SGT Mapping

Explains binding SGTs to packets from a specified VLAN.

Layer 3 Logical Interface to SGT Mapping (L3IF–SGT Mapping)

Maps SGTs to traffic of any Layer 3 interface.

Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport

Configuring Cisco TrustSec SXP

Describes how to configure the SGT Exchange Protocol (SXP) on switches.

Configuring an SXP Peer Connection

Details how to configure SXP peer connections on both devices.

Configuring Layer 3 SGT Transport Between Cisco TrustSec Domains

Guides on configuring Layer 3 SGT Transport for cross-domain traffic.

Configuring SGACL Policies

SGACL Policy Configuration Process

Outlines the steps to configure and enable Cisco TrustSec SGACL policies.

Manually Configuring SGACL Policies

Guides on manually configuring SGACL policies by binding ACLs to SGTs.

Configuring Endpoint Admission Control

Information About Endpoint Admission Control

Explains endpoint authentication and authorization methods in TrustSec networks.

802.1X Authentication Configuration

Details the basic 802.1X configuration for a Gigabit Ethernet port.

MAC Authentication Bypass Configuration

Explains MAC Authentication Bypass (MAB) for non-802.1X capable clients.

Cisco TrustSec Command Summary

Related product manuals