Cisco TrustSec User Manual

7-2
Cisco TrustSec Configuration Guide
OL-22192-01
Chapter 7 Cisco TrustSec Command Summary
CTS Interface Configuration Commands
cts dot1x Enters CTS dot1x Interface Configuration mode
(config-if-cts-dot1x).
cts layer3 Enables and applies traffic and exception policies
to CTS Layer 3 Transport gateway interfaces.
cts manual (config-if) Supply local configuration for CTS
parameters
platform cts Enables the TrustSec egress or ingress reflector.
CTS dot1x Submode Commands
default (cts dot1x interface configuration
submode)
Restores defaults for CTS dot1x commands.
propagate (cts dot1x submode) Enables/disables SGT propagation in dot1x mode.
sap (cts dot1x interface submode) Configures CTS SAP for dot1x mode.
timer (cts do1x interface submode) Configures the CTS timer.
CTS Manual Interface Configuration Submode Commands
default (cts manual interface configuration
submode)
Restores default configurations for CTS manual
mode.
policy (cts manual interface configuration
submode)
Configures CTS policy for manual mode
propagate (cts manual interface configuration
submode)
Configures CTS SGT Propagation configuration
for manual mode
sap (cts manual interface submode) Configures CTS SAP for manual mode.
Cisco TrustSec Clear Commands
clear cts cache Clears TrustSec cache file by type, by filename or
all cache files.
clear cts counter Clears the counters for a single TrustSec interface
or for all interfaces
clear cts credentials Clears all CTS credentials, including all PACs.
clear cts environment-data Clears TrustSec environment data from cache.
clear cts macsec Clears MACsec counters for a specified interface.
clear cts pac Clears a PAC or all PACs from the keystore.
clear cts role-based counters Displays role-based access control enforcement
statistics for SGTs and DGTs.
clear cts server Removes the specified authentication server.

Cisco TrustSec Specifications

General

Category	Network Security
Functionality	Provides role-based access control, network segmentation, and policy enforcement.
Key Components	Security Group Tags (SGT), Security Exchange Protocol (SXP).
Authentication Methods	802.1X, MAC Authentication Bypass (MAB), Web Authentication
Security Group Tagging (SGT)	Assigns security group tags to users and devices for identity-based segmentation.
Security Exchange Protocol (SXP)	A protocol used to propagate SGT information across network devices.
Policy Enforcement	Enforces security policies based on SGTs and SGACLs.
Benefits	Enhanced security, simplified policy management, and improved compliance.
Encryption	Supports encryption for data in transit through IPsec and MACsec.
Scalability	Scalable to large enterprise networks with thousands of devices.
Compatibility	Compatible with a wide range of Cisco network devices.
Description	Cisco TrustSec is a security architecture framework designed to build secure networks. It uses identity-based access control to segment the network and enforce policies based on user roles and device types, rather than relying solely on IP addresses.