Cisco TrustSec User Manual

ix
Cisco TrustSec Switch Configuration Guide
OL-22192-02
Preface
Revised: October 16, 2013, OL-22192-02
Organization
This guide includes the following chapters and appendixes:
Chapter or Appendix Title Description
Chapter 1, “Cisco TrustSec
Overview”
Describes the elements and processes that create
the Cisco TrustSec network.
Chapter 2, “Configuring the Cisco
TrustSec Solution”
Provides an overview of configuration tasks
required to implement a Cisco TrustSec Network.
Chapter 3, “Configuring Identities,
Connections, and SGTs”
Provides NDAC and TrustSec seed device
configuration procedures.
Chapter 4, “Configuring SGT
Exchange Protocol over TCP (SXP)
and Layer 3 Transport”
Provides SGT over TCP Protocol (SXP)
configuration procedures.
Chapter 5, “Configuring SGACL
Policies”
Provides Security Group ACL configuration
procedures from the switch CLI.
Chapter 6, “Configuring Endpoint
Admission Control”
Provides 802.1X, MAB, and WebAuth
configuration procedures for a TrustSec context.
Chapter 7, “Cisco TrustSec
Command Summary”
Provides a list of Cisco TrustSec CLI commands
with brief descriptions.
Appendix A, “Notes for Catalyst
3000 and 2000 Series Switches and
WLC 5700 Series Wireless LAN
Controllers”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 3000 and 2000 Series
Switches and WLC 5700 Series Wireless LAN
Controllers.
Appendix B, “Notes for Catalyst
4500 Series Switches”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 4500 Series Switches.
Appendix C, “Notes for Catalyst
6500 Series Switches”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 6500 Series Switches.

Cisco TrustSec Specifications

General

Category	Network Security
Functionality	Provides role-based access control, network segmentation, and policy enforcement.
Key Components	Security Group Tags (SGT), Security Exchange Protocol (SXP).
Authentication Methods	802.1X, MAC Authentication Bypass (MAB), Web Authentication
Security Group Tagging (SGT)	Assigns security group tags to users and devices for identity-based segmentation.
Security Exchange Protocol (SXP)	A protocol used to propagate SGT information across network devices.
Policy Enforcement	Enforces security policies based on SGTs and SGACLs.
Benefits	Enhanced security, simplified policy management, and improved compliance.
Encryption	Supports encryption for data in transit through IPsec and MACsec.
Scalability	Scalable to large enterprise networks with thousands of devices.
Compatibility	Compatible with a wide range of Cisco network devices.
Description	Cisco TrustSec is a security architecture framework designed to build secure networks. It uses identity-based access control to segment the network and enforce policies based on user roles and device types, rather than relying solely on IP addresses.