<\/span><\/h2>\nCisco TrustSec operates as an identity-aware security framework coordinated by Cisco ISE as the central policy controller. The architecture functions through three sequential phases: Classification<\/strong>, Propagation<\/strong>, and Enforcement<\/strong>.<\/p>\n +------------------+ +-------------------+ +--------------------+\n | Classification | -----> | Propagation | -----> | Enforcement |\n | (Ingress NAD) | | (Network Fabric) | | (Egress NAD) |\n | Identity -> SGT | | CMD \/ SXP \/ L3 | | Match SGACL Matrix |\n +------------------+ +-------------------+ +--------------------+\n<\/code><\/pre>\n<\/span>1. Classification (Ingress)<\/span><\/h3>\nClassification occurs at the ingress network access device (NAD)\u2014such as a campus switch, wireless LAN controller (WLC), or VPN gateway\u2014at the moment an endpoint connects:<\/p>\n
\n- Authentication<\/strong>: The endpoint authenticates via 802.1X, MAC Authentication Bypass (MAB), or Web Authentication.<\/li>\n
- Policy Evaluation<\/strong>: Cisco ISE matches the session against authentication and authorization policies, evaluating context such as user role, device posture, location, and group membership.<\/li>\n
- SGT Assignment<\/strong>: ISE returns a RADIUS Access-Accept containing the
cisco-av-pair<\/code> attribute specifying a 16-bit numeric identifier known as a Security Group Tag (SGT) (for example, cts:security-group-tag=0004-02<\/code>).<\/li>\n- Binding<\/strong>: The ingress switch binds the endpoint’s IP and MAC address to the assigned SGT in its local forwarding table. Alternatively, static classification can bind SGTs to VLANs, subnets, physical switch ports, or DNS domains.<\/li>\n<\/ol>\n
<\/span>2. Propagation (Network Fabric)<\/span><\/h3>\nOnce the packet enters the network, its identity context must travel alongside the payload from the source switch to the destination device. TrustSec handles this through two transport models:<\/p>\n
\n- Inline Tagging<\/strong>: The ingress switch inserts a 16-bit SGT directly into the Layer 2\/Layer 3 frame header using Cisco Metadata (CMD) or VXLAN encapsulation headers (in Cisco SD-Access environments). As the packet traverses intermediate routers and switches, the tag remains intact at wire speed without requiring stateful lookups on transit hops.<\/li>\n
- SGT Exchange Protocol (SXP)<\/strong>: On hops or legacy networks where hardware-level inline tagging is unsupported, switches share IP-to-SGT binding tables over a TCP control-plane session directly with other enforcement points or ISE.<\/li>\n<\/ul>\n
<\/span>3. Enforcement (Egress)<\/span><\/h3>\nEnforcement occurs at the egress switch or firewall closest to the destination resource:<\/p>\n
\n- Lookup<\/strong>: The egress device inspects the inbound packet to identify the Source SGT<\/strong> (carried inline or resolved via an IP-to-SGT binding table).<\/li>\n
- Destination Resolution<\/strong>: The device resolves the Destination SGT<\/strong> assigned to the targeted resource using its own local bindings.<\/li>\n
- Policy Evaluation<\/strong>: The egress device checks the combination against the TrustSec Egress Policy Matrix downloaded locally from Cisco ISE.<\/li>\n
- Action<\/strong>: The switch applies the corresponding Security Group Access Control List (SGACL), permitting, denying, or logging the traffic at line rate directly within the device’s hardware Ternary Content-Addressable Memory (TCAM).<\/li>\n<\/ol>\n
\n<\/span>Cisco TrustSec vs. Traditional VLAN Segmentation: Key Differences<\/span><\/h2>\nWhile traditional network segmentation relies on physical or logical topology (subnets, VLANs, and firewall interfaces), TrustSec implements software-defined microsegmentation that remains persistent regardless of where a device connects.<\/p>\n
\n\n\n| Architectural Dimension<\/th>\n | Traditional VLAN & IP ACL Segmentation<\/th>\n | Cisco TrustSec Role-Based Microsegmentation<\/th>\n<\/tr>\n<\/thead>\n |
\n\nAddressing Model<\/strong><\/td>\n| Tightly coupled to subnets, VLAN IDs, and static IP blocks.<\/td>\n | Decoupled from IP addressing; relies on logical 16-bit SGTs.<\/td>\n<\/tr>\n | \nAccess Control Engine<\/strong><\/td>\n| Extended IP ACLs containing thousands of source\/destination IP pairs.<\/td>\n | Matrix of Source SGT $\\times$ Destination SGT referencing compact SGACLs.<\/td>\n<\/tr>\n | \nTCAM Utilization<\/strong><\/td>\n| High; long wildcard-mask rule chains consume switch hardware memory rapidly.<\/td>\n | Minimal; rules evaluate single numeric SGT pairs regardless of IP quantity.<\/td>\n<\/tr>\n | \nOperational Agility<\/strong><\/td>\n| Endpoint relocation requires IP renumbering, VLAN trunking, and firewall rule updates.<\/td>\n | Endpoints move freely; SGT policies remain identical across any port or subnet.<\/td>\n<\/tr>\n | \nBroadcast Domains<\/strong><\/td>\n| Stretched VLANs across core switches increase spanning tree blast radius.<\/td>\n | Routed access with localized subnets; segmentation enforced at egress.<\/td>\n<\/tr>\n | \nEast-West Traffic Filtering<\/strong><\/td>\n| Difficult inside the same VLAN; requires private VLANs or firewall hair-pinning.<\/td>\n | Native intra-VLAN and intra-subnet filtering supported directly on switch ports.<\/td>\n<\/tr>\n | \nRule Maintenance Complexity<\/strong><\/td>\n| Combinatorial explosion: $O(N^2)$ rule scaling as host counts expand.<\/td>\n | Normalized policy matrix: scales linearly with distinct organizational roles.<\/td>\n<\/tr>\n | \nPolicy Administration<\/strong><\/td>\n| Fragmented across individual firewalls, router interfaces, and switch configs.<\/td>\n | Centralized in Cisco ISE; automatically downloaded by network devices.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n<\/span>Step-by-Step: Configuring Cisco TrustSec and SGTs in Cisco ISE<\/span><\/h2>\nConfiguring Cisco TrustSec involves setting up network device authorization, defining security groups, creating SGACL rules, structuring the egress matrix, and deploying policies to network devices.<\/p>\n +-----------------------------------------------------------------------------------------+\n| STEP 1: Enable TrustSec on NAD |\n| Administration > Network Resources > Network Devices |\n+-----------------------------------------------------------------------------------------+\n |\n v\n+-----------------------------------------------------------------------------------------+\n| STEP 2: Define Security Group Tags (SGTs) |\n| Work Centers > TrustSec > Components > Security Groups |\n+-----------------------------------------------------------------------------------------+\n |\n v\n+-----------------------------------------------------------------------------------------+\n| STEP 3: Create Security Group Access Control Lists (SGACLs) |\n| Work Centers > TrustSec > Components > Security Group ACLs |\n+-----------------------------------------------------------------------------------------+\n |\n v\n+-----------------------------------------------------------------------------------------+\n| STEP 4: Build the TrustSec Egress Policy Matrix |\n| Work Centers > TrustSec > TrustSec Policy > Egress Policy |\n+-----------------------------------------------------------------------------------------+\n |\n v\n+-----------------------------------------------------------------------------------------+\n| STEP 5: Map SGTs to Ingress Authorization Rules |\n| Policy > Policy Sets > Authorization Policy |\n+-----------------------------------------------------------------------------------------+\n |\n v\n+-----------------------------------------------------------------------------------------+\n| STEP 6: Deploy and Verify Policy Provisioning |\n| Trigger CTS Environment Data Download on Network Access Devices |\n+-----------------------------------------------------------------------------------------+\n<\/code><\/pre>\n<\/span>Step 1: Enable TrustSec on the Network Access Device (NAD)<\/span><\/h3>\n\n- In Cisco ISE, navigate to Administration > Network Resources > Network Devices<\/strong>.<\/li>\n
- Select an existing switch or click Add<\/strong> to register a new device.<\/li>\n
- In the device profile, expand Advanced TrustSec Settings<\/strong>.<\/li>\n
- Check Device is TrustSec-Enabled<\/strong>.<\/li>\n
- Specify a Device ID<\/strong> and configure a secure Device Password<\/strong> (used for mutual authentication and Protected Access Credential [PAC] provisioning).<\/li>\n
- Enable Download environment data every X seconds<\/strong> (default: 86,400 seconds \/ 24 hours).<\/li>\n<\/ol>\n
<\/span>Step 2: Define Security Group Tags (SGTs)<\/span><\/h3>\n\n- Go to Work Centers > TrustSec > Components > Security Groups<\/strong>.<\/li>\n
- Click Add<\/strong> to create new identity containers.<\/li>\n
- Configure the parameters:<\/li>\n
- Name<\/strong>:
Production_Servers<\/code><\/li>\n- Tag Value<\/strong>: Select Auto-Generate<\/strong> or assign a manual decimal value (e.g.,
10<\/code>).<\/li>\n- Description<\/strong>: “Core production server farms”.<\/li>\n
- Repeat the process to create operational groups such as
Developers<\/code> (Tag: 20<\/code>) and Contractors<\/code> (Tag: 30<\/code>).<\/li>\n<\/ol>\n<\/span>Step 3: Create Security Group Access Control Lists (SGACLs)<\/span><\/h3>\n\n- Navigate to Work Centers > TrustSec > Components > Security Group ACLs<\/strong>.<\/li>\n
- Click Add<\/strong> to build reusable policy contracts.<\/li>\n
- Enter an ACL Name<\/strong> (e.g.,
SGACL_RESTRICTED_DEV<\/code>).<\/li>\n- In the IP Version<\/strong> dropdown, select IPv4<\/strong> (or IPv6\/Agnostic).<\/li>\n
- Specify the rule logic using standard permit\/deny statements:
\n text
\n permit tcp dst eq 443
\n permit tcp dst eq 80
\n permit tcp dst eq 22
\n deny ip<\/code><\/li>\n- Click Save<\/strong>.<\/li>\n<\/ol>\n
<\/span>Step 4: Build the TrustSec Egress Policy Matrix<\/span><\/h3>\n\n- Navigate to Work Centers > TrustSec > TrustSec Policy > Egress Policy > Matrix<\/strong>.<\/li>\n
- Locate the cell where the Source SGT<\/strong> row intersects with the Destination SGT<\/strong> column (e.g., Source:
Developers<\/code>, Destination: Production_Servers<\/code>).<\/li>\n- Click the cell and select Edit<\/strong>.<\/li>\n
- Assign the appropriate SGACL created in Step 3 (
SGACL_RESTRICTED_DEV<\/code>).<\/li>\n- Set the Final Catch-All Rule<\/strong> (e.g., Deny All<\/em> or Permit All<\/em>).<\/li>\n
- Click Save<\/strong>. The cell changes from clear to active (highlighted with an assigned SGACL icon).<\/li>\n<\/ol>\n
<\/span>Step 5: Map SGTs to Ingress Authorization Rules<\/span><\/h3>\n\n- Navigate to Policy > Policy Sets<\/strong>, and open the active policy set (e.g., Campus Wired<\/em>).<\/li>\n
- Expand the Authorization Policy<\/strong> section.<\/li>\n
- Create an authorization rule:<\/li>\n
- Condition<\/strong>:
ActiveDirectory:ExternalGroups EQUALS engineering-team<\/code><\/li>\n- Profile<\/strong>:
PermitAccess<\/code><\/li>\n- Security Group (SGT)<\/strong>: Select
Developers<\/code>.<\/li>\n- Save the policy set. When a developer authenticates, ISE returns the
Developers<\/code> SGT to the ingress switchport.<\/li>\n<\/ol>\n<\/span>Step 6: Deploy and Verify Policy Provisioning<\/span><\/h3>\nNetwork access devices automatically update their environment data on schedule, or you can force an immediate refresh directly from the switch CLI:<\/p>\n switch# cts refresh environment-data\nswitch# cts refresh policy\n<\/code><\/pre>\n
\n<\/span>SGT Transport Mechanisms: Inline Tagging vs. SXP Peering<\/span><\/h2>\nTransmitting identity across the enterprise requires an infrastructure strategy that matches hardware capabilities. Cisco TrustSec supports two primary methods: hardware-based Inline Tagging<\/strong> and software-based Security Group Tag Exchange Protocol (SXP)<\/strong>.<\/p>\nINLINE TAGGING (Hardware-driven, hop-by-hop)\n[Host] -> [ Switch A ] === SGT inside Ethernet\/CMD Frame ===> [ Switch B ] -> [Server]\n (Applies Tag) (Enforces Policy)\n\nSXP PEERING (Software-driven, control-plane peering over legacy IP)\n[Host] -> [ Switch A ] --------------- Standard IP Routing -------------> [ Switch B ] -> [Server]\n \\ \/\n \\== TCP 64999 (SXP Peering: IP 10.1.1.5 <-> SGT 20) =========\/\n<\/code><\/pre>\n
| | | | | | | | |