The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
A network device at the ingress of a Cisco TrustSec domain must have the security group tag (SGT) for the entering packet so that it can then tag it with this SGT before it forwards the packet into the domain. The egress network device determines the SGT of the packet in order to apply a security group access control list (SGACL).
The Identity Port Mapping (IPM) feature enables the ingress network device to determine the source SGT based on the source identity. IPM is implemented by configuring the link with the identity of the connected peer so that the ingress network device can request policy information, including SGT and trust state, from the authentication server.
IPM is supported for the following ports:
Routed ports
Switchports in access mode
Switchports in trunk mode
If no SAP parameters are defined, Media Access Control Security (MACsec) encapsulation or encryption is not performed.
TrustSec layer 2 IPM uses the policy static sgt command to configure a physical port so that a single SGT is imposed on all traffic entering the port. This SGT is then applied on all IP traffic exiting the port until a new binding is learned.
The Cisco TrustSec L3 IPM feature provides a dynamic method where the Cisco access control system (ACS) access server assigns the SGT based on the device ID mapping in the ACS for filtering at egress interfaces where no directly connected hosts (other than the next hop router) exists.
TrustSec layer 3 IPM uses the policy dynamic identity command to designate a peer name as non-trusted in the Cisco ACS or Cisco ISE configuration.
This feature can be used to identify places in the network egress interfaces (e.g. campus, extranet, internet) that need to be filtered so that guest access (group SGT) to the extranet (the business partner connection) is denied.
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
| Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 3 |
interface type slot/port Example: |
Enters interface configuration mode for the uplink interface. |
||
| Step 4 |
cts manual Example: |
Enters Cisco TrustSec manual configuration mode. |
||
| Step 5 |
policy dynamic identity peer-name Example: |
|
||
| Step 6 |
policy static sgt tag [trusted ] Example: |
|
||
| Step 7 |
exit Example: |
Exits Cisco TrustSec manual interface configuration mode. |
||
| Step 8 |
no shutdown Example: |
Enables the interface and enables Cisco TrustSec authentication on the interface. |
The following example shows how to configure Cisco TrustSec authentication in manual mode on an interface:
Device# configure terminal
Device(config)# interface gi2/1
Device(config-if)# cts manual
Device(config-if-cts-manual)# sap pmk 1234abcdef mode-list gcm null no-encap
Device(config-if-cts-manual)# exit
Device(config-if)# shutdown
Device(config-if)# no shutdown
Device(config-if)# exit
Device(config)# exit|
Related Topic |
Document Title |
|---|---|
|
Cisco IOS commands |
|
|
Security commands |
|
|
Cisco TrustSec and SXP configuration |
|
|
IPsec configuration |
|
|
IKEv2 configuration |
Configuring Internet Key Exchange Version 2 (IKEv2) and FlexVPN Site-to-Site |
|
Cisco Secure Access Control Server |
|
Description |
Link |
|---|---|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
TrustSec Identity Port Mapping |
15.1(1)SY |
The Identity Port Mapping (IPM) feature enables the ingress network device to determine the source security group tag (SGT) based on the source identity. IPM is implemented by configuring the link with the identity of the connected peer so that the ingress network device can request policy information, including SGT and trust state, from the authentication server. The following command was introduced: policy static sgt . |
|
Cisco TrustSec L3 Identity Port Mapping |
15.1(1)SY |
The Cisco TrustSec L3 Identity Port Mapping feature provides a dynamic method where the Cisco access control system (ACS) access server assigns the SGT based on the device ID mapping in the ACS for filtering at egress interfaces where no directly connected hosts (other than the next hop router) exists. The following command was introduced: policy dynamic identity . |
Feedback