Setup ISE 3.4 PAC-less Authentication between ISE and NAD for Trustsec

Available Languages

Download Options

PDF (523.3 KB)
View with Adobe Reader on a variety of devices
ePub (596.1 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (296.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:March 19, 2025

Document ID:222858

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

The document describes the initial setup for PAC-less configuration between ISE and NAD clients for Trustsec environment data download.

Prerequisites

Requirements

Familiarity with Cisco TrustSec as a network security solution.
Knowledge of Identity Services Engine (ISE) for managing network security.
Basic understanding of Extensible Authentication Protocol (EAP) as a framework for transporting authentication information.

Components Used

Identity Services Engine (ISE) Release 3.4.x

Cisco IOS® 17.15.1 or higher

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Information

In PAC-less mode, TrustSec policies are easier to implement because they do not require a Protected Access Credential (PAC), which is usually needed for secure communication between devices and the Identity Services Engine (ISE). This approach is particularly beneficial in environments with multiple ISE nodes. If the primary node goes offline, devices can automatically switch to a backup without needing to re-establish their credentials, reducing interruptions. PAC-less authentication simplifies the process, making it more scalable and user-friendly, and supports modern security methods aligned with Zero Trust principles.

In this mode, devices start by sending a request that includes a username and password. The ISE responds by proposing a secure session. Once this session is set up, the ISE provides important information needed for secure communication. This includes a key for security and details like server identity and timing. This information is used to ensure secure and continuous access to necessary policies and data.

Configure

Configurations

Switch Configuration

In this document, the setup for PAC-less authentication is configured using the Cisco C9300 switch. Any switch running version 17.15.1 or higher can perform PAC-less authentication with the Identity Services Engine (ISE).

Step 1: Configure the Radius server and radius group on the switch under configuration terminal of the switch.

Radius server:

radius server <Server Name>
 address ipv4 <ISE Ip address> auth-port 1812 acct-port 1813
 key <Radius shared secret>

Radius Group:

aaa group server radius trustsec
 server name <Server Name>

Step 2: Map the radius server group to cts authorization and dot1x for authentication with PAC-less.

CTS Mapping:

cts authorization list cts-mlist    // cts-mlist is the name of the authorization list

Dot1x authentication:

aaa authentication dot1x default group <Server Name>
aaa authorization network cts-mlist group <Server Name>

Step 3: Configure the CTS-ID and password under the enable mode on the switch

cts credentials id <CTS-ID> password <Password>

ISE Configuration

1. On ISE, configure the network device under Administration > Network Resources > Network Devices > Network Devices. Click add to add the switch to the ISE server.

ISE Configuration - Add Network Device

2. Add the NAD IP address in the ip address field for ISE to process the radius request for the trustsec authentication from the switch.
3. Enable Radius Authenticaiton Settings for the NAD client and enter the Radius shared secret key.

4. Enable Advanced Trustsec Settings and update the Device name with CTS-ID and the password field with the password from the command (cts credentials id <CTS-ID> password <Password>).

Enable Trustsec Settings

Verify

To verify the configuration is working on the switch, run this command to check the environment data is getting downloaded to the switch


Command:

show cts environment-data

CTS Environment Data
====================
Current state = COMPLETE
Last status = Successful
Service Info Table:
Local Device SGT:
  SGT tag = 2-00:TrustSec_Devices
Server List Info:
Installed list: CTSServerList1-0001, 1 server(s):
 Server: 10.127.196.169, port 1812, A-ID 35DE97B0FA3D6B801821DF8CD0501645
          Status = ALIVE
          auto-test = FALSE, keywrap-enable = FALSE, idle-time = 60 mins, deadtime = 20 secs
Security Group Name Table:
    0-00:Unknown
    2-00:TrustSec_Devices
    3-00:Network_Services
    4-00:Employees
    5-00:Contractors
    6-00:Guests
    7-00:Production_Users
    8-00:Developers
    9-00:Auditors
    10-00:Point_of_Sale_Systems
    11-00:Production_Servers
    12-00:Development_Servers
    13-00:Test_Servers
    14-00:PCI_Servers
    15-00:BYOD
    255-00:Quarantined_Systems
Environment Data Lifetime = 86400 secs 
Last update time = 14:27:48 UTC Sun Feb 23 2025
Env-data expires in   0:23:51:23 (dd:hr:mm:sec)
Env-data refreshes in 0:23:51:23 (dd:hr:mm:sec)
Cache data applied           = NONE
State Machine is running

By running the command, cts refresh environment-data on the switch, a radius request is sent to ISE for authentication.

View Live Logs

Trustsec Data Download Succeeded

Troubleshoot

To Troubleshoot the issue, please run these debugs on the switch:

Debug Command:

debug cts environment-data all 
debug cts env 
debug cts aaa 
debug radius 
debug cts ifc events 


debug cts authentication details 

debug cts authorization all debug

Debug Snippet:

*Feb 23 14:48:14.974: CTS env-data: Force environment-data refresh bitmask 0x2

*Feb 23 14:48:14.974: CTS env-data: download transport-type = CTS_TRANSPORT_IP_UDP

*Feb 23 14:48:14.974: cts_env_data COMPLETE: during state env_data_complete, got event 0(env_data_request)

*Feb 23 14:48:14.974: @@@ cts_env_data COMPLETE: env_data_complete -> env_data_waiting_rsp

*Feb 23 14:48:14.974: env_data_waiting_rsp_enter: state = WAITING_RESPONSE

*Feb 23 14:48:14.974: Secure Key is present on the device, proceed with pac-less env-data download // initiate the PAC-Less authententication from switch

*Feb 23 14:48:14.974: cts_aaa_is_fragmented: (CTS env-data SM)NOT-FRAG attr_q(0)

*Feb 23 14:48:14.974: env_data_request_action: state = WAITING_RESPONSE

*Feb 23 14:48:14.974: env_data_download_complete:

status(FALSE), req(x0),rec(x0)

*Feb 23 14:48:14.974: status(FALSE), req(x0), rec(x0), expect(x81),

wait_for_server_list(x85), wait_for_multicast_SGT(xB5), wait_for_SGName_mapping_tbl(x1485),

wait_for_SG-EPG_tbl(x18085), wait_for_default_EPG_tbl(xC0085), wait_for_default_SGT_tbl(x600085) wait_for_default_SERVICE_ENTRY_tbl(xC000085)

*Feb 23 14:48:14.974: env_data_request_action: state = WAITING_RESPONSE, received = 0x0 request = 0x0

*Feb 23 14:48:14.974: cts_env_data_aaa_req_setup : aaa_id = 15

*Feb 23 14:48:14.974: cts_aaa_req_setup: (CTS env-data SM)Private group appears DEAD, attempt public group

*Feb 23 14:48:14.974: cts_aaa_attr_add: AAA req(0x7AB57A6AA2C0)

*Feb 23 14:48:14.974: username = #CTSREQUEST#

*Feb 23 14:48:14.974: AAA Context Add Attribute: (CTS env-data SM)attr(test)

*Feb 23 14:48:14.974: cts-environment-data = test

*Feb 23 14:48:14.974: cts_aaa_attr_add: AAA req(0x7AB57A6AA2C0)

*Feb 23 14:48:14.974: AAA Context Add Attribute: (CTS env-data SM)attr(env-data-fragment)

*Feb 23 14:48:14.974: cts-device-capability = env-data-fragment

*Feb 23 14:48:14.974: cts_aaa_attr_add: AAA req(0x7AB57A6AA2C0)

*Feb 23 14:48:14.975: AAA Context Add Attribute: (CTS env-data SM)attr(multiple-server-ip-supported)

*Feb 23 14:48:14.975: cts-device-capability = multiple-server-ip-supported

*Feb 23 14:48:14.975: cts_aaa_attr_add: AAA req(0x7AB57A6AA2C0)

*Feb 23 14:48:14.975: AAA Context Add Attribute: (CTS env-data SM)attr(wnlx)

*Feb 23 14:48:14.975: clid = wnlx

*Feb 23 14:48:14.975: cts_aaa_req_send: AAA req(0x7AB57A6AA2C0) successfully sent to AAA.

*Feb 23 14:48:14.975: RADIUS/ENCODE(0000000F):Orig. component type = CTS

*Feb 23 14:48:14.975: RADIUS(0000000F): Config NAS IP: 0.0.0.0

*Feb 23 14:48:14.975: vrfid: [65535] ipv6 tableid : [0]

*Feb 23 14:48:14.975: idb is NULL

*Feb 23 14:48:14.975: RADIUS(0000000F): Config NAS IPv6: ::

*Feb 23 14:48:14.975: RADIUS/ENCODE(0000000F): acct_session_id: 4003

*Feb 23 14:48:14.975: RADIUS(0000000F): sending

*Feb 23 14:48:14.975: RADIUS: PAC less mode, secret is present

*Feb 23 14:48:14.975: RADIUS: Successfully added CTS pacless attribute to the radius request

*Feb 23 14:48:14.975: RADIUS/ENCODE: Best Local IP-Address 10.127.196.234 for Radius-Server 10.127.196.169

*Feb 23 14:48:14.975: RADIUS: PAC less mode, secret is present

*Feb 23 14:48:14.975: RADIUS(0000000F): Send Access-Request to 10.127.196.169:1812 id 1645/11, len 249 // Radius Access Request from the switch

RADIUS: authenticator 78 8A 70 5C E5 D3 DD F1 - B4 82 57 E2 1F 95 3B 92

*Feb 23 14:48:14.975: RADIUS: User-Name [1] 14 "#CTSREQUEST#"

*Feb 23 14:48:14.975: RADIUS: Vendor, Cisco [26] 33

*Feb 23 14:48:14.975: RADIUS: Cisco AVpair [1] 27 "cts-environment-data=test"

*Feb 23 14:48:14.975: RADIUS: Vendor, Cisco [26] 47

*Feb 23 14:48:14.975: RADIUS: Cisco AVpair [1] 41 "cts-device-capability=env-data-fragment"

*Feb 23 14:48:14.975: RADIUS: Vendor, Cisco [26] 58

*Feb 23 14:48:14.975: RADIUS: Cisco AVpair [1] 52 "cts-device-capability=multiple-server-ip-supported"

*Feb 23 14:48:14.975: RADIUS: User-Password [2] 18 *

*Feb 23 14:48:14.975: RADIUS: Calling-Station-Id [31] 8 "wnlx"

*Feb 23 14:48:14.975: RADIUS: Service-Type [6] 6 Outbound [5]

*Feb 23 14:48:14.975: RADIUS: NAS-IP-Address [4] 6 10.127.196.234

*Feb 23 14:48:14.975: RADIUS: Vendor, Cisco [26] 39

*Feb 23 14:48:14.975: RADIUS: Cisco AVpair [1] 33 "cts-pac-capability=cts-pac-less" // CTS PAC Less cv-pair attribute add to the request for ISE to handle the packet for PAC-less authentication

*Feb 23 14:48:14.975: RADIUS(0000000F): Sending a IPv4 Radius Packet

*Feb 23 14:48:14.975: RADIUS(0000000F): Started 5 sec timeout

*Feb 23 14:48:14.990: RADIUS: Received from id 1645/11 10.127.196.169:1812, Access-Accept, len 313. // Authentication success

RADIUS: authenticator 92 4C 21 5C 99 28 64 8B - 23 06 4B 87 F6 FF 66 3C

*Feb 23 14:48:14.990: RADIUS: User-Name [1] 14 "#CTSREQUEST#"

*Feb 23 14:48:14.990: RADIUS: Class [25] 78

RADIUS: 43 41 43 53 3A 30 61 37 66 63 34 61 39 54 37 68 [CACS:0a7fc4a9T7h]

RADIUS: 39 79 44 42 70 2F 7A 6A 64 66 66 56 49 55 74 4D [9yDBp/zjdffVIUtM]

RADIUS: 78 34 68 63 50 4C 4A 45 49 76 75 79 51 62 4C 70 [x4hcPLJEIvuyQbLp]

RADIUS: 31 48 7A 35 50 45 39 38 3A 69 73 65 33 34 31 2F [1Hz5PE98:ise341/]

RADIUS: 35 32 39 36 36 39 30 32 31 2F 32 31 [ 529669021/21]

*Feb 23 14:48:14.990: RADIUS: Vendor, Cisco [26] 39

*Feb 23 14:48:14.990: RADIUS: Cisco AVpair [1] 33 "cts-pac-capability=cts-pac-less"

*Feb 23 14:48:14.990: RADIUS: Vendor, Cisco [26] 43

*Feb 23 14:48:14.991: RADIUS: Cisco AVpair [1] 37 "cts:server-list=CTSServerList1-0001"

*Feb 23 14:48:14.991: RADIUS: Vendor, Cisco [26] 38

*Feb 23 14:48:14.991: RADIUS: Cisco AVpair [1] 32 "cts:security-group-tag=0002-00"

*Feb 23 14:48:14.991: RADIUS: Vendor, Cisco [26] 41

*Feb 23 14:48:14.991: RADIUS: Cisco AVpair [1] 35 "cts:environment-data-expiry=86400"

*Feb 23 14:48:14.991: RADIUS: Vendor, Cisco [26] 40

*Feb 23 14:48:14.991: RADIUS: Cisco AVpair [1] 34 "cts:security-group-table=0001-17"

*Feb 23 14:48:14.991: RADIUS: PAC less mode, secret is present

*Feb 23 14:48:14.991: RADIUS(0000000F): Received from id 1645/11

*Feb 23 14:48:14.991: cts_aaa_callback: (CTS env-data SM)AAA req(0x7AB57A6AA2C0) response success

*Feb 23 14:48:14.991: AAA CTX FRAG CLEAN: (CTS env-data SM)attr(test)

*Feb 23 14:48:14.991: AAA CTX FRAG CLEAN: (CTS env-data SM)attr(env-data-fragment)

*Feb 23 14:48:14.991: AAA CTX FRAG CLEAN: (CTS env-data SM)attr(multiple-server-ip-supported)

*Feb 23 14:48:14.991: AAA CTX FRAG CLEAN: (CTS env-data SM)attr(wnlx)

*Feb 23 14:48:14.991: AAA attr: Unknown type (450).

*Feb 23 14:48:14.991: AAA attr: Unknown type (1324).

*Feb 23 14:48:14.991: AAA attr: server-list = CTSServerList1-0001.

*Feb 23 14:48:14.991: Received SLIST name. Setting cts_is_slist_send_to_binos_req to FALSE

*Feb 23 14:48:14.991: AAA attr: security-group-tag = 0002-00.

*Feb 23 14:48:14.991: AAA attr: environment-data-expiry = 86400.

*Feb 23 14:48:14.991: AAA attr: security-group-table = 0001-17.CTS env-data: Receiving AAA attributes. // Downloading the environment data

CTS_AAA_SLIST

slist name(CTSServerList1) received in 1st Access-Accept

slist name(CTSServerList1) exists

CTS_AAA_SECURITY_GROUP_TAG

CTS_AAA_ENVIRONMENT_DATA_EXPIRY = 86400.

CTS_AAA_SGT_NAME_LIST

table(0001) received in 1st Access-Accept

Copy table(0001) from installed to received because no change.

new name(0001), gen(17)

CTS_AAA_DATA_END

*Feb 23 14:48:14.991: cts_env_data WAITING_RESPONSE: during state env_data_waiting_rsp, got event 1(env_data_received)

*Feb 23 14:48:14.991: @@@ cts_env_data WAITING_RESPONSE: env_data_waiting_rsp -> env_data_assessing

*Feb 23 14:48:14.991: env_data_assessing_enter: state = ASSESSING

*Feb 23 14:48:14.991: cts_aaa_is_fragmented: (CTS env-data SM)NOT-FRAG attr_q(0)

*Feb 23 14:48:14.991: env_data_assessing_action: state = ASSESSING

*Feb 23 14:48:14.991: env_data_download_complete:

status(FALSE), req(x81),rec(xC87)

*Feb 23 14:48:14.991: Expect same as received

*Feb 23 14:48:14.991: status(TRUE), req(x81), rec(xC87), expect(x81),

wait_for_server_list(x85), wait_for_multicast_SGT(xB5), wait_for_SGName_mapping_tbl(x1485),

wait_for_SG-EPG_tbl(x18085), wait_for_default_EPG_tbl(xC0085), wait_for_default_SGT_tbl(x600085) wait_for_default_SERVICE_ENTRY_tbl(xC000085)

*Feb 23 14:48:14.991: cts_env_data ASSESSING: during state env_data_assessing, got event 4(env_data_complete)

*Feb 23 14:48:14.991: @@@ cts_env_data ASSESSING: env_data_assessing -> env_data_complete

*Feb 23 14:48:14.991: env_data_complete_enter: state = COMPLETE

*Feb 23 14:48:14.991: CTS-ifc-ev: env data reporting to core, result: Successful

*Feb 23 14:48:14.991: env_data_install_action: state = COMPLETE completed.types 0x0

*Feb 23 14:48:14.991: env_data_install_action: clean installed sgt<->sgname table

*Feb 23 14:48:14.991: Cleaning up installed sg-epg list

*Feb 23 14:48:14.991: Cleaning up installed default epg list

*Feb 23 14:48:14.991: env_data_install_action: mcast_sgt table updated

*Feb 23 14:48:14.991: Env data sync to standby status 2

*Feb 23 14:48:14.991: SLIST is the same as previous refresh. No need to send it to BINOS

*Feb 23 14:48:14.991: CTS-sg-epg-events:setting default_sg 0 to env data

Revision History

Revision	Publish Date	Comments
1.0	19-Mar-2025	Initial Release

Contributed by Cisco Engineers

Vishal Prathaban
Technical Consulting Engineer

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

This Document Applies to These Products

Identity Services Engine 3.4

Setup ISE 3.4 PAC-less Authentication between ISE and NAD for Trustsec

Available Languages

Download Options

Bias-Free Language

Contents

Introduction

Prerequisites

Requirements

Components Used

Information

Configure

Configurations

Switch Configuration

ISE Configuration

Verify

Troubleshoot

Revision History

Contributed by Cisco Engineers

Was this Document Helpful?

Contact Cisco

This Document Applies to These Products