Copyright Page

Chapter 1. TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Finding Feature Information

Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Security Groups and SGTs

How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

Disabling CTS SGT Propagation on an Interface

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Chapter 2. Enabling Bidirectional SXP Support

Finding Feature Information

Prerequisites for Bidirectional SXP Support

Restrictions for Bidirectional SXP Support

Information About Bidirectional SXP Support

Bidirectional SXP Support Overview

How to Enable Bidirectional SXP Support

Configuring Bidirectional SXP Support

Verifying Bidirectional SXP Support Configuration

Configuration Examples for Bidirectional SXP Support

Example: Configuring Bidirectional SXP Support

Additional References for Bidirectional SXP Support

Feature Information for Bidirectional SXP Support

Chapter 3. Enablement of Security Group ACL at Interface Level

Finding Feature Information

Restrictions for Enablement of Security Group ACL at Interface Level

Information About Enablement of Security Group ACL at Interface Level

Security Group ACL Overview

Guidelines to Configure Security Group ACL

How to Configure Security Group ACL at Interface Level

Configuring Security Group ACL at Interface Level

Configuration Examples for Enablement of Security Group ACL at Interface Level

Example: Configuring Security Group ACL at Interface Level

Example: Verifying Security Group ACL at Interface Level

Additional References for Enablement of Security Group ACL at Interface Level

Feature Information for Enablement of Security Group ACL at Interface Level

Chapter 4. IPv6 Support for SGT and SGACL

Finding Feature Information

Restrictions for IPv6 Support for SGT and SGACL

Information About IPv6 Support for SGT and SGACL

Components of IPv6 Dynamic Learning

How to Configure IPv6 Support for SGT and SGACL

Generating IPv6 Addresses for IP-SGT Bindings

Configuring IPv6 IP-SGT Binding Using Local Binding

Configuring IPv6 IP-SGT Binding Using a VLAN

Verifying IPv6 Support for SGT and SGACL

Configuration Examples for IPv6 Support for SGT and SGACL

Example: Generating IPv6 Addresses for IP-SGT Bindings

Example: Configuring IPv6 IP-SGT Binding Using Local Binding

Example: Configuring IPv6 IP-SGT Binding Using a VLAN

Additional References for IPv6 Support for SGT and SGACL

Feature Information for IPv6 Support for SGT and SGACL

Chapter 5. Cisco TrustSec Network Device Admission Control

Information About Cisco TrustSec Network Device Admission Control

Cisco TrustSec NDAC Authentication for an Uplink Interface

How to Configure Cisco TrustSec Network Device Admission Control

Configuring AAA for Cisco TrustSec NDAC Devices

Configuring AAA on Cisco TrustSec Seed Devices

Configuring AAA on Cisco TrustSec Non-seed Devices

Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

Configuration Examples for Cisco TrustSec Network Device Admission Control

Example: Configuring AAA for Cisco TrustSec NAC Devices

Example: Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

Additional References

Feature Information for Cisco TrustSec Network Device Admission Control

Chapter 6. Cisco TrustSec Critical Authentication

Finding Feature Information

Prerequisites for Cisco TrustSec Critical Authentication

Restrictions for Cisco TrustSec Critical Authentication

Critical Authentication Overview

Configuring Critical Authentication

Troubleshooting Tips

Verifying Critical Authentication

Example: Configuring Critical Authentication

Additional References for Cisco TrustSec Critical Authentication

Feature Information for Cisco TrustSec Critical Authentication

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Chapter 1. TrustSec SGT Handling: L2 SGT Imposition and Forwarding

First Published: July 25, 2011

Cisco TrustSec (CTS) builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers. Communication on the links between devices in the domain is secured with a combination of encryption, message integrity check, and data-path replay protection mechanisms.

The TrustSec SGT Handling: L2 SGT Imposition and Forwarding feature allows the interfaces in a router to be manually enabled for CTS so that the router can insert the Security Group Tag (SGT) in the packet to be carried throughout the network in the CTS header.

- Finding Feature Information

- Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

The CTS network needs to be established with the following prerequisites before implementing the TrustSec SGT Handling: L2 SGT Imposition and Forwarding feature:

- Connectivity exists between all network devices

- Cisco Secure Access Control System (ACS) 5.1 operates with a CTS-SXP license

- Directory, DHCP, DNS, certificate authority, and NTP servers function within the network

- Configure the retry open timer command to a different value on different routers.

Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Security Groups and SGTs

Security Groups and SGTs

A security group is a grouping of users, endpoint devices, and resources that share access control policies. Security groups are defined by the administrator in the ACS. As new users and devices are added to the Cisco TrustSec (CTS) domain, the authentication server assigns these new entities to appropriate security groups. CTS assigns to each security group a unique 16-bit security group number whose scope is global within a CTS domain. The number of security groups in the router is limited to the number of authenticated network entities. Security group numbers do not need to be manually configured.

Once a device is authenticated, CTS tags any packet that originates from that device with an SGT that contains the security group number of the device. The packet carries this SGT throughout the network within the CTS header. The SGT is a single label that determines the privileges of the source within the entire CTS domain. The SGT is identified as the source because it contains the security group of the source. The destination device is assigned a destination group tag (DGT).

Note

The CTS packet tag does not contain the security group number of the destination device.

How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

- Disabling CTS SGT Propagation on an Interface

Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

Perform the following steps to manually enable an interface on the device for Cisco TrustSec (CTS) so that the device can add Security Group Tag (SGT) in the packet to be propagated throughout the network and to implement a static authorization policy.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface {GigabitEthernetport | Vlan number}

4.    cts manual

5.    policy static sgt tag [trusted]

6.    end

7.    show cts interface [GigabitEthernetport | Vlan number | brief | summary]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface {GigabitEthernetport | Vlan number}

Example:

Device(config)# interface gigabitethernet 0

Enters the interface on which CTS SGT authorization and forwarding is enabled

Step 4

cts manual

Example:

Device(config-if)# cts manual

Enables the interface for CTS SGT authorization and forwarding, and enters CTS manual interface configuration mode.

Step 5

policy static sgt tag [trusted]

Example:

Device(config-if-cts-manual)# policy static sgt 100 trusted

Configures a static authorization policy for a CTS security group with a tagged packet that defines the trustworthiness of the SGT.

Step 6

end

Example:

Device(config-if-cts-manual)# end

Exits CTS manual interface configuration mode and enters privileged EXEC mode.

Step 7

show cts interface [GigabitEthernetport | Vlan number | brief | summary]

Example:

Device# show cts interface brief

Displays CTS configuration statistics for the interface.

Example:

The following is sample output for the show cts interface briefcommand.

Cisco ASR 1000 Series Aggregation Services Routers and Cisco Cloud Services Router 1000V Series

Device# show cts interface brief

Global Dot1x feature is Disabled
Interface GigabitEthernet0/1/0:
CTS is enabled, mode:    MANUAL
IFC state:               OPEN
Interface Active for 00:00:40.386
Authentication Status:   NOT APPLICABLE
Peer identity:       "unknown"
Peer's advertised capabilities: ""
Authorization Status:    NOT APPLICABLE
SAP Status:              NOT APPLICABLE
Propagate SGT:           Enabled
Cache Info:
Cache applied to link : NONE

Cisco 4400 Series Integrated Services Routers

Device# show cts interface brief

Interface GigabitEthernet0/1/0
CTS is enabled, mode:     MANUAL
Propagate SGT:          Enabled
Static Ingress SGT Policy:
Peer SGT:             100
Peer SGT assignment:  Trusted

Disabling CTS SGT Propagation on an Interface

Follow these steps to disable CTS SGT Propagation on an interface in an instance when a peer device is not capable of receiving an SGT.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface {GigabitEthernetport | Vlan number}

4.    cts manual

5.    no propagate sgt

6.    end

7.    show cts interface [GigabitEthernetport | Vlan number | brief | summary]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

interface {GigabitEthernetport | Vlan number}

Example:

Router(config)# interface gigabitethernet 0

Enters the interface on which CTS SGT authorization and forwarding is enabled

Step 4

cts manual

Example:

Router(config-if)# cts manual

Enables the interface for CTS SGT authorization and forwarding.

CTS manual interface configuration mode is entered where CTS parameters can be configured.

Step 5

no propagate sgt

Example:

Router(config-if-cts-manual)# no propagate sgt

Disables CTS SGT propagation on an interface in situations where a peer device is not capable of receiving an SGT.
Note:
CTS SGT propagation is enabled by default. The propagate sgt command can be used if CTS SGT propagation needs to be turned on again for a peer device.

Once the no propagate sgt command is entered, the SGT tag is not added in the L2 header.

Step 6

end

Example:

Router(config-if-cts-manual)# end

Exits CTS manual interface configuration mode and enters privileged EXEC mode.

Step 7

show cts interface [GigabitEthernetport | Vlan number | brief | summary]

Example:

Router# show cts interface brief
Global Dot1x feature is Disabled
Interface GigabitEthernet0:
CTS is enabled, mode:    MANUAL
IFC state:               OPEN
Authentication Status:   NOT APPLICABLE
Peer identity:       "unknown"
Peer's advertised capabilities: ""
Authorization Status:    NOT APPLICABLE
SAP Status:              NOT APPLICABLE
Propagate SGT:           Disabled
Cache Info:
Cache applied to link : NONE

Displays CTS configuration statistics to verify that CTS SGT propagation was disabled on interface.

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

Cisco IOS Security Command Reference: Commands A to C

Cisco IOS Security Command Reference: Commands D to L

Cisco IOS Security Command Reference: Commands M to R

Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec switches

Cisco TrustSec Switch Configuration Guide

MIBs

MIB

MIBs Link

CISCO-TRUSTSEC-SXP-MIB

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Feature Name

Releases

Feature Information

TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Cisco IOS XE 3.3SE

Cisco IOS XE 3.6E

This feature allows the interfaces in a router to be manually enabled for CTS so that the router can insert the Security Group Tag (SGT) in the packet to be carried throughout the network in the CTS header.

In Cisco IOS XE Release 3.3SE, this feature is supported on the following platforms:

- Catalyst 3850 Series Switches

- Catalyst 3650 Series Switches

- Cisco 5700 Series Wireless LAN Controllers

In Cisco IOS XE Release 3.6E, this feature is supported on the following platforms:

- Cisco Catalyst 4500E Supervisor Engine 7-E

- Cisco Catalyst 4500E Supervisor Engine 7L-E

- Cisco Catalyst 4500-X Series Switches

- Cisco Catalyst 4500E Supervisor Engine 8-E

- Cisco Catalyst 3850 Series Switches

- Cisco Catalyst 3650 Series Switches

The following commands were introduced or modified: cts manual, policy static sgt, propagate sgt, show cts interface.

Chapter 2. Enabling Bidirectional SXP Support

The Bidirectional SXP Support feature enhances the functionality of Cisco TrustSec with SXP version 4 by adding support for Security Group Tag (SGT) Exchange Protocol (SXP) bindings that can be propagated in both directions between a speaker and a listener over a single connection.

- Finding Feature Information

- Prerequisites for Bidirectional SXP Support

- Restrictions for Bidirectional SXP Support

- Information About Bidirectional SXP Support

- How to Enable Bidirectional SXP Support

- Configuration Examples for Bidirectional SXP Support

- Additional References for Bidirectional SXP Support

- Feature Information for Bidirectional SXP Support

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for Bidirectional SXP Support

- Ensure that Cisco TrustSec is configured on the device. For more information, see the “Cisco TrustSec Support for IOS” chapter in the Cisco TrustSec Configuration Guide.

Restrictions for Bidirectional SXP Support

- The peers at each end of the connection must be configured as a bidirectional connection using the both keyword. It is a wrong configuration to have one end configured as a bidirectional connection using the both keyword and the other end configured as a speaker or listener (unidirectional connection).

Information About Bidirectional SXP Support

- Bidirectional SXP Support Overview

Bidirectional SXP Support Overview

Cisco TrustSec builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers. The peer that produces data is the speaker and the corresponding peer is the listener.

With the support for bidirectional Security Group Tag (SGT) Exchange Protocol (SXP) configuration, a peer can act as both a speaker and a listener and propagate SXP bindings in both directions using a single connection.

The bidirectional SXP configuration is managed with one pair of IP addresses. On either end, only the listener initiates the SXP connection and the speaker accepts the incoming connection.

Bidirectional SXP Connection

In addition, SXP version 4 (SXPv4) continues to support the loop detection mechanism (to prevent stale binding in the network).

How to Enable Bidirectional SXP Support

- Configuring Bidirectional SXP Support

- Verifying Bidirectional SXP Support Configuration

Configuring Bidirectional SXP Support

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp enable

4.    cts sxp default password

5.    cts sxp default source-ip

6.    cts sxp connection peer ipv4-address {source | password} {default | none} mode {local | peer} both [vrf vrf-name]

7.    cts sxp speaker hold-time minimum-period

8.    cts sxp listener hold-time minimum-period maximum-period

9.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp enable

Example:

Device(config)# cts sxp enable

Enables the Cisco TrustSec Security Group Tag (SGT) Exchange Protocol version 4 (SXPv4) on a network device.

Step 4

cts sxp default password

Example:

Device(config)# cts sxp default password Cisco123

(Optional) Specifies the Cisco TrustSec SGT SXP default password.

Step 5

cts sxp default source-ip

Example:

Device(config)# cts sxp default source-ip 10.20.2.2

(Optional) Configures the Cisco TrustSec SGT SXP source IPv4 address.

Step 6

cts sxp connection peer ipv4-address {source | password} {default | none} mode {local | peer} both [vrf vrf-name]

Example:

Device(config)# cts sxp connection peer 10.20.2.2 password default mode local both

Configures the Cisco TrustSec SXP peer address connection for a bidirectional SXP configuration. The both keyword configures the bidirectional SXP configuration.

The source keyword specifies the IPv4 address of the source device. If no address is specified, the connection uses the default source address, if configured, or the address of the port.

The password keyword specifies the password that Cisco TrustSec SXP uses for the connection using the following options:

- default—Use the default Cisco TrustSec SXP password you configured using the cts sxp default password command.

- none—A password is not used.

The mode keyword specifies the role of the remote peer device:

- local—The specified mode refers to the local device.

- peer—The specified mode refers to the peer device.

- both—Specifies that the device is both the speaker and the listener in the bidirectional SXP connection.

The optional vrf keyword specifies the VRF to the peer. The default is the default VRF.

Step 7

cts sxp speaker hold-time minimum-period

Example:

Device(config)# cts sxp speaker hold-time 950

(Optional) Configures the global hold time (in seconds) of a speaker network device for Cisco TrustSec SGT SXPv4. The valid range is from 1 to 65534. The default is 120.

Step 8

cts sxp listener hold-time minimum-period maximum-period

Example:

Device(config)# cts sxp listener hold-time 750 1500

(Optional) Configures the global hold time (in seconds) of a listener network device for Cisco TrustSec SGT SXPv4. The valid range is from 1 to 65534. The default is 90 to 180.

Note:   The maximum-period value must be greater than or equal to the minimum-period value.

Step 9

exit

Example:

Device(config)# exit

Exits global configuration mode.

Verifying Bidirectional SXP Support Configuration

SUMMARY STEPS

1.    enable

2.    show cts sxp {connections | sgt-map} [brief | vrf vrf-name]

DETAILED STEPS

Step 1

enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Example:

Device> enable

Step 2

show cts sxp {connections | sgt-map} [brief | vrf vrf-name]

Displays Cisco TrustSec Exchange Protocol (SXP) status and connections.

Example:

Device# show cts sxp connections

SXP : Enabled
Highest Version Supported: 4
Default Password : Set
Default Source IP: Not Set
Connection retry open period: 120 secs
Reconcile period: 120 secs
Retry open timer is running
----------------------------------------------
Peer IP : 2.0.0.2
Source IP : 1.0.0.2
Conn status : On (Speaker) :: On (Listener)
Conn version : 4
Local mode : Both
Connection inst# : 1
TCP conn fd : 1(Speaker) 3(Listener)
TCP conn password: default SXP password
Duration since last state change: 1:03:38:03 (dd:hr:mm:sec) :: 0:00:00:46 (dd:hr:mm:sec)

Device# show cts sxp connection brief

SXP : Enabled
Highest Version Supported: 4
Default Password : Set
Default Source IP: Not Set
Connection retry open period: 120 secs
Reconcile period: 120 secs
Retry open timer is running
-----------------------------------------------------
Peer_IP Source_IP Conn Status Duration
---------------------------------------------------
2.0.0.2 1.0.0.2 On(Speaker)::On(Listener) 0:00:37:17 (dd:hr:mm:sec)::0:00:37:19 (dd:hr:mm:sec)

The following table describes the various scenarios for the connection status output.

Connection Status Output Scenarios

Node1

Node2

Node1 CLI Output for Connection Status

Node2 CLI Output for Connection Status

Both

Both

On (Speaker)

On (Listener)

On (Speaker)

On (Listener)

Speaker

Listener

On

On

Listener

Speaker

On

On

Configuration Examples for Bidirectional SXP Support

- Example: Configuring Bidirectional SXP Support

Example: Configuring Bidirectional SXP Support

The following example shows how to enable bidirectional CTS-SXP and configure the SXP peer connection on Device_A to connect to Device_B:

Device_A> enable
Device_A# configure terminal
Device_A(config)# cts sxp enable
Device_A(config)# cts sxp default password Cisco123
Device_A(config)# cts sxp default source-ip 10.10.1.1
Device_A(config)# cts sxp connection peer 10.20.2.2 password default mode local both
Device_A(config)# exit

The following example shows how to configure the bidirectional CTS-SXP peer connection on Device_B to connect to Device_A:

Device_B> enable
Device_B# configure terminal
Device_B(config)# cts sxp enable
Device_B(config)# cts sxp default password Password123
Device_B(config)# cts sxp default source-ip 10.20.2.2
Device_B(config)# cts sxp connection peer 10.10.1.1 password default mode local both
Device_B(config)# exit

Additional References for Bidirectional SXP Support

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec configuration

“Cisco TrustSec Support for IOS” chapter in the Cisco TrustSec Configuration Guide

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature Information for Bidirectional SXP Support

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Bidirectional SXP Support

Feature Name

Releases

Feature Information

Bidirectional SXP Support

Cisco IOS XE 3.6E

The Bidirectional SXP Support feature enhances the functionality of Cisco TrustSec with SXP version 4 by adding support for Security Group Tag (SGT) Exchange Protocol (SXP) bindings that can be propagated in both directions between a speaker and a listener over a single connection.

In Cisco IOS XE Release 3.6E, this feature is supported on the following platforms:

- Cisco Catalyst 4500E Supervisor Engine 7-E

- Cisco Catalyst 4500E Supervisor Engine 7L-E

- Cisco Catalyst 4500-X Series Switches

- Cisco Catalyst 4500E Supervisor Engine 8-E

- Cisco Catalyst 3850 Series Switches

- Cisco Catalyst 3650 Series Switches

The following command was introduced or modified: cts sxp connection peer.

Chapter 3. Enablement of Security Group ACL at Interface Level

The Enablement of Security Group ACL at Interface Level feature controls and manages the Cisco TrustSec access control on a network device based on an attribute-based access control list. When a security group access control list (SGACL) is enabled globally, the SGACL is enabled on all interfaces in the network by default; use the Enablement of Security Group ACL at Interface Level feature to disable the SGACL on a Layer 3 interface.

- Finding Feature Information

- Restrictions for Enablement of Security Group ACL at Interface Level

- Information About Enablement of Security Group ACL at Interface Level

- How to Configure Security Group ACL at Interface Level

- Configuration Examples for Enablement of Security Group ACL at Interface Level

- Additional References for Enablement of Security Group ACL at Interface Level

- Feature Information for Enablement of Security Group ACL at Interface Level

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for Enablement of Security Group ACL at Interface Level

- The Enablement of Security Group ACL at Interface Level feature is effective only if the security group access control list (SGACL) enforcement is enabled globally.

- Disabling per-interface SGACL enforcement also disables Security Group Tag (SGT) caching on the specific interface.

- Per-interface SGACL enforcement is not supported on Layer 3 port channel interfaces.

- Per-interface SGACL enforcement is not supported on Layer 2 interfaces.

Information About Enablement of Security Group ACL at Interface Level

- Security Group ACL Overview

- Guidelines to Configure Security Group ACL

Security Group ACL Overview

The attribute-based access control list organizes and manages the Cisco TrustSec access control on a network device. The security group access control list (SGACL) is a Layer 3-4 access control list to filter access based on the value of the security group tag (SGT). The filtering usually occurs at an egress port of the Cisco TrustSec domain. SGT is a Layer 2 tag that is used to classify traffic based on role, and SGT tagging occurs at ingress of the CTS domain.

The terms role-based ACL (RBACL) and SGACL can be used interchangeably, and they refer to a topology-independent ACL used in an attribute-based access control (ABAC) policy model. ABAC is an access control mechanism that uses subject attributes, resource attributes, and environment attributes.

- Subject attributes (S) are associated with a subject—be it a user or an application—that defines the identity and characteristics of that subject.

- Resource attributes (R) are associated with a resource, such as a web service, a system function, or data.

- Environment attributes (E) describe the operational, technical, or situational environment or context in which information is accessed.

ABAC policy rules are generated as Boolean functions of S, R, and E attributes, and these rules decide whether a subject S can access a resource R in a particular environment E. Access control policy is defined between security groups and consists of traditional security ACLs but without IP source and destination addresses.

Because networks are bidirectional, access control is applied both between the subject (user) and the object (resource or server) and between the object and the subject. This requires the subjects to be grouped together into security groups and the objects to be likewise grouped together into security groups. Rules based on subject and object attributes group the subjects and objects into security groups.

Once SGACL is enabled globally, it is automatically enabled on every Layer 3 interface on the device, and you can disable SGACL on specific Layer 3 interfaces. Granular disablement at interface level is effective only if SGACL is enabled globally. This feature is applicable even if packets sent or received are not tagged with SGT at the source device of the packet.

Enabling or disabling per-interface SGACL enforcement enables or disables SGACL monitor mode on that interface.

Guidelines to Configure Security Group ACL

The security group access control list (SGACL) can be configured by the administrator in Cisco Identity Service Engine (ISE) or in Cisco Secure Access Control System (ACS).

You can also configure the SGACL in the device using the ip access-list role-based sgacl-name command in global configuration mode. Use the show cts role-based permissions command or the show cts rbacl command in privileged EXEC mode to view the SGACLs configured on the device. For more information about the security commands, see the Cisco IOS Security Command Reference.

Note

Ensure that the SGACL name begins with an alphabetic character to prevent ambiguity with numbered access lists. These names cannot contain a space or quotation mark.

How to Configure Security Group ACL at Interface Level

- Configuring Security Group ACL at Interface Level

Configuring Security Group ACL at Interface Level

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    cts role-based enforcement

5.    end

6.    show running-config interface type number

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type number

Example:

Device(config)# interface gigabitethernet 2/5/3

Enters interface configuration mode.

Step 4

cts role-based enforcement

Example:

Device(config-if)# cts role-based enforcement

Enables a security group access control list (SGACL) for the interface.

Step 5

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Step 6

show running-config interface type number

Example:

Device# show running-config interface gigabitethernet 2/5/3

Displays whether the SGACL is disabled on a specific interface.

Configuration Examples for Enablement of Security Group ACL at Interface Level

- Example: Configuring Security Group ACL at Interface Level

- Example: Verifying Security Group ACL at Interface Level

Example: Configuring Security Group ACL at Interface Level

Device> enable
Device# configure terminal
Device(config)# interface gigabitethernet 1/1/3
Device(config-if)# cts role-based enforcement
Device(config-if)# end

Example: Verifying Security Group ACL at Interface Level

Device# show running-config interface gigabitethernet 2/5/3

Building configuration...

Current configuration : 175 bytes
!
interface GigabitEthernet2/5/3
no switchport
ip address 192.0.2.2 255.255.255.0
load-interval 30
ipv6 address 2001:DB8::1
ipv6 enable
no cts role-based enforcement
end

Note

The no cts role-based enforcement line in the command output indicates that the security group access control list (SGACL) is disabled at the interface level.

Additional References for Enablement of Security Group ACL at Interface Level

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec switches

Cisco TrustSec Switch Configuration Guide

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Enablement of Security Group ACL at Interface Level

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Enablement of Security Group ACL at Interface Level

Feature Name

Releases

Feature Information

Enablement of Security Group ACL at Interface Level

Cisco IOS XE 3.6E

The Enablement of Security Group ACL at Interface Level feature controls and manages the Cisco TrustSec access control on a network device based on an attribute-based access control policy. This feature provides the flexibility of enabling and disabling a security group access control list (SGACL) on specific Layer 3 interfaces with assigned security groups.

In Cisco IOS XE Release 3.6E, this feature is supported on the following platforms:

- Cisco Catalyst 4500E Supervisor Engine 7-E

- Cisco Catalyst 4500E Supervisor Engine 7L-E

- Cisco Catalyst 4500-X Series Switches

- Cisco Catalyst 4500E Supervisor Engine 8-E

- Cisco Catalyst 3850 Series Switches

- Cisco Catalyst 3650 Series Switches

The following command was introduced: cts role-based enforcement.

Chapter 4. IPv6 Support for SGT and SGACL

The IPv6 Support for SGT and SGACL feature facilitates dynamic learning of mappings between IP addresses and Security Group Tags (SGTs) for IPv6 addresses. The SGT is later used to derive the Security Group Access Control List (SGACL).

- Finding Feature Information

- Restrictions for IPv6 Support for SGT and SGACL

- Information About IPv6 Support for SGT and SGACL

- How to Configure IPv6 Support for SGT and SGACL

- Configuration Examples for IPv6 Support for SGT and SGACL

- Additional References for IPv6 Support for SGT and SGACL

- Feature Information for IPv6 Support for SGT and SGACL

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Restrictions for IPv6 Support for SGT and SGACL

Enforcement of IPv6 addresses is not supported by this feature.

Information About IPv6 Support for SGT and SGACL

- Components of IPv6 Dynamic Learning

Components of IPv6 Dynamic Learning

Dynamic learning of IPv6 addresses require three components:

- Switch Integrated Security Features (SISF)—An infrastructure built to take care of security, address assignment, address resolution, neighbor discovery, exit point discovery, and so on.

- Cisco Enterprise Policy Manager (EPM)—A solution that registers to SISF to receive IPv6 address notifications. The Cisco EPM then uses these IPv6 addresses and the Security Group Tags (SGTs) downloaded from the Cisco Identity Services Engine (ISE) to generate IP-SGT bindings.

- Cisco TrustSec—A solution that protects devices from unauthorized access. Cisco TrustSec assigns an SGT to the ingress traffic of a device and enforces the access policy based on the tag anywhere in the network.

Learning of IPv6 addresses can be done using the following methods, which are listed starting from lowest priority (1) to highest priority (7):

1. VLAN—Bindings learned from snooped Address Resolution Protocol (ARP) packets on a VLAN that has VLAN-SGT mapping.

2. CLI—Address bindings configured using the IP-SGT form of the cts role-based sgt-map global configuration command.

3. Layer 3 Interface (L3IF)—Bindings added due to forwarding information base (FIB ) forwarding entries that have paths through one or more interfaces with consistent L3IF-SGT mapping or identity port mapping (IPM) on routed ports.

4. SXP—Bindings learned from SGT Exchange Protocol (SXP) peers.

5. IP_ARP—Bindings learned when tagged ARP packets are received on a CTS-capable link.

6. Local—Bindings of authenticated hosts that are learned via EPM and device tracking.

7. Internal—Bindings between locally configured IP addresses and the device’s own SGT.

How to Configure IPv6 Support for SGT and SGACL

- Generating IPv6 Addresses for IP-SGT Bindings

- Configuring IPv6 IP-SGT Binding Using Local Binding

- Configuring IPv6 IP-SGT Binding Using a VLAN

- Verifying IPv6 Support for SGT and SGACL

Generating IPv6 Addresses for IP-SGT Bindings

Switch Integrated Security Features (SISF) is a feature that generates IPv6 addresses for use in IP-SGT bindings.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ipv6 snooping policy policy-name

4.    tracking enable

5.    exit

6.    ipv6 dhcp pool dhcp-pool-name

7.    address prefix ipv6-address/prefix

8.    exit

9.    interface vlan interface-number

10.    ipv6 enable

11.    no ipv6 address

12.    ipv6 address ipv6-address/prefix

13.    ipv6 address autoconfiguration

14.    ipv6 dhcp server dhcp-pool-name

15.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

ipv6 snooping policy policy-name

Example:

Device(config)# ipv6 snooping policy policy1

Generates IPv6 addresses for IP-SGT bindings and enters IPv6 snooping configuration mode.

Step 4

tracking enable

Example:

Device(config-ipv6-snooping)# tracking enable

Overrides the default tracking policy on a port.

Step 5

exit

Example:

Device(config-ipv6-snooping)# exit

Exits IPv6 snooping configuration mode and returns to global configuration mode.

Step 6

ipv6 dhcp pool dhcp-pool-name

Example:

Device(config)# ipv6 dhcp pool dhcp-pool

Assigns an IPv6 DHCP pool to the DHCP server and enters IPv6 DHCP pool configuration mode.

Step 7

address prefix ipv6-address/prefix

Example:

Device(config-dhcpv6)# address prefix 2001:DB8::1/64

Sets the IPv6 address for an end host.

Step 8

exit

Example:

Device(config-dhcpv6)# exit

Exits IPv6 DHCP pool configuration mode and returns to global configuration mode.

Step 9

interface vlan interface-number

Example:

Device(config)# interface vlan 20

Creates a VLAN interface and enters interface configuration mode.

Step 10

ipv6 enable

Example:

Device(config-if)# ipv6 enable

Enables IPv6 on an interface.

Step 11

no ipv6 address

Example:

Device(config-if)# no ipv6 address

Removes the existing IPv6 address set for an interface.

Step 12

ipv6 address ipv6-address/prefix

Example:

Device(config-if)# ipv6 address 2001:DB8:1:1::1/64

Assigns an IPv6 address for the interface.

Step 13

ipv6 address autoconfiguration

Example:

Device(config-if)# ipv6 address autoconfiguration

Enables stateless autoconfiguration on an interface.

Step 14

ipv6 dhcp server dhcp-pool-name

Example:

Device(config-if)# ipv6 dhcp server dhcp-pool

Assigns an IPv6 DHCP pool to the DHCP server.

Step 15

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

What to Do Next

Configure IPv6-SGT binding by using either local binding or a VLAN.

Configuring IPv6 IP-SGT Binding Using Local Binding

In local binding, the Security Group Tag (SGT) value is downloaded from the Identity Services Engine (ISE).

Before You Begin

- An IPv6 address must be generated through Switch Integrated Security Features (SISF) to configure an IP-SGT binding.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    policy-map type control subscriber control-policy-name

4.    event session-started match-all

5.    priority-number class always do-until-failure

6.    action-number authenticate using mab

7.    end

8.    configure terminal

9.    interface gigabitethernet interface-number

10.    description interface-description

11.    switchport access vlan vlan-id

12.    switchport mode access

13.    ipv6 snooping attach-policy policy-name

14.    access-session port-control auto

15.    mab eap

16.    dot1x pae authenticator

17.    service-policy type control subscriber policy-name

18.    end

19.    show cts role-based sgt-map all ipv6

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

policy-map type control subscriber control-policy-name

Example:

Device(config)# policy-map type control subscriber policy1

Defines a control policy for subscriber sessions and enters control policy-map configuration mode.

Step 4

event session-started match-all

Example:

Device(config-event-control-policymap)# event session-started match-all

Specifies the type of event that triggers actions in a control policy if conditions are met.

Step 5

priority-number class always do-until-failure

Example:

Device(config-class-control-policymap)# 10 class always do-until-failure

Associates a control class with one or more actions in a control policy and enters action control policy-map configuration mode.

- A named control class must first be configured before specifying it with the control-class-name argument.

Step 6

action-number authenticate using mab

Example:

Device(config-action-control-policymap)# 10 authenticate using mab

Initiates the authentication of a subscriber session using the specified method.

Step 7

end

Example:

Device(config-action-control-policymap)# end

Exits action control policy-map configuration mode and returns to privileged EXEC mode.

Step 8

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 9

interface gigabitethernet interface-number

Example:

Device(config)# interface gigabitehternet 1/0/1

Enters interface configuration mode.

Step 10

description interface-description

Example:

Device(config-if)# description downlink to ipv6 clients

Describes the configured interface.

Step 11

switchport access vlan vlan-id

Example:

Device(config-if)# switchport access vlan 20

Sets access mode characteristics of the interface and configures VLAN when the interface is in access mode.

Step 12

switchport mode access

Example:

Device(config-if)# switchport mode access

Sets the trunking mode to access mode.

Step 13

ipv6 snooping attach-policy policy-name

Example:

Device(config-if)# ipv6 snooping attach-policy snoop

Applies a policy to the IPv6 snooping feature.

Step 14

access-session port-control auto

Example:

Device(config-if)# access-session port-control auto

Sets the authorization state of a port.

Step 15

mab eap

Example:

Device(config-if)# mab eap

Uses Extensible Authentication Protocol (EAP) for MAC authentication bypass.

Step 16

dot1x pae authenticator

Example:

Device(config-if)# dot1x pae authenticator

Enables dot1x authentication on the port.

Step 17

service-policy type control subscriber policy-name

Example:

Device(config-if)# service-policy type control subscriber policy

Specifies the policy map that is used for sessions that come up on this interface. The policy map has rules for authentication and authorization.

Step 18

end

Example:

Device(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

Step 19

show cts role-based sgt-map all ipv6

Example:

Device# show cts role-based sgt-map all ipv6

Displays active IPv6 IP-SGT bindings.

Configuring IPv6 IP-SGT Binding Using a VLAN

In a VLAN, a network administrator assigns a Security Group Tag (SGT) value to a particular VLAN.

Before You Begin

- An IPv6 address must be generated through Switch Integrated Security Features (SISF) to configure an IP-SGT binding.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts role-based sgt-map vlan-list vlan-id sgt sgt-value

4.    end

5.    show cts role-based sgt-map all ipv6

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts role-based sgt-map vlan-list vlan-id sgt sgt-value

Example:

Device(config)# cts role-based sgt-map vlan-list 20 sgt 3

Assigns an SGT value to the configured VLAN.

Note:
The range of the sgt-value argument must be from 2 to 65519.

Step 4

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Step 5

show cts role-based sgt-map all ipv6

Example:

Device# show cts role-based sgt-map all ipv6

Displays active IPv6 IP-SGT bindings.

Verifying IPv6 Support for SGT and SGACL

SUMMARY STEPS

1.    enable

2.    show cts role-based sgt-map all

3.    show cts role-based sgt-map all ipv6

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

show cts role-based sgt-map all

Example:

Device# show cts role-based sgt-map all

Active IPv4-SGT Bindings Information

IP Address              SGT     Source
============================================
192.0.2.1                8       INTERNAL
192.0.2.2                8       INTERNAL
192.0.2.3                11      LOCAL

IP-SGT Active Bindings Summary
============================================
Total number of LOCAL    bindings = 1
Total number of INTERNAL bindings = 2
Total number of active   bindings = 3

Active IPv6-SGT Bindings Information

IP Address                                  SGT     Source
================================================================
2001:DB8:0:ABCD::1                          8       INTERNAL
2001:DB8:1::1                               11      LOCAL
2001:DB8:1::1                               11      LOCAL

IP-SGT Active Bindings Summary
============================================
Total number of LOCAL    bindings = 2
Total number of INTERNAL bindings = 1
Total number of active   bindings = 3

Displays active IPv4 and IPv6 IP-SGT bindings.

Step 3

show cts role-based sgt-map all ipv6

Example:

Device# show cts role-based sgt-map all ipv6

Active IP-SGT Bindings Information

IP Address                                  SGT     Source
================================================================
2001:DB8:1::1                                  10      CLI
2001:DB8:1:FFFF::1                             27      VLAN
2001:DB8:9798:8294:753F::1                     5       LOCAL
2001:DB8:8E99:DA94:8A6A::2                     5       LOCAL
2001:DB8:104:2001::139                         27      VLAN
2001:DB8:104:2001:14FE:9798:8294:753F          5       LOCAL

IP-SGT Active Bindings Summary
============================================
Total number of VLAN     bindings = 2
Total number of CLI      bindings = 1
Total number of LOCAL    bindings = 3
Total number of active   bindings = 6

Displays active IPv6 IP-SGT bindings.

Configuration Examples for IPv6 Support for SGT and SGACL

- Example: Generating IPv6 Addresses for IP-SGT Bindings

- Example: Configuring IPv6 IP-SGT Binding Using Local Binding

- Example: Configuring IPv6 IP-SGT Binding Using a VLAN

Example: Generating IPv6 Addresses for IP-SGT Bindings

Device> enable
Device# configure terminal
Device(config)# ipv6 snooping policy policy-name
Device(config-ipv6-snooping)# tracking enable
Device(config-ipv6-snooping)# exit
Device(config)# ipv6 dhcp pool dhcp-pool
Device(config-dhcpv6)# address prefix 2001:DB8::1/64
Device(config-dhcpv6)# exit
Device(config)# interface vlan 20
Device(config-if)# no ip address
Device(config-if)# ipv6 address 2001:DB8::2/64
Device(config-if)# ipv6 address autoconfiguration
Device(config-if)# ipv6 enable
Device(config-if)# ipv6 dhcp server dhcp-pool
Device(config-if)# end

Example: Configuring IPv6 IP-SGT Binding Using Local Binding

Device> enable
Device# configure terminal
Device(config)# ipv6 snooping policy policy-name
Device(config-ipv6-snooping)# tracking enable
Device(config-ipv6-snooping)# exit
Device(config)# ipv6 dhcp pool dhcp-pool
Device(config-dhcpv6)# address prefix 2001:DB8::1/64
Device(config-dhcpv6)# exit
Device (config)# interface vlan 20
Device(config-if)# no ip address
Device(config-if)# ipv6 address 2001:DB8::2/64
Device(config-if)# ipv6 address autoconfiguration
Device(config-if)# ipv6 enable
Device(config-if)# ipv6 dhcp server dhcp-pool
Device(config-if)# exit
Device(config)# policy-map type control subscriber policy1
Device(config-event-control-policymap)# event session match-all
Device(config-class-control-policymap)# 10 class always do-until-failure
Device(config-action-control-policymap)# 10 authenticate using mab
Device(config-action-control-policymap)# end
Device# configure terminal
Device(config)# interface gigabitehternet 1/0/1
Device(config-if)# description downlink to ipv6 clients
Device(config-if)# switchport access vlan 20
Device(config-if)# switchport mode access
Device(config-if)# ipv6 snooping attach-policy snoop
Device(config-if)# access-session port-control auto
Device(config-if)# mab eap
Device(config-if)# dot1x pae authenticator
Device(config-if)# service-policy type control subscriber example
Device(config-if)# end

Example: Configuring IPv6 IP-SGT Binding Using a VLAN

Device> enable
Device# configure terminal
Device(config)# ipv6 snooping policy policy-name
Device(config-ipv6-snooping)# tracking enable
Device(config-ipv6-snooping)# exit
Device(config)# ipv6 dhcp pool dhcp-pool
Device(config-dhcpv6)# address prefix 2001:DB8::1/64
Device(config-dhcpv6)# domain name domain.com
Device(config-dhcpv6)# exit
Device (config)# interface vlan 20
Device(config-if)# no ip address
Device(config-if)# ipv6 address 2001:DB8::2/64
Device(config-if)# ipv6 address autoconfiguration
Device(config-if)# ipv6 enable
Device(config-if)# ipv6 nd other-config-flag
Device(config-if)# ipv6 dhcp server dhcp-pool
Device(config-if)# end

Additional References for IPv6 Support for SGT and SGACL

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference Commands A to C

- Cisco IOS Security Command Reference Commands D to L

- Cisco IOS Security Command Reference Commands M to R

- Cisco IOS Security Command Reference Commands S to Z

Security group ACL

“Enablement of Security Group ACL at Interface Level” module of Cisco TrustSec Configuration Guide

IEEE 802.1X authentication

“Configuring IEEE 802.1X Port-Based Authentication” module of 802.1X Authentication Services Configuration Guide

MAC Authentication Bypass

“Configuring MAC Authentication Bypass” module of Authentication Authorization and Accounting Configuration Guide

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature Information for IPv6 Support for SGT and SGACL

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for IPv6 Support for SGT and SGACL

Feature Name

Releases

Feature Information

IPv6 Support for SGT and SGACL

Cisco IOS XE 3.6E

The IPv6 Support for SGT and SGACL feature introduces dynamic learning of mappings between IP addresses and Security Group Tags (SGTs) for IPv6 addresses. The SGT is later used to derive the Security Group Access Control List (SGACL).

In Cisco IOS XE Release 3.6E, this feature was supported on the following platforms:

- Catalyst 3650 Series Switches

- Catalyst 3850 Series Switches

- Catalyst 4500E Supervisor Engine 7L-E

- Catalyst 4500-X Series Switches

- Catalyst 4900 Series Switches

- Catalyst 4500E Supervisor Engine 8-E

The following command was modified: cts role-based sgt-map.

Chapter 5. Cisco TrustSec Network Device Admission Control

The Cisco TrustSec Network Device Admission Control (NDAC) feature creates an independent layer of trust between Cisco TrustSec devices to prohibit rogue devices from being allowed on the network.

- Information About Cisco TrustSec Network Device Admission Control

- How to Configure Cisco TrustSec Network Device Admission Control

- Configuration Examples for Cisco TrustSec Network Device Admission Control

- Additional References

- Feature Information for Cisco TrustSec Network Device Admission Control

Information About Cisco TrustSec Network Device Admission Control

- Cisco TrustSec NDAC Authentication for an Uplink Interface

Cisco TrustSec NDAC Authentication for an Uplink Interface

Cisco TrustSec NDAC authentication with 802.1X must be enabled on each uplink interface that connects to another Cisco TrustSec device.

How to Configure Cisco TrustSec Network Device Admission Control

- Configuring AAA for Cisco TrustSec NDAC Devices

- Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

Configuring AAA for Cisco TrustSec NDAC Devices

Configure authentication, authorization, and accounting (AAA) on both seed and non-seed Network Device Admission Control (NDAC) devices.

- Configuring AAA on Cisco TrustSec Seed Devices

- Configuring AAA on Cisco TrustSec Non-seed Devices

Configuring AAA on Cisco TrustSec Seed Devices

SUMMARY STEPS

1.    enable

2.    cts credentials id cts-id password cts-password

3.    configure terminal

4.    aaa new-model

5.    aaa session-id common

6.    radius server radius-server-name

7.    address ipv4 {hostname | ipv4address} [acct-port port | alias {hostname | ipv4address} | auth-port port [acct-port port]]

8.    pac key encryption-key

9.    exit

10.    radius-server vsa send authentication

11.    aaa group server radius group-name

12.    server name radius-server-name

13.    exit

14.    aaa authentication dot1x default group group-name

15.    aaa authorization network default group group-name

16.    aaa authorization network list-name group group-name

17.    cts authorization list list-name

18.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

cts credentials id cts-id password cts-password

Example:

Device# cts credentials id CTS-One password cisco123

Specifies the Cisco TrustSec ID and password of the network device.

Step 3

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 4

aaa new-model

Example:

Device(config)# aaa new-model

Enables new RADIUS and AAA access control commands and functions and disables old commands.

Step 5

aaa session-id common

Example:

Device(config)# aaa session-id common

Ensures that the same session identification (ID) information is used for each AAA accounting service type within a given call.

Step 6

radius server radius-server-name

Example:

Device(config)# radius server cts-aaa-server

Specifies the name for the RADIUS server configuration for Protected Access Credential (PAC) provisioning and enters RADIUS server configuration mode.

Step 7

address ipv4 {hostname | ipv4address} [acct-port port | alias {hostname | ipv4address} | auth-port port [acct-port port]]

Example:

Device(config-radius-server)# address ipv4 192.0.2.1 auth-port 1812 acct-port 1813

Configures the IPv4 address for the RADIUS server accounting and authentication parameters.

Step 8

pac key encryption-key

Example:

Device(config-radius-server)# pac key cisco123

Specifies the PAC encryption key.

Step 9

exit

Example:

Device(config-radius-server)# exit

Exits RADIUS server configuration mode and enters global configuration mode.

Step 10

radius-server vsa send authentication

Example:

Device(config)# radius-server vsa send authentication

Configures the network access server (NAS) to recognize and use only authentication vendor-specific attributes (VSAs).

Step 11

aaa group server radius group-name

Example:

Device(config)# aaa group server radius cts_sg

Groups different RADIUS server hosts into distinct lists and distinct methods and enters RADIUS group server configuration mode.

Step 12

server name radius-server-name

Example:

Device(config-sg-radius)# server name cts-aaa-server

Specifies a RADIUS server.

Step 13

exit

Example:

Device(config-sg-radius)# exit

Exits RADIUS group server configuration mode and enters global configuration mode.

Step 14

aaa authentication dot1x default group group-name

Example:

Device(config)# aaa authentication dot1x default group cts_sg

Specifies the RADIUS server to use for authentication on interfaces running IEEE 802.1X.

Step 15

aaa authorization network default group group-name

Example:

Device(config)# aaa authorization network default group cts_sg

Specifies that the RADIUS server method is the default method for authorization into a network.

Step 16

aaa authorization network list-name group group-name

Example:

Device(config)# aaa authorization network cts-mlist group cts_sg

Specifies that the RADIUS server method is part of the list of authorization methods to use for authorization into a network.

Step 17

cts authorization list list-name

Example:

Device(config)# cts authorization list cts-mlist

Specifies a list of AAA servers for the Cisco TrustSec seed device.

Step 18

exit

Example:

Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Configuring AAA on Cisco TrustSec Non-seed Devices

SUMMARY STEPS

1.    enable

2.    cts credentials id cts-id password cts-password

3.    configure terminal

4.    aaa new-model

5.    aaa session-id common

6.    radius-server vsa send authentication

7.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

cts credentials id cts-id password cts-password

Example:

Device# cts credentials id CTS-One password cisco123

Specifies the Cisco TrustSec ID and password of the network device.

Step 3

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 4

aaa new-model

Example:

Device(config)# aaa new-model

Enables new RADIUS and AAA access control commands and functions and disables old commands.

Step 5

aaa session-id common

Example:

Device(config)# aaa session-id common

Ensures that the same session identification (ID) information is used for each AAA accounting service type within a given call.

Step 6

radius-server vsa send authentication

Example:

Device(config)# radius-server vsa send authentication

Configures the network access server (NAS) to recognize and use only authentication vendor-specific attributes (VSAs).

Step 7

exit

Example:

Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

Before You Begin
Configure authentication, authorization, and accounting (AAA) on both seed and non-seed Network Device Admission Control (NDAC) devices. For more information, see the “Configuring AAA for Cisco TrustSec NDAC Devices” section in this chapter.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type slot/port

4.    cts dot1x

5.    sap mode-list {gcm-encrypt | gmac | no-encap | null} [gcm-encrypt | gmac | no-encap | null]

6.    timer reauthentication seconds

7.    [no] propagate sgt

8.    exit

9.    no shutdown

10.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Device(config)# interface gigabitEthernet 3/1

Enters interface configuration mode for the uplink interface.

Step 4

cts dot1x

Example:

Device(config-if)# cts dot1x

Configures the uplink interface for NDAC authentication and enters CTS dot1x interface configuration mode.

Step 5

sap mode-list {gcm-encrypt | gmac | no-encap | null} [gcm-encrypt | gmac | no-encap | null]

Example:

Device(config-if-cts-dot1x)# sap mode-list gcm

(Optional) Configures the Security Association Protocol (SAP) authentication and encryption modes to negotiate link encryption between two interfaces. The interface negotiates with the peer for a mutually-acceptable mode. List the acceptable modes in the desired order of preference. Choices for the mode argument are:

- gcm-encrypt—Specifies GMAC authentication and GCM encryption.

- gmac—Specifies GMAC authentication only, no encryption.

- no-encap—Specifies no encapsulation.

- null—Specifies encapsulation present, no authentication, no encryption.

Note:
If the interface is not capable of SGT insertion or data link encryption, no-encap is the default and the only available SAP operating mode.

Step 6

timer reauthentication seconds

Example:

Device(config-if-cts-dot1x)# timer reauthentication 100

(Optional) Configures a reauthentication period to be used if the authentication server does not specify a period. If no reauthentication period is specified, the default period is 86400 seconds.

Step 7

[no] propagate sgt

Example:

Device(config-if-cts-dot1x)# no propagate sgt

(Optional) Security Group Tag (SGT) processing propagation is enabled by default. The no form of this command is used when the peer is incapable of processing an SGT. The no propagate sgt command prevents the interface from transmitting the SGT to the peer.

Step 8

exit

Example:

Device(config-if-cts-dot1x)# exit

s

Exits Cisco TrustSec 802.1X interface configuration mode.

Step 9

no shutdown

Example:

Device(config-if)# no shutdown

Enables the interface and enables Cisco TrustSec authentication on the interface.

Step 10

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Configuration Examples for Cisco TrustSec Network Device Admission Control

- Example: Configuring AAA for Cisco TrustSec NAC Devices

- Example: Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

Example: Configuring AAA for Cisco TrustSec NAC Devices

Example: Configuring AAA on Cisco TrustSec Seed Devices

Device> enable
Device# cts credentials id CTS-One password cisco123
Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa session-id common
Device(config)# radius server cts-aaa-server
Device(config-radius-server)# address ipv4 192.0.2.1 auth-port 1812 acct-port 1813
Device(config-radius-server)# pac key cisco123
Device(config-radius-server)# exit
Device(config)# radius-server vsa send authentication
Device(config)# aaa group server radius cts_sg
Device(config-sg-radius)# server name cts-aaa-server
Device(config-sg-radius)# exit
Device(config)# aaa authentication dot1x default group cts_sg
Device(config)# aaa authorization network default group cts_sg
Device(config)# aaa authorization network cts-mlist group cts_sg
Device(config)# cts authorization list cts-mlist
Device(config)# exit

Example: Configuring AAA on Cisco TrustSec Non-seed Devices

Device> enable
Device# cts credentials id CTS-One password cisco123
Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa session-id common
Device(config)# radius-server vsa send authentication
Device(config)# exit

Example: Configuring Cisco TrustSec NDAC Authentication for an Uplink Interface

This example shows how to enable Cisco TrustSec authentication in 802.1X mode on an interface using GCM as the preferred SAP mode; the authentication server did not provide a reauthentication timer:

Device> enable
Device# configure terminal
Device(config)# interface gigabitethernet 3/1
Device(config-if)# cts dot1x
Device(config-if-cts-dot1x)# sap mode-list gcm null no-encap
Device(config-if-cts-dot1x)# timer reauthentication 43200
Device(config-if-cts-dot1x)# exit
Device(config-if)# no shutdown
Device(config-if)# end

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security commands

- Cisco IOS Security Command Reference Commands A to C

- Cisco IOS Security Command Reference Commands D to L

- Cisco IOS Security Command Reference Commands M to R

- Cisco IOS Security Command Reference Commands S to Z

Cisco TrustSec and SXP configuration

Cisco TrustSec Switch Configuration Guide

IPsec configuration

Configuring Security for VPNs with IPsec

IKEv2 configuration

Configuring Internet Key Exchange Version 2 (IKEv2) and FlexVPN Site-to-Site

Cisco Secure Access Control Server

Configuration Guide for the Cisco Secure ACS

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Cisco TrustSec Network Device Admission Control

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Cisco TrustSec Network Device Admission Control

Feature Name

Releases

Feature Information

Cisco TrustSec Network Device Admission Control

Cisco IOS XE Release 3.7E

The Cisco TrustSec Network Device Admission Control (NDAC) feature creates an independent layer of trust between Cisco TrustSec devices to prohibit rogue devices from being allowed on the network.

The following commands were introduced or modified: cts dot1x, propagate sgt (config-if-cts-dot1x) , sap mode-list, timer reauthentication.

Chapter 6. Cisco TrustSec Critical Authentication

The Cisco TrustSec Critical Authentication feature ensures that the Network Device Admission Control (NDAC)-authenticated 802.1X links between Cisco TrustSec devices are in an open state even when the Authentication, Authorization, and Accounting (AAA) server is not reachable.

- Finding Feature Information

- Prerequisites for Cisco TrustSec Critical Authentication

- Restrictions for Cisco TrustSec Critical Authentication

- Additional References for Cisco TrustSec Critical Authentication

- Feature Information for Cisco TrustSec Critical Authentication

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for Cisco TrustSec Critical Authentication

- The Cisco TrustSec Network Device Admission Control feature must be configured on the device. For more information, see the “Cisco TrustSec Network Device Admission Control” chapter in the Cisco TrustSec Configuration Guide.

- Ensure that the RADIUS server is marked as dead before configuring the Cisco TrustSec Critical Authentication feature.

Restrictions for Cisco TrustSec Critical Authentication

- All Cisco TrustSec 802.1X links must be part of a single port channel or must be on different VLANs. If multiple links are on the same VLAN, authentication fails because Spanning Tree Protocol (STP) drops all the packets on a blocked interface.

Note

All STP forwarding ports are maintained in the open state when Cisco TrustSec critical authentication mode is enabled.

- If the authenticating device (authenticator) is down or if connectivity between the authenticator and Cisco Identity Services Engine (ISE) is lost, the Cisco TrustSec 802.1X links move to the critical authentication mode until connectivity is regained or until the links are reconfigured.

- The default peer security group tag (SGT) value used to configure the Cisco TrustSec 802.1X links for critical authentication must be defined in the ISE server. If the default peer-SGT value is not defined in the ISE server, the policies related to the default peer SGT are not downloaded and are not applied on the Cisco TrustSec 802.1X links. In such a situation, the default policy is applied when the links are in critical authentication mode.

- You must not refresh the environment data when connectivity to the ISE server is lost and when the Cisco TrustSec 802.1X links are in critical authentication mode. If the environment data is refreshed and fails to download, the policies on the device may get cleared.

Critical Authentication Overview

The Cisco TrustSec solution provides end-to-end security that is centrally managed using an Authentication, Authorization, and Accounting (AAA) server. The AAA server authenticates and authorizes each device coming into the network, and encryption is done on a per-link basis. The authentication information is downloaded to both the authenticating device (authenticator) and to the incoming device (supplicant) that are added to the CTS network. Another key component of Cisco TrustSec is the Cisco Identity Services Engine (ISE). The ISE server is the policy control point for Cisco TrustSec. The authenticator must be connected to the ISE server to ensure that the Cisco TrustSec 802.1X links are active. After authentication, the supplicant is connected to the ISE server through the authenticator.

Cisco TrustSec Network Device Admission Control helps to add network devices into trusted networks.

When the AAA server is down, Cisco TrustSec can neither add any new device into the network nor maintain the currently authenticated devices in the trusted network. This situation results in the Cisco TrustSec links going into the disconnect state.

The Cisco TrustSec Critical Authentication feature aims to prevent the Cisco TrustSec 802.1X links from going down if the AAA server is not reachable. For devices that are already in the trusted network, previously obtained (cached) security group access control list (SGACL) policies, peer security group tag (SGT) values, and pairwise master key (PMK) values are used until the AAA server is reachable again. For new devices coming into the network, the default peer-SGT value (trusted or untrusted), default PMK value, and default SGACL policy are used until the AAA server is reachable and the full authentication and authorization policy is received from the AAA server.

All three values—SGACL policy, peer-SGT value, and PMK value—are configurable.

If a user does not want to configure the PMK value, critical authentication brings up 802.1X links without link encryption, and the Security Association Protocol (SAP) negotiation does not occur between interfaces. The default PMK value is used for all SAP negotiations.

In critical authentication mode, preference is given to cached data because it is the last valid set of values received from the AAA server. However, this is a configurable option, and the user can decide if default values should be preferred over cached values.

Configuring Critical Authentication

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    radius-server dead-criteria [time seconds] [tries number-of-tries]

4.    radius-server deadtime minutes

5.    radius server server-name

6.    address ipv4 {hostname | ipv4address} [acct-port port | alias {hostname | ipv4address} | auth-port port [acct-port port]]

7.    automate-tester username user [ignore-auth-port] [ignore-acct-port] [idle-time minutes]

8.    pac key encryption-key

9.    exit

10.    cts dot1x-server-timeout server-timeout-value

11.    cts dot1x-supp-timeout supplicant-timeout-value

12.    cts server test {ipv4-address | all} {deadtime seconds | enable | idle-time minutes}

13.    cts critical-authentication default peer-sgt peer-sgt-value [trusted]

14.    cts critical-authentication

15.    cts critical-authentication default pmk pmk-value

16.    cts cache {enable | nv-storage {bootflash: [dir] | disk0: [dir] | disk1: [dir] | sup-bootflash: [image]}}

17.    cts critical-authentication fallback {cached | default}

18.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

radius-server dead-criteria [time seconds] [tries number-of-tries]

Example:

Device(config)# radius-server dead-criteria time 15 tries 3

Configures the conditions that determine when a RADIUS server is considered unavailable or dead.

- time seconds - Sets the time, in seconds, during which the device does not need to get a valid response from the RADIUS server. The range is from one to 120 seconds.

- tries number-of-tries - Sets the number of times that the device does not get a valid response from the RADIUS server before the server is considered unavailable.

Step 4

radius-server deadtime minutes

Example:

Device(config)# radius-server deadtime 10

Defines time, in minutes (up to a maximum of 1440 minutes or 24 hours), a server marked as DEAD is held in that state. This command improves RADIUS response times when some servers might be unavailable, and causes the unavailable servers to be skipped immediately.

Once the deadtime expires, the device marks the server as UP (ALIVE) and notifies the registered clients about the state change. If the server is still unreachable after the state is marked as UP and if the DEAD criteria is met, then server is marked as DEAD again for the deadtime interval.

Step 5

radius server server-name

Example:

Device(config)# radius server RASERV-1

Specifies the name for the RADIUS server configuration for Protected Access Credential (PAC) provisioning and enters RADIUS server configuration mode.

Step 6

address ipv4 {hostname | ipv4address} [acct-port port | alias {hostname | ipv4address} | auth-port port [acct-port port]]

Example:

Device(config-radius-server)# address ipv4 172.20.254.4 auth-port 1812 acct-port 1813

Configures the IPv4 address for the RADIUS server accounting and authentication parameters.

Step 7

automate-tester username user [ignore-auth-port] [ignore-acct-port] [idle-time minutes]

Example:

Device(config-radius-server)# automate-tester username dummy

Enables the automated testing feature for the RADIUS server.

With this practice, the device sends periodic test authentication messages to the RADIUS server. It looks for a RADIUS response from the server. A success message is not necessary - a failed authentication suffices, because it shows that the server is alive.

Step 8

pac key encryption-key

Example:

Device(config-radius-server)# pac key 7 mypackey

Specifies the Protected Access Credential (PAC) encryption key. The encryption-key argument can be 0 (specifies that an unencrypted key follows), 6 (specifies that an advanced encryption scheme [AES] encrypted key follows), 7 (specifies that a hidden key follows), or a line specifying the unencrypted (clear-text) server key.

Step 9

exit

Example:

Device(config)# exit

Exits RADIUS server configuration mode and returns to global configuration mode.

Step 10

cts dot1x-server-timeout server-timeout-value

Example:

Device(config)# cts dot1x-server-timeout 30

Sets the time, in seconds, during which the device does not need to get a valid response from the RADIUS server. The range is from 30 to 65535 seconds.

Step 11

cts dot1x-supp-timeout supplicant-timeout-value

Example:

Device(config)# cts dot1x-supp-timeout 30

Sets the time, in seconds, during which the device does not need to get a valid reply from the supplicant. The range is from 30 to 65535 seconds.

To enable the 802.1x links to move to the critical authentication state, ensure that the supplicant timeout is not lesser than the RADIUS server timeout.

Step 12

cts server test {ipv4-address | all} {deadtime seconds | enable | idle-time minutes}

Example:

Device(config)# cts server test all idle-time 3

Configures the server-liveliness test for a specified RADIUS server or for all servers on the dynamic server list. By default, the test is enabled for all servers. The default deadtime is 20 seconds; the range is 1 to 864000 seconds. The default idle-time is 60 seconds; the range is from 1 to 14400 seconds.

Step 13

cts critical-authentication default peer-sgt peer-sgt-value [trusted]

Example:

Device(config)# cts critical-authentication default peer-sgt 5

Configures the default peer security group tag (SGT) value.

- The peer-SGT value is used to tag new devices coming into the Cisco TrustSec network. This value must be configured before the Cisco TrustSec critical authentication mode is enabled. Use the trusted keyword to mark a device as trustworthy.

- The range for the peer-SGT-value argument is from 2 to 65519.

Step 14

cts critical-authentication

Example:

Device(config)# cts critical-authentication

Enables Cisco TrustSec critical authentication mode.

Step 15

cts critical-authentication default pmk pmk-value

Example:

Device(config)# cts critical-authentication default pmk password123

(Optional) Configures the default pairwise master key (PMK) value to be used for all Security Association Protocol (SAP) negotiations.

Step 16

cts cache {enable | nv-storage {bootflash: [dir] | disk0: [dir] | disk1: [dir] | sup-bootflash: [image]}}

Example:

Device(config)# cts cache nv-storage bootdisk:cache

(Optional) Enables caching of Cisco TrustSec authorization and environment data information to DRAM and NVRAM.

Step 17

cts critical-authentication fallback {cached | default}

Example:

Device(config)# cts critical-authentication fallback cached

(Optional) Configures the access policy to be applied for the critical authentication feature.

- Use the cached keyword to apply the existing cached values to authenticated devices. Use the default keyword to apply the default values to authenticated devices.

Note:
If access policies are not configured using the fallback keyword, the default cached policies are used.

Step 18

exit

Example:

Device(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Troubleshooting Tips

- Use the debug cts critical-auth events and debug cts critical-auth errors commands in user EXEC or privileged EXEC mode to help troubleshoot issues with the critical authentication mode.

- Troubleshooting can also be done using the log messages that notify users when an interface enters critical authentication mode and when it reauthenticates.

Verifying Critical Authentication

SUMMARY STEPS

1.    enable

2.    show running-config | section critical

3.    show cts interface summary

DETAILED STEPS

Step 1

enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Example:

Device> enable

Step 2

show running-config | section critical

Displays the critical authentication configuration and the configured values.

Example:

Device# show running-config | section critical

cts critical-authentication default pmk 4444000000000000000000000000000000000000000000000000000000000000
cts critical-authentication default peer-sgt 10
cts critical-authentication fallback default
cts critical-authentication

Step 3

show cts interface summary

Displays summary information about the configured Cisco TrustSec interfaces, including the Cisco TrustSec 802.1X links in critical authentication mode and their status.

Example:

Device# show cts interface summary

Global Dot1x feature is Enabled

CTS Layer2 Interfaces
---------------------
Interface  Mode    IFC-state dot1x-role peer-id    IFC-cache    Critical-Authentication
-----------------------------------------------------------------------------
Gi3/0/2    DOT1X   OPEN      Authent    3k_3       valid    Cached

CTS Layer3 Interfaces
---------------------
Interface   IPv4 encap       IPv6 encap       IPv4 policy      IPv6 policy
--------------------------------------------------------------------------

Example: Configuring Critical Authentication

Device> enable
Device# configure terminal
Device(config)# radius-server dead-criteria time 15 tries 3
Device(config)# radius-server deadtime 10
Device(config)# radius server RASERV-1
Device(config-radius-server)# address ipv4 172.20.254.4 auth-port 1812 acct-port 1813
Device(config-radius-server)# automate-tester username dummy
Device(config-radius-server)# pac key 7 mypackey
Device(config-radius-server)# exit
Device(config)# radius server RASERV-2
Device(config-radius-server)# address ipv4 172.20.254.8 auth-port 1645 acct-port 1646
Device(config-radius-server)# automate-tester username dummy
Device(config-radius-server)# pac key 7 mypackey
Device(config-radius-server)# exit
Device(config)# cts dot1x-server-timeout 30
Device(config)# cts dot1x-supp-timeout 30
Device(config)# cts server test all idle-time 3
Device(config)# cts critical-authentication default peer-sgt 5
Device(config)# cts critical-authentication
Device(config)# cts critical-authentication default pmk password123
Device(config)# cts cache nv-storage bootdisk:cache
Device(config)# cts critical-authentication fallback cached
Device(config)# exit

Additional References for Cisco TrustSec Critical Authentication

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

- Cisco IOS Security Command Reference: Commands A to C

- Cisco IOS Security Command Reference: Commands D to L

- Cisco IOS Security Command Reference: Commands M to R

- Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec configuration

“Cisco TrustSec Support for IOS” chapter in the Cisco TrustSec Configuration Guide

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature Information for Cisco TrustSec Critical Authentication

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Cisco TrustSec Critical Authentication

Feature Name

Releases

Feature Information

Cisco TrustSec Critical Authentication

Cisco IOS XE 3.6E

The Cisco TrustSec Critical Authentication feature ensures that the Network Device Admission Control (NDAC)-authenticated 802.1X links between Cisco TrustSec devices are in an open state even when the Authentication, Authorization, and Accounting (AAA) server is not reachable.

In Cisco IOS XE Release 3.6E, this feature is supported on the following platforms:

- Cisco Catalyst 4500E Supervisor Engine 7-E

- Cisco Catalyst 4500E Supervisor Engine 7L-E

- Cisco Catalyst 4500-X Series Switches

- Cisco Catalyst 4500E Supervisor Engine 8-E

- Cisco Catalyst 3850 Series Switches

- Cisco Catalyst 3650 Series Switches

The following command was introduced by this feature: cts critical-authentication.