Cisco TrustSec enables organizations to secure their networks and services through identity-based access control to anyone,
anywhere, anytime. The solution also offers data integrity and confidentiality services, policy-based governance, and centralized
monitoring, troubleshooting, and reporting services. You can combine Cisco TrustSec with personalized, professional service
offerings to simplify the solution deployment and management, and is a foundational security component to Cisco Borderless
The Cisco TrustSec security architecture helps build secure networks by establishing domains of trusted network devices. Each
device in the domain is authenticated by its peers. Communication on the links between the devices in the domain is secured
with a combination of encryption, message integrity check, and data path replay protection mechanisms. Cisco TrustSec uses
a device and user credentials that are acquired during authentication for classifying the packets by security groups (SGs),
as they enter the network. This packet classification is maintained by tagging packets on an ingress to the Cisco TrustSec
network. This is because they can be correctly identified to apply security and other policy criteria along the data path.
The tag, called the security group tag (SGT), allows the network to enforce the access control policy by enabling the endpoint
device to act upon the SGT to filter traffic. Note that the Cisco TrustSec security group tag is applied only when you enable AAA override on a WLAN.
One of the components of Cisco TrustSec architecture is the security group-based access control. In the security group-based
access control component, access policies in the Cisco TrustSec domain are topology-independent, based on the roles (as indicated
by the security group number) of source and destination devices rather than on network addresses. Individual packets are tagged
with the security group number of the source.
The Cisco TrustSec solution is implemented across the following three distinct phases:
Client classification at ingress by a centralized policy database (Cisco ISE) and assigning unique SGT to clients based on
client identity attributes such as the role and so on.
Propagation of IP-to-SGT binding to neighboring devices using the SGT Exchange Protocol (SXP) or inline tagging methods or
Security Group Access Control List (SGACL) policy enforcement. Cisco AP is the enforcement point for central or local switching
For more information about deploying the Cisco TrustSec solution, see the Wireless TrustSec Deployment Guide at:
SGT Exchange Protocol
Cisco devices use the SGT Exchange Protocol (SXP) to propagate SGTs across network devices that do not have any hardware support
for Cisco TrustSec. The SXP is the software solution to eliminate the need for upgrade of Cisco TrustSec hardware on all Cisco
switches. Controller supports the SXP as part of the Cisco TrustSec architecture. The SXP sends SGT information to the Cisco
TrustSec-enabled switches so that appropriate role-based access control lists (RBAC lists) can be activated. This depends
on the role information present in the SGT. To implement the SXP on a network, only the egress distribution switch has to
be Cisco TrustSec-enabled. All the other switches can be non-Cisco TrustSec-capable switches.
The SXP runs between the access layer and the distribution switch or between two distribution switches. The SXP uses TCP as
the transport layer. Cisco TrustSec authentication is performed for the host (client) joining the network on the access layer
switch. This is similar to an access switch with the hardware that is enabled with Cisco TrustSec. The access layer switch
is not Cisco TrustSec hardware enabled. Therefore, data traffic is not encrypted or cryptographically authenticated when it
passes through the access layer switch. The SXP is used to pass the IP address of the authenticated device, which is a wireless
client and the corresponding SGT up to the distribution switch. If the distribution switch is a hardware that is enabled with
Cisco TrustSec, the switch inserts the SGT into the packet on behalf of the access layer switch. If the distribution switch
is not a hardware that is enabled with Cisco TrustSec, the SXP on the distribution switch passes the IP-SGT mapping to all
the distribution switches that have the Cisco TrustSec hardware. On the egress side, the enforcement of the RBAC lists occurs
at the egress L3 interface on the distribution switch.
The following are some guidelines for Cisco TrustSec SXP:
The SXP is supported only on the following security policies:
The SXP is supported for both IPv4 and IPv6 clients.
By default, the controller always works in the Speaker mode.
From Release 8.3, the SXP on the controller is supported for both centrally and locally switched networks.
It is possible to do IP-SGT mapping on the WLANs as well for clients that are not authenticated by Cisco ISE.
For more information about Cisco TrustSec, see http://www.cisco.com/c/en/us/solutions/enterprise-networks/trustsec/index.html.