Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Cisco TrustSec

Updated: April 10, 2026

Want to summarize with AI?

Log in

Outlines Cisco TrustSec architecture, including user and device identity, scalable access controls, data confidentiality, and enforcement using Cisco ISE and SGACLs. Highlights SGACL and SGT inline tagging features, supported platforms, HA policy for FlexConnect, and commands for managing environment data.

A Cisco TrustSec solution is a network security architecture that

  • strongly identifies users, hosts, and network devices within the network

  • provides topology-independent and scalable access controls by classifying data traffic based on user or device roles, and

  • ensures data confidentiality and integrity by establishing trust among authenticated peers and encrypting network links.

The key component of Cisco TrustSec is the Cisco Identity Services Engine (ISE). Cisco ISE can provision switches with TrustSec Identities and Security Group ACLs (SGACLs). SGACLs may be configured manually on the switch.

Note

Before changing CTS server to a new one, manually clear the CTS environment data using the clear cts environment-data command. Running the show cts environment-data command will return updated data.

Feature History

Feature Name

Release

Description

Trustsec policy HA support for FlexConnect mode APs

Cisco IOS XE 17.18.2

 The feature ensures that CTS SGACL enforcement remains available and consistent during HA events such as Stateful Switchover (SSO) between wireless controllers. This provides uninterrupted security policy enforcement on Flex mode APs even during controller failover or redundancy events.

TrustSec support for Cisco Catalyst IW6300 Heavy Duty Series and 6300 Series Embedded Services APs

Cisco IOS XE 17.8.1

Enable and configure Cisco TrustSec Security Group ACL (SGACL) in FlexConnect and Flex+Bridge mode. SGACL enforcement on the controller is available for local and Bridge mode. Inline tagging and SXP are supported only in FlexConnect.

Support for SGT Inline Tagging Over Port-Channel Uplink

Cisco IOS XE 17.3.5a

SGT inline tagging over port-channel uplink is supported for Cisco Catalyst 9800-L, 9800-40, and 9800-80 Wireless Controllers.

If you downgrade to releases that do not support SGT inline tagging over port-channel, the port-channel may be suspended.

Cisco TrustSec features

This table lists the TrustSec features that will be implemented on TrustSec-enabled Cisco switches. Future releases will support more switches and provide additional TrustSec features.

Cisco TrustSec Feature Description
802.1AE Tagging (MACsec)

Protocol for IEEE 802.1AE-based wire-rate hop-to-hop Layer 2 encryption.

On MACsec-capable devices, your network traffic is encrypted when leaving one device, decrypted when entering the next device, while staying unencrypted inside the devices.

This feature is only available between TrustSec hardware-capable devices.
Endpoint Admission Control (EAC)

EAC authenticates each device or user connecting to the TrustSec domain. This usually happens at the access level switch. If authentication and authorization are successful, your device or user session receives a Security Group Tag. You can use 802.1X, MAC Authentication Bypass (MAB), or Web Authentication Proxy (WebAuth) with EAC.
Network Device Admission Control (NDAC)

With NDAC, each network device in your TrustSec domain verifies the credentials and trustworthiness of peer devices. NDAC uses an authentication framework based on IEEE 802.1X port-based authentication and EAP-FAST as its EAP method. Successful authentication and authorization in NDAC process results in Security Association Protocol negotiation for IEEE 802.1AE encryption.

Security Group Access Control List (SGACL)

Security Group Access Control List (SGACL): An SGACL links a Security Group Tag with a policy that your devices enforce on SGT-tagged traffic leaving the TrustSec domain.
Security Association Protocol (SAP)

After NDAC authentication, the Security Association Protocol (SAP) automatically negotiates keys and the cipher suite for subsequent MACSec link encryption between TrustSec peers. SAP is defined in IEEE 802.11i.
Security Group Tag (SGT)

An SGT is a 16-bit label indicating the security classification of a source in the TrustSec domain. It is appended to an Ethernet frame or an IP packet.

SGT Exchange Protocol (SXP)

Security Group Tag Exchange Protocol (SXP). With SXP, devices that are not TrustSec-hardware-capable can receive SGT attributes for authenticated users and devices from the Cisco Identity Services Engine (ISE) or the Cisco Secure Access Control System (ACS). The devices can then forward a sourceIP-to-SGT binding to a TrustSec-hardware-capable device will tag the source traffic for SGACL enforcement.

When both ends of a link support 802.1AE MACsec, SAP negotiation occurs. An EAPOL-key exchange occurs between the supplicant and the authenticator to negotiate a cipher suite, exchange security parameters, and manage keys. Successful completion of these tasks results in the establishment of a security association (SA).

Depending on your software version, licensing, and link hardware support, SAP negotiation can use one of these modes of operation:

  • Galois Counter Mode (GCM): authentication and encryption

  • GCM authentication (GMAC): GCM authentication, no encryption

  • No Encapsulation: no encapsulation (clear text)

  • Null: encapsulation, no authentication or encryption

Configure a device SGT manually (CLI)

Configure a device Security Group Tag (SGT) using commands when the authentication server is unavailable.

When the authentication server is accessible, it assigns an SGT to your device for packets originating from your device. If the authentication server is not available, configure an SGT manually. The server-assigned SGT is always used instead of your manual configuration if both are present.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Configure a WLAN policy profile and enter the wireless policy configuration mode.

Example:

Device(config)# wireless profile policy profile-policy
3.

Specify the Security Group Tag (SGT) number.

Example:

Device(config-wireless-policy)# cts sgt sgt-value

The valid values are from 0 to 65,535.
4.

Return to the global configuration mode.

Example:

Device(config-wireless-policy)# exit

Configure ISE for TrustSec (CLI)

Set up ISE to enable secure network access using TrustSec policies using commands.
This task involves configuring a device to communicate with an ISE server as a RADIUS server and integrating TrustSec authorization.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Specify the RADIUS server name.

Example:

Device(config)# radius server server-name
3.

Specify the primary RADIUS server parameters.

Example:

Device(config-radius-server)# address ipv6 ip-address
4.

Specify the authentication and encryption key used between the Device and the key string RADIUS daemon running on the RADIUS server.

Example:

Device(config-radius-server)# pac key key
5.

Return to the configuration mode.

Example:

Device(config-radius-server)# exit
6.

Create a radius server-group identification.

Example:

Device(config)# aaa group server radius server-group
Note

server-group refers to the server group name. The valid range is from 1 to 32 alphanumeric characters.

7.

Create a CTS authorization list.

Example:

Device(config)# cts authorization list mlist-name
8.

Create an authorization method list for web-based authorization.

Example:

Device(config)# aaa authorization network mlist-name group group-name
Note

Ensure that the ISE IP address configured on your controller is the same as the IP address configured on ISE ( Work Center > TrustSec > Components > Trustsec AAA Servers ).

Note

If the ISE version is 002.005(000.239), 002.004(000.357), 002.003(000.298), 002.002(000.470), 002.001(000.474), 002.000(001.130), or 002.000(000.306), use the access-session tls-version 1.0 command to download PAC from ISE. For other ISE versions, the above command is not required.

Verify Cisco TrustSec configuration

To display the wireless CTS SGACL configuration summary, use this command:

Device# show wireless cts summary

Local Mode CTS Configuration

Policy Profile Name               SGACL Enforcement     Inline-Tagging   Default-Sgt      
----------------------------------------------------------------------------------------
xyz-policy                        DISABLED              ENABLED          0                
wireless-policy1                  DISABLED              DISABLED         0                
w-policy-profile1                 DISABLED              DISABLED         0                
default-policy-profile            DISABLED              DISABLED         0                


Flex Mode CTS Configuration

Flex Profile Name                 SGACL Enforcement     Inline-Tagging   
-----------------------------------------------------------------------
xyz-flex                          DISABLED              ENABLED          
demo-flex                         DISABLED              DISABLED         
flex-demo                         DISABLED              DISABLED         
xyz-flex-profile                  DISABLED              DISABLED         
default-flex-profile              DISABLED              DISABLED

To display CTS-specific configuration status for various wireless profiles, use this command:

Device# show cts wireless profile policy xyz-policy

Policy Profile Name         		: xyz-policy
CTS
  Role-based enforcement         : ENABLED
  Inline-tagging                 : ENABLED
  	Default SGT		 : 100

Policy Profile Name          		: foo2
CTS
  Role-based enforcement         : DISABLED
  Inline-tagging                 : ENABLED
  Default SGT		         : NOT-DEFINED

Policy Profile Name           	        : foo3
CTS
  Role-based enforcement         : DISABLED
  Inline-tagging                 : DISABLED
  Default SGT			 : 65001

To display CTS configuration for a given wireless profile, use this command:

Device# show wireless profile policy detailed xyz-policy
 
Policy Profile Name           : xyz-policy
Description                   : 
Status                        : DISABLED
VLAN                          : 1
Client count                  : 0
Passive Client                : DISABLED
ET-Analytics                  : DISABLED
StaticIP Mobility             : DISABLED
!
.
.
.WGB Policy Params
  Broadcast Tagging           : DISABLED
  Client VLAN                 : DISABLED
Mobility Anchor List
  IP Address                                  Priority
CTS
  Role-based enforcement         : ENABLED
  Inline-tagging                 : ENABLED
  Default SGT	                  : NOT-DEFINED