Copyright Page

Chapter 1. Cisco TrustSec SGT Exchange Protocol IPv4

Finding Feature Information

Prerequisites for Cisco TrustSec SGT Exchange Protocol IPv4

Restrictions for Cisco TrustSec SGT Exchange Protocol IPv4

Information About Cisco TrustSec SGT Exchange Protocol IPv4

Security Group Tagging

Using CTS-SXP for SGT Propagation Across Legacy Access Networks

VRF-Aware CTS-SXP

Security Group Access Zone-Based Policy Firewall

How to Configure the Cisco TrustSec SGT Exchange Protocol IPv4

Enabling CTS-SXP

Configuring a CTS-SXP Peer Connection

Configuring the Default CTS-SXP Password

Configuring the Default CTS-SXP Source IP Address

Configuring the CTS-SXP Reconciliation Period

Configuring the CTS-SXP Retry Period

Creating Syslogs to Capture IP-to-SGT Mapping Changes

Configuring a Class Map for a Security Group Access Zone-Based Policy Firewall

Creating a Policy Map for a Security Group Access Zone-Based Policy Firewall

Configuration Examples for Cisco TrustSec SGT Exchange Protocol IPv4

Example: Enabling and Configuring a CTS-SXP Peer Connection

Example: Configuring a Security Group Access Zone-Based Policy Firewall

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Feature Information for Cisco TrustSec SGT Exchange Protocol IPv4

Chapter 2. TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Finding Feature Information

Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Security Groups and SGTs

How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

Disabling CTS SGT Propagation on an Interface

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Chapter 1. Cisco TrustSec SGT Exchange Protocol IPv4

Cisco TrustSec (CTS) builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers. Communication on the links between devices in the domain is secured with a combination of encryption, message integrity check, and data-path replay protection mechanisms.

The Security Group Tag (SGT) Exchange Protocol (SXP) is one of several protocols that supports CTS and is referred to in this document as CTS-SXP. CTS-SXP is a control protocol for propagating IP-to-SGT binding information across network devices that do not have the capability to tag packets. CTS-SXP passes IP to SGT bindings from authentication points to upstream devices in the network. This process allows security services on switches, routers, or firewalls to learn identity information from access devices.

- Finding Feature Information

- Prerequisites for Cisco TrustSec SGT Exchange Protocol IPv4

- Restrictions for Cisco TrustSec SGT Exchange Protocol IPv4

- Information About Cisco TrustSec SGT Exchange Protocol IPv4

- How to Configure the Cisco TrustSec SGT Exchange Protocol IPv4

- Configuration Examples for Cisco TrustSec SGT Exchange Protocol IPv4

- Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Feature Information for Cisco TrustSec SGT Exchange Protocol IPv4

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for Cisco TrustSec SGT Exchange Protocol IPv4

The CTS-SXP network needs to be established before implementing SXP. The CTS-SXP network has the following prerequisites:

- To use the Cisco TrustSec functionality on your existing router, ensure that you have purchased a Cisco TrustSec security license. If the router is being ordered and needs the Cisco TrustSec functionality, ensure that this license is pre-installed on your router before it is shipped to you.

- CTS-SXP software runs on all network devices

- Connectivity exists between all network devices

- The Cisco Identity Services Engine 1.0 is required for authentication. The Secure Access Control Server (ACS) Express Appliance server can also be used for authentication, however not all ACS features are supported by CTS. ACS 5.1 operates with a CTS-SXP license

- Configure the retry open timer command to a different value on different routers.

Restrictions for Cisco TrustSec SGT Exchange Protocol IPv4

- The Cisco TrustSec Support for IOS feature is supported on the Cisco Integrated Services Router Generation 2 (ISR G2) only.

- CTS-SXP is supported only on physical interfaces, not on logical interfaces.

- CTS-SXP does not support IPv6.

- If the default password is configured on a router, the connection on that router should configure the password to use the default password. If the default password is not configured, the connection on that router should configure to not use the password configuration. The configuration of the password option should be consistent across the deployment network.

Information About Cisco TrustSec SGT Exchange Protocol IPv4

- Security Group Tagging

- Using CTS-SXP for SGT Propagation Across Legacy Access Networks

- VRF-Aware CTS-SXP

- Security Group Access Zone-Based Policy Firewall

Security Group Tagging

CTS-SXP uses the device and user credentials acquired during authentication for classifying the packets by security groups (SGs) as they enter the network. This packet classification is maintained by tagging packets on ingress to the CTS-SXP network so that they can be properly identified for the purpose of applying security and other policy criteria along the data path. The Security Group Tag (SGT) allows the network to enforce the access control policy by enabling the endpoint device to act upon the SGT to filter traffic.

Using CTS-SXP for SGT Propagation Across Legacy Access Networks

Tagging packets with SGTs requires hardware support. There may be devices in the network that can participate in CTS authentication, but lack the hardware capability to tag packets with SGTs. However, if CTS-SXP is used, then these devices can pass IP-to-SGT mappings to a CTS peer device that has CTS-capable hardware.

CTS-SXP typically operates between ingress access layer devices at the CTS domain edge and distribution layer devices within the CTS domain. The access layer device performs CTS authentication of external source devices to determine the appropriate SGTs for ingress packets. The access layer device learns the IP addresses of the source devices using IP device tracking and (optionally) DHCP snooping, then uses CTS-SXP to pass the IP addresses of the source devices along with their SGTs to the distribution switches. Distribution switches with CTS-capable hardware can use this IP-to-SGT mapping information to tag packets appropriately and to enforce Security Group Access Control List (SGACL) policies as shown in the figure below. An SGACL associates an SGT with a policy. The policy is enforced when SGT-tagged traffic egresses the CTS domain.

How CTS-SXP Propagates SGT Information

You must manually configure a CTS-SXP connection between a peer without CTS hardware support and a peer with CTS hardware support. The following tasks are required when configuring the CTS-SXP connection:

- If CTS-SXP data integrity and authentication are required, the same CTS-SXP password can be configured on both peer devices. The CTS-SXP password can be configured either explicitly for each peer connection or globally for the device. Although a CTS-SXP password is not required it is recommended.

- Each peer on the CTS-SXP connection must be configured as either a CTS-SXP speaker or CTS-SXP listener. The speaker device distributes the IP-to-SGT mapping information to the listener device.

- A source IP address can be specified to use for each peer relationship or a default source IP address can be configured for peer connections where a specific source IP address is not configured. If no source IP address is specified, then the device uses the interface IP address of the connection to the peer.

CTS-SXP allows multiple hops. That is, if the peer of a device lacking CTS hardware support also lacks CTS hardware support, the second peer can have a CTS-SXP connection to a third peer, continuing the propagation of the IP-to-SGT mapping information until a hardware-capable peer is reached. A device can be configured as a CTS-SXP listener for one CTS-SXP connection as a CTS-SXP speaker for another CTS-SXP connection.

A CTS device maintains connectivity with its CTS-SXP peers by using the TCP keepalive mechanism. To establish or restore a peer connection, the device repeatedly attempts the connection setup by using the configured retry period until the connection is successful or until the connection is removed from the configuration.

VRF-Aware CTS-SXP

The CTS-SXP implementation of Virtual Routing and Forwarding (VRF) binds a CTS-SXP connection with a specific VRF. It is assumed that the network topology is correctly configured for Layer 2 or Layer 3 VPNs, and that all VRFs are configured before enabling CTS-SXP.

CTS-SXP VRF support can be summarized as follows:

- Only one CTS-SXP connection can be bound to one VRF.

- Different VRFs may have overlapping CTS-SXP peer or source IP addresses.

- IP-to-SGT mappings learned (added or deleted) in one VRF can be updated only in the same VRF domain. The CTS-SXP connection cannot update a mapping bound to a different VRF. If no SXP connection exits for a VRF, IP-SGT mappings for that VRF won’t be updated by SXP.

- CTS-SXP does not support the establishment of connections with a source IPv6 address. However, multiple address families per VRF are supported where one CTS-SXP connection in a VRF domain can forward both IPv4 and IPv6 IP-to-SGT mappings.

- CTS-SXP has no limitation on the number of connections and number of IP-to-SGT mappings per VRF.

Security Group Access Zone-Based Policy Firewall

CTS-SXP extends the deployment of network devices to additional places on the network by using the Security Group Access (SGA) Zone-Based Policy firewalls (ZBPFs). CTS-SXP is used for Identity distribution through inline devices where the identity information is learned from a primary communication path that exists across networks as shown in the figure below.

The Security Group Tag (SGT) is used by the SGA ZBPF to apply enforcement policy. IP-to-SGT mapping information is learned through CTS-SXP. When a packet arrives, source and destination IP addresses in the packet are used to derive source and destination tags. The Identity firewall applies a policy to the received IP packets based on the configured policy where the SGT is one of the attributes.

CTS-SXP SGA ZBPF Distribution Path Across Networks

How to Configure the Cisco TrustSec SGT Exchange Protocol IPv4

- Enabling CTS-SXP

- Configuring a CTS-SXP Peer Connection

- Configuring the Default CTS-SXP Password

- Configuring the Default CTS-SXP Source IP Address

- Configuring the CTS-SXP Reconciliation Period

- Configuring the CTS-SXP Retry Period

- Creating Syslogs to Capture IP-to-SGT Mapping Changes

- Configuring a Class Map for a Security Group Access Zone-Based Policy Firewall

- Creating a Policy Map for a Security Group Access Zone-Based Policy Firewall

Enabling CTS-SXP

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp enable

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp enable

Example:

Device(config)# cts sxp enable

Enables a CTS-SXP connection to any peer connection that is configured.

Note:
Ensure that peer connections are configured. If peer connections are not configured, then CTS-SXP connections cannot be established with them.

Configuring a CTS-SXP Peer Connection

The CTS-SXP peer connection must be configured on both devices. One device is the speaker and the other is the listener. When using password protection, make sure to use the same password on both ends.

Note

If a default CTS-SXP source IP address is not configured and you do not configure a CTS-SXP source address in the connection, the Cisco TrustSec software derives the CTS-SXP source IP address from existing local IP addresses. The CTS-SXP source IP address might be different for each TCP connection initiated from the router.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp connection peer ipv4-address {source | password} {default | none} mode {local | peer} [[listener | speaker] [vrf vrf-name]]

4.    exit

5.    show cts sxp {connections | sgt-map} [brief | vrf vrf-name]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp connection peer ipv4-address {source | password} {default | none} mode {local | peer} [[listener | speaker] [vrf vrf-name]]

Example:

Device(config)# cts sxp connection peer 10.20.2.2 password default mode local speaker

Configures the CTS-SXP peer address connection.

The source keyword specifies the IPv4 address of the source device. If no address is specified, the connection uses the default source address, if configured, or the address of the port.

The password keyword specifies the password that CTS-SXP uses for the connection using the following options:

- default—Use the default CTS-SXP password you configured using the cts sxp default password command.

- none—A password is not used.

The mode keyword specifies the role of the remote peer device:

- local—The specified mode refers to the local device.

- peer—The specified mode refers to the peer device.

- listener—Specifies that the device is the listener in the connection.

- speaker—Specifies that the device is the speaker in the connection. This is the default.

The optional vrf keyword specifies the VRF to the peer. The default is the default VRF.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and returns to privileged EXEC mode.

Step 5

show cts sxp {connections | sgt-map} [brief | vrf vrf-name]

Example:

Device# show cts sxp connections

(Optional) Displays CTS-SXP status and connections.

Configuring the Default CTS-SXP Password

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp default password [0 | 6 | 7] password

4.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp default password [0 | 6 | 7] password

Example:

Device(config)# cts sxp default password Cisco123

Configures the CTS-SXP default password. You can enter either a clear text password (using the 0 or no option) or an encrypted password (using the 6 or 7 option). The maximum password length is 32 characters.

Note:
By default, CTS-SXP uses no password when setting up connections.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and returns to privileged EXEC mode.

Configuring the Default CTS-SXP Source IP Address

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp default source-ip src-ip-addr

4.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp default source-ip src-ip-addr

Example:

Device(config)# cts sxp default source-ip 10.20.2.2

Configures the CTS-SXP default source IP address that is used for all new TCP connections where a source IP address is not specified.

Note:
Existing TCP connections are not affected when the default CTS-SXP source IP address is configured.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and returns to privileged EXEC mode.

Configuring the CTS-SXP Reconciliation Period

After a peer terminates a CTS-SXP connection, an internal hold-down timer starts. If the peer reconnects before the internal hold-down timer expires, the CTS-SXP reconciliation period timer starts. While the CTS-SXP reconciliation period timer is active, the CTS software retains the SGT mapping entries learned from the previous connection and removes invalid entries. The default value is 120 seconds (2 minutes). Setting the CTS-SXP reconciliation period to 0 seconds disables the timer and causes all entries from the previous connection to be removed.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp reconciliation period seconds

4.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp reconciliation period seconds

Example:

Device(config)# cts sxp reconciliation period 150

Sets the CTS-SXP reconciliation timer, in seconds. The range is from 0 to 64000. The default is 120.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and enters privileged EXEC mode.

Configuring the CTS-SXP Retry Period

The CTS-SXP retry period determines how often the CTS software retries a CTS-SXP connection. If a CTS-SXP connection is not established successfully, then the CTS software makes a new attempt to set up the connection after the CTS-SXP retry period timer expires. The default value is 2 minutes. Setting the CTS-SXP retry period to 0 seconds disables the timer and retries are not attempted.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp retry period seconds

4.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp retry period seconds

Example:

Device(config)# cts sxp retry period 160

Sets the CTS-SXP retry timer, in seconds. The range is from 0 to 64000. The default is 120.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and returns to privileged EXEC mode.

Creating Syslogs to Capture IP-to-SGT Mapping Changes

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    cts sxp log binding-changes

4.    exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

cts sxp log binding-changes

Example:

Device(config)# cts sxp log binding-changes

Enables logging for IP-to-SGT binding changes causing CTS-SXP syslogs (sev 5 syslog) to be generated whenever a change to IP-to-SGT binding occurs (add, delete, change). These changes are learned and propagated on the CTS-SXP connection.

Note:
This logging function is disabled by default.

Step 4

exit

Example:

Device# exit

Exits global configuration mode and returns to privileged EXEC mode.

Configuring a Class Map for a Security Group Access Zone-Based Policy Firewall

Perform this task to configure a class map for classifying Security Group Access (SGA) zone-based policy firewall network traffic.

Note

You must perform at least one match step.

The zone-based firewall policy uses the Security Group Tag ID for filtering. In a zone-based firewall policy, only the first packet that creates a session matches the policy. Subsequent packets in this flow do not match the filters in the configured policy, but instead match the session directly. The statistics related to subsequent packets are shown as part of the inspect action.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    object-group security name

4.    security-group tag-id sgt-id

5.    group-object name

6.    description text

7.    exit

8.    class-map type inspect [match-any | match-all] class-map-name

9.    match group-object security source name

10.    match group-object security destination name

11.    end

12.    show object-group [name]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

object-group security name

Example:

Device(config)# object-group security myobject1a

Creates an object group to identify traffic coming from a specific user or endpoint and enters object-group identity mode.

Step 4

security-group tag-id sgt-id

Example:

Device(config-object-group)# security-group tag-id 120

Specifies the membership of a security group by using the SGT ID number. This number can be from 1 to 65535. Multiple security groups can be specified using this command.

Step 5

group-object name

Example:

Device(config-object-group)# group-object admin

(Optional) Specifies a nested reference to a type of user group. Multiple nested user groups can be specified using this command.

Step 6

description text

Example:

Device(config-object-group)# description my sgtinfo

(Optional) Defines information about the security group.

Step 7

exit

Example:

Device(config-object-group)# exit

Exits object-group identity mode and enters global configuration mode.

Step 8

class-map type inspect [match-any | match-all] class-map-name

Example:

Device(config)# class-map type inspect match-any myclass1

Creates a Layer 3 or Layer 4 inspect type class map and enters class-map configuration mode.

Step 9

match group-object security source name

Example:

Device(config-cmap)# match group-object security source myobject1

Matches traffic from a user in the security group.

Step 10

match group-object security destination name

Example:

Device(config-cmap)# match group-object security destination myobject1

Matches traffic for a user in the security group.

Step 11

end

Example:

Device(config-cmap)# end

Exits class-map configuration mode and enters privileged EXEC mode.

Step 12

show object-group [name]

Example:

Device# show object-group admin

(Optional) Displays the content of all user groups. Optionally, use the name argument to show information for a single group.

Creating a Policy Map for a Security Group Access Zone-Based Policy Firewall

Perform this task to create a policy map for a Security Group Access (SGA) zone-based policy firewall that is attached to zone pairs. This task also helps to configure Identity Firewall (IDFW) to work with Security Group Tag (SGT) Exchange Protocol (SXP) or L2-tagged traffic on the interfaces that belong to the security zones.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    policy-map type inspect policy-map-name

4.    class type inspect class-name

5.    inspect

6.    exit

7.    zone-pair security zone-pair-name source source-zone destination destination-zone

8.    service-policy type inspect policy-map-name

9.    end

10.    interface type number

11.    zone-member security zone-name

12.    cts manual

13.    no propagate sgt

14.    policy static sgt tag [trusted]

15.    exit

16.    show policy-map type inspect zone-pair session

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

policy-map type inspect policy-map-name

Example:

Device(config)# policy-map type inspect z1z2-policy

Creates a Layer 3 or Layer 4 inspect type policy map.

- Enters policy map configuration mode.

Step 4

class type inspect class-name

Example:

Device(config-pmap)# class type inspect cmap-1

Specifies the traffic (class) on which an action is to be performed and enters policy-map class configuration mode.

Step 5

inspect

Example:

Device(config-pmap-c)# inspect

Enables packet inspection.

Step 6

exit

Example:

Device(config-pmap-c)# exit

Exits policy-map class configuration mode and enters global configuration mode.

Step 7

zone-pair security zone-pair-name source source-zone destination destination-zone

Example:

Device(config)# zone-pair security z1z2 source z1 destination z2

Creates a zone pair and enters security zone configuration mode.
Note:
To apply a policy, you must configure a zone pair.

Step 8

service-policy type inspect policy-map-name

Example:

Device(config-sec-zone)# service-policy type inspect z1z2-policy2

Attaches a firewall policy map to the destination zone pair.
Note:
If a policy is not configured between a pair of zones, traffic is dropped by default.

Step 9

end

Example:

Device(config-sec-zone)# end

Exits security zone configuration mode and enters global configuration mode.

Step 10

interface type number

Example:

Device(config)# interface GigabitEthernet 0/1/1

Configures an interface and enters interface configuration mode.

Step 11

zone-member security zone-name

Example:

Device(config-if)# zone-member security Inside

Assigns an interface to a specified security zone.
Note:
When you make an interface a member of a security zone, all traffic in and out of that interface (except traffic bound for the router or initiated by the router) is dropped by default. To let traffic through the interface, you must make the zone part of a zone pair to which you should apply a policy. If the policy permits traffic, traffic can flow through that interface.

Step 12

cts manual

Example:

Device(config-if)# cts manual

Enables the interface for Cisco TrustSec Security (CTS) SGT authorization and forwarding, and enters CTS manual interface configuration mode.

Step 13

no propagate sgt

Example:

Device(config-if-cts-manual)# no propagate sgt

Disables SGT propagation at Layer 2 on CTS interfaces.

Step 14

policy static sgt tag [trusted]

Example:

Device(config-if-cts-manual)# policy static sgt 100 trusted

Configures a static authorization policy for a CTS security group with a tagged packet that defines the trustworthiness of the SGT.

Step 15

exit

Example:

Device(config-if)# exit

Exits security zone configuration mode and enters privileged EXEC mode.

Step 16

show policy-map type inspect zone-pair session

Example:

Device# show policy-map type inspect zone-pair session

(Optional) Displays the Cisco IOS stateful packet inspection sessions created because of the policy-map application on the specified zone pair.

Note:
The information displayed under the class-map field is the traffic rate (bits per second) of the traffic that belongs to the connection-initiating traffic only. Unless the connection setup rate is significantly high and is sustained for multiple intervals over which the rate is computed, no significant data is shown for the connection.

Example:

The following sample output of the show policy-map type inspect zone-pair session command displays the information about the Cisco IOS stateful packet inspection sessions created because of the policy-map application on the specified zone pair:

Device# show policy-map type inspect zone-pair session

Zone-pair: in-out
Service-policy inspect : test

Class-map: test (match-any)
Match: group-object security source sgt
Inspect
Established Sessions
Session 113EF68C (192.2.2.1:8)=>(198.51.100.252:153) icmp SIS_OPEN
Created 00:00:02, Last heard 00:00:02
Bytes sent (initiator:responder) [360:360]

Class-map: class-default (match-any)
Match: any
Drop (default action)
310 packets, 37380 bytes

Configuration Examples for Cisco TrustSec SGT Exchange Protocol IPv4

- Example: Enabling and Configuring a CTS-SXP Peer Connection

- Example: Configuring a Security Group Access Zone-Based Policy Firewall

Example: Enabling and Configuring a CTS-SXP Peer Connection

The following example shows how to enable CTS-SXP and configure the CTS-SXP peer connection on Device_A, a speaker, for connection to Device_B, a listener:

Device# configure terminal
Device_A(config)# cts sxp enable
Device_A(config)# cts sxp default password Cisco123
Device_A(config)# cts sxp default source-ip 10.10.1.1
Device_A(config)# cts sxp connection peer 10.20.2.2 password default mode local speaker

The following example shows how to configure the CTS-SXP peer connection on Device_B, a listener, for connection to Device_A, a speaker:

Device# configure terminal
Device_B(config)# cts sxp enable
Device_B(config)# cts sxp default password Cisco123
Device_B(config)# cts sxp default source-ip 10.20.2.2
Device_B(config)# cts sxp connection peer 10.10.1.1 password default mode local listener

The following sample output for show cts sxp connections command displays CTS-SXP connections:

Device_B# show cts sxp connections

SXP              : Enabled
Default Password : Set
Default Source IP: 10.10.1.1
Connection retry open period: 10 secs
Reconcile period: 120 secs
Retry open timer is not running
----------------------------------------------
Peer IP          : 10.20.2.2
Source IP        : 10.10.1.1
Conn status      : On
Connection mode  : SXP Listener
Connection inst# : 1
TCP conn fd      : 1
TCP conn password: default SXP password
Duration since last state change: 0:00:21:25 (dd:hr:mm:sec)
Total num of SXP Connections = 1

Example: Configuring a Security Group Access Zone-Based Policy Firewall

The following example shows the configuration of a class map and policy map for an SGA zone-based policy firewall.

Device(config)# object-group security myobject1
Device(config-object-group)# security-group tag-id 1
Device(config-object-group)# exit
Device(config)# object-group security myobject2
Device(config-object-group)# security-group tag-id 2
Device(config-object-group)# exit
Device(config)# object-group security myobject3
Device(config-object-group)# security-group tag-id 3
Device(config-object-group)# exit
Device(config)# object-group security myobject4
Device(config-object-group)# security-group tag-id 4
Device(config-object-group)# exit

Device(config)# class-map type inspect match-any myclass1
Device(config-cmap)# match group-object security source myobject1
Device(config-cmap)# exit
Device(config)# class-map type inspect match-any myclass2
Device(config-cmap)# match group-object security source myobject2
Device(config-cmap)# exit
Device(config)# class-map type inspect match-any myclass3
Device(config-cmap)# match group-object security source myobject3
Device(config-cmap)# exit
Device(config)# class-map type inspect match-any myclass4
Device(config-cmap)# match group-object security source myobject4
Device(config-cmap)# exit

Device(config)# policy-map type inspect InsideOutside
Device(config-pmap)# class type inspect myclass1
Device(config-pmap-c)# pass
Device(config-pmap-c)# exit
Device(config-pmap)# class type inspect myclass2
Device(config-pmap-c)# drop log
Device(config-pmap-c)# exit

Device(config)# policy-map type inspect OutsideInside
Device(config-pmap)# class type inspect myclass3
Device(config-pmap-c)# pass
Device(config-pmap-c)# exit
Device(config-pmap)# class type inspect myclass4
Device(config-pmap-c)# drop
Device(config-pmap-c)# exit

Device(config)# zone-pair security Inside
Device(config-sec-zone)# description Firewall Inside Zone
Device(config-sec-zone)# exit

Device(config)# zone-pair security Outside
Device(config-sec-zone)# description Firewall Outside Zone
Device(config-sec-zone)# exit

Device(config)# zone-pair security InsideOutside source Inside destination Outside
Device(config-sec-zone)# description Firewall ZonePair Inside Outside
Device(config-sec-zone)# service-policy type inspect InsideOutside
Device(config-sec-zone)# exit

Device(config)# zone-pair security OutsideInside source Outside destination Inside
Device(config-sec-zone)# description Firewall ZonePair Outside Inside
Device(config-sec-zone)# service-policy type inspect OutsideInside
Device(config-sec-zone)# exit

Device(config)# interface Gigabit 0/1/1
Device(config-if)# zone-member security Inside
Device(config-if)# exit

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

Cisco IOS Security Command Reference: Commands A to C

Cisco IOS Security Command Reference: Commands D to L

Cisco IOS Security Command Reference: Commands M to R

Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec switches

Cisco TrustSec Switch Configuration Guide

MIBs

MIB

MIBs Link

CISCO-TRUSTSEC-SXP-MIB

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for Cisco TrustSec SGT Exchange Protocol IPv4

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for Cisco TrustSec SGT Exchange Protocol IPv4

Feature Name

Releases

Feature Information

Cisco TrustSec SGT Exchange Protocol IPv4

Cisco IOS 12.2(33)SXI3

Cisco IOS 15.1(3)S

Cisco IOS 15.1(2)SY1

The Security Group Tag (SGT) Exchange Protocol (SXP) is one of several protocols that supports CTS and is referred to in this document as CTS-SXP. CTS-SXP is a control protocol for propagating IP-to-SGT binding information across network devices that do not have the capability to tag packets. CTS-SXP passes IP-to-SGT bindings from authentication points to upstream devices in the network. This allows security services on switches, routers, or firewalls to learn identity information from access devices.

The following commands were introduced or modified: cts sxp enable, cts sxp connection peer, show cts sxp, cts sxp default source-ip, cts sxp reconciliation period, cts sxp retry period, cts sxp log binding-changes.

TrustSec SG Firewall Enforcement IPv4

Cisco IOS 15.2(1)S

This feature helps CTS-SXP extend the deployment of network devices through Security Group Access (SGA) Zone-Based Policy firewalls (ZBPFs).

The following commands were introduced or modified: group-object, match group-object security, object-group security, policy static sgt, and security-group.

Chapter 2. TrustSec SGT Handling: L2 SGT Imposition and Forwarding

First Published: July 25, 2011

Cisco TrustSec (CTS) builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers. Communication on the links between devices in the domain is secured with a combination of encryption, message integrity check, and data-path replay protection mechanisms.

The TrustSec SGT Handling: L2 SGT Imposition and Forwarding feature allows the interfaces in a router to be manually enabled for CTS so that the router can insert the Security Group Tag (SGT) in the packet to be carried throughout the network in the CTS header.

- Finding Feature Information

- Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

The CTS network needs to be established with the following prerequisites before implementing the TrustSec SGT Handling: L2 SGT Imposition and Forwarding feature:

- Connectivity exists between all network devices

- Cisco Secure Access Control System (ACS) 5.1 operates with a CTS-SXP license

- Directory, DHCP, DNS, certificate authority, and NTP servers function within the network

- Configure the retry open timer command to a different value on different routers.

Information about TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Security Groups and SGTs

Security Groups and SGTs

A security group is a grouping of users, endpoint devices, and resources that share access control policies. Security groups are defined by the administrator in the ACS. As new users and devices are added to the Cisco TrustSec (CTS) domain, the authentication server assigns these new entities to appropriate security groups. CTS assigns to each security group a unique 16-bit security group number whose scope is global within a CTS domain. The number of security groups in the router is limited to the number of authenticated network entities. Security group numbers do not need to be manually configured.

Once a device is authenticated, CTS tags any packet that originates from that device with an SGT that contains the security group number of the device. The packet carries this SGT throughout the network within the CTS header. The SGT is a single label that determines the privileges of the source within the entire CTS domain. The SGT is identified as the source because it contains the security group of the source. The destination device is assigned a destination group tag (DGT).

Note

The CTS packet tag does not contain the security group number of the destination device.

How to Configure TrustSec SGT Handling: L2 SGT Imposition and Forwarding

- Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

- Disabling CTS SGT Propagation on an Interface

Manually Enabling TrustSec SGT Handling: L2 SGT Imposition and Forwarding on an Interface

Perform the following steps to manually enable an interface on the device for Cisco TrustSec (CTS) so that the device can add Security Group Tag (SGT) in the packet to be propagated throughout the network and to implement a static authorization policy.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface {GigabitEthernetport | Vlan number}

4.    cts manual

5.    policy static sgt tag [trusted]

6.    end

7.    show cts interface [GigabitEthernetport | Vlan number | brief | summary]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface {GigabitEthernetport | Vlan number}

Example:

Device(config)# interface gigabitethernet 0

Enters the interface on which CTS SGT authorization and forwarding is enabled

Step 4

cts manual

Example:

Device(config-if)# cts manual

Enables the interface for CTS SGT authorization and forwarding, and enters CTS manual interface configuration mode.

Step 5

policy static sgt tag [trusted]

Example:

Device(config-if-cts-manual)# policy static sgt 100 trusted

Configures a static authorization policy for a CTS security group with a tagged packet that defines the trustworthiness of the SGT.

Step 6

end

Example:

Device(config-if-cts-manual)# end

Exits CTS manual interface configuration mode and enters privileged EXEC mode.

Step 7

show cts interface [GigabitEthernetport | Vlan number | brief | summary]

Example:

Device# show cts interface brief

Displays CTS configuration statistics for the interface.

Example:

The following is sample output for the show cts interface briefcommand.

Cisco ASR 1000 Series Aggregation Services Routers and Cisco Cloud Services Router 1000V Series

Device# show cts interface brief

Global Dot1x feature is Disabled
Interface GigabitEthernet0/1/0:
CTS is enabled, mode:    MANUAL
IFC state:               OPEN
Interface Active for 00:00:40.386
Authentication Status:   NOT APPLICABLE
Peer identity:       "unknown"
Peer's advertised capabilities: ""
Authorization Status:    NOT APPLICABLE
SAP Status:              NOT APPLICABLE
Propagate SGT:           Enabled
Cache Info:
Cache applied to link : NONE

Cisco 4400 Series Integrated Services Routers

Device# show cts interface brief

Interface GigabitEthernet0/1/0
CTS is enabled, mode:     MANUAL
Propagate SGT:          Enabled
Static Ingress SGT Policy:
Peer SGT:             100
Peer SGT assignment:  Trusted

Disabling CTS SGT Propagation on an Interface

Follow these steps to disable CTS SGT Propagation on an interface in an instance when a peer device is not capable of receiving an SGT.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface {GigabitEthernetport | Vlan number}

4.    cts manual

5.    no propagate sgt

6.    end

7.    show cts interface [GigabitEthernetport | Vlan number | brief | summary]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

- Enter your password if prompted.

Step 2

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

interface {GigabitEthernetport | Vlan number}

Example:

Router(config)# interface gigabitethernet 0

Enters the interface on which CTS SGT authorization and forwarding is enabled

Step 4

cts manual

Example:

Router(config-if)# cts manual

Enables the interface for CTS SGT authorization and forwarding.

CTS manual interface configuration mode is entered where CTS parameters can be configured.

Step 5

no propagate sgt

Example:

Router(config-if-cts-manual)# no propagate sgt

Disables CTS SGT propagation on an interface in situations where a peer device is not capable of receiving an SGT.
Note:
CTS SGT propagation is enabled by default. The propagate sgt command can be used if CTS SGT propagation needs to be turned on again for a peer device.

Once the no propagate sgt command is entered, the SGT tag is not added in the L2 header.

Step 6

end

Example:

Router(config-if-cts-manual)# end

Exits CTS manual interface configuration mode and enters privileged EXEC mode.

Step 7

show cts interface [GigabitEthernetport | Vlan number | brief | summary]

Example:

Router# show cts interface brief
Global Dot1x feature is Disabled
Interface GigabitEthernet0:
CTS is enabled, mode:    MANUAL
IFC state:               OPEN
Authentication Status:   NOT APPLICABLE
Peer identity:       "unknown"
Peer's advertised capabilities: ""
Authorization Status:    NOT APPLICABLE
SAP Status:              NOT APPLICABLE
Propagate SGT:           Disabled
Cache Info:
Cache applied to link : NONE

Displays CTS configuration statistics to verify that CTS SGT propagation was disabled on interface.

Additional References for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

Security commands

Cisco IOS Security Command Reference: Commands A to C

Cisco IOS Security Command Reference: Commands D to L

Cisco IOS Security Command Reference: Commands M to R

Cisco IOS Security Command Reference: Commands S to Z

Cisco TrustSec switches

Cisco TrustSec Switch Configuration Guide

MIBs

MIB

MIBs Link

CISCO-TRUSTSEC-SXP-MIB

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Click Here

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Feature Information for TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Feature Name

Releases

Feature Information

TrustSec SGT Handling: L2 SGT Imposition and Forwarding

Cisco IOS 15.1(3)S

Cisco IOS 15.2(2)T

Cisco IOS 15.1(2)SY1

This feature allows the interfaces in a router to be manually enabled for CTS so that the router can insert the Security Group Tag (SGT) in the packet to be carried throughout the network in the CTS header.

The following commands were introduced or modified: cts manual, policy static sgt, propagate sgt, show cts interface.