Cisco TrustSec User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco TrustSec Switch Configuration
Guide
For Cisco Catalyst Switches
Updated: October 2013
Text Part Number: OL-22192-02

CCVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of
Cisco Systems, Inc.; and Access Registrar, Aironet, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo,
Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step,
Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study,
LightStream, Linksys, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way
to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0711R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco TrustSec Switch Configuration Guide
© 2010-2013 Cisco Systems, Inc. All rights reserved.

iii
Cisco TrustSec Configuration Guide
OL-22192-01
CONTENTS
Preface ix
Cisco TrustSec Overview 1-1
Information about Cisco TrustSec Architecture 1-1
Authentication 1-3
Cisco TrustSec and Authentication 1-3
Device Identities 1-6
Device Credentials 1-6
User Credentials 1-6
Security Group-Based Access Control 1-7
Security Groups and SGTs 1-7
SGACL Policies 1-7
Ingress Tagging and Egress Enforcement 1-8
Determining the Source Security Group 1-9
Determining the Destination Security Group 1-10
SGACL Enforcement on Routed and Switched Traffic 1-10
Authorization and Policy Acquisition 1-10
Environment Data Download 1-11
RADIUS Relay Functionality 1-12
Link Security 1-12
Using Cisco TrustSec-Incapable Devices and Networks in a Cisco TrustSec Network 1-13
SXP for SGT Propagation Across Legacy Access Networks 1-13
Layer 3 SGT Transport for Spanning Non-TrustSec Regions 1-14
Cisco TrustSec Reflector for Cisco TrustSec-Incapable Switching Modules 1-15
Ingress Reflector 1-16
Egress Reflector 1-16
VRF-Aware SXP 1-17
Layer 2 VRF-Aware SXP and VRF Assignment 1-17

Contents
iv
Cisco TrustSec Configuration Guide
OL-22192-01
Configuring the Cisco TrustSec Solution 2-1
Configuration Overview 2-1
Cisco TrustSec Configuration How-to Documents 2-1
Supported Hardware and Software 2-2
Prerequisites for Cisco TrustSec 2-2
Cisco TrustSec Guidelines and Limitations 2-3
Default Settings 2-3
Additional Documentation 2-3
Release-Specific Documents 2-3
Platform-Specific Documents 2-4
Cisco IOS TrustSec Documentation Set 2-5
Configuring Identities, Connections, and SGTs 3-1
Cisco TrustSec Identity Configuration Feature Histories 3-1
Configuring Credentials and AAA for a Cisco TrustSec Seed Device 3-2
Configuration Examples for Seed Device 3-3
Configuring Credentials and AAA for a Cisco TrustSec Non-Seed Device 3-3
Configuration Examples for Non-Seed Device 3-4
Enabling Cisco TrustSec Authentication and MACsec in 802.1X Mode on an Uplink Port 3-5
Configuration Examples for 802.1X on Uplink Port 3-6
Configuring Cisco TrustSec and MACsec in Manual Mode on an Uplink Port 3-6
Configuration Examples for Manual Mode and MACsec on an Uplink Port 3-8
Regenerating SAP Key on an Interface 3-9
Verifying the Cisco TrustSec Interface Configuration 3-9
Manually Configuring a Device SGT 3-11
Configuration Examples for Manually Configuring a Device SGT 3-11
Manually Configuring IP-Address-to-SGT Mapping 3-12
Subnet to SGT Mapping 3-12
Default Settings 3-12
Configuring Subnet to SGT Mapping 3-12
Verifying Subnet to SGT Mapping Configuration 3-15
Configuration Examples for Subnet to SGT Mapping 3-15
VLAN to SGT Mapping 3-16
Default Settings 3-17
Configuring VLAN to SGT Mapping 3-17
Verifying VLAN to SGT Mapping 3-19
Configuration Example for VLAN to SGT Mapping for a Single Host Over an Access Link 3-19

Contents
v
Cisco TrustSec Configuration Guide
OL-22192-01
Layer 3 Logical Interface to SGT Mapping (L3IF–SGT Mapping) 3-20
Feature History for L3IF-SGT Mapping 3-21
Default Settings 3-21
Configuring L3IF to SGT Mapping 3-21
Verifying L3IF to SGT Mapping 3-21
Configuration Example for L3IF to SGT Mapping on an Ingress Port 3-22
Binding Source Priorities 3-22
Configuring Additional Authentication Server-Related Parameters 3-23
Automatically Configuring a New or Replacement Password with the Authentication Server 3-24
Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport 4-1
Cisco TrustSec SGT Exchange Protocol Feature Histories 4-1
Configuring Cisco TrustSec SXP 4-2
Enabling Cisco TrustSec SXP 4-2
Configuring an SXP Peer Connection 4-2
Configuring the Default SXP Password 4-4
Configuring the Default SXP Source IP Address 4-4
Changing the SXP Reconciliation Period 4-5
Changing the SXP Retry Period 4-5
Creating Syslogs to Capture Changes of IP Address to SGT Mapping Learned Through SXP 4-5
Verifying the SXP Connections 4-6
Configuring Layer 3 SGT Transport Between Cisco TrustSec Domains 4-6
Configuring Cisco TrustSec Reflector for Cisco TrustSec-Incapable Switching Modules 4-8
Configuring Cisco TrustSec Caching 4-9
Enabling Cisco TrustSec Caching 4-9
Clearing the Cisco TrustSec Cache 4-10
Configuring SGACL Policies 5-1
Cisco TrustSec SGACL Feature Histories 5-1
SGACL Policy Configuration Process 5-2
Enabling SGACL Policy Enforcement Globally 5-2
Configuration Examples for Enabling SGACL Policy Enforcement Globally 5-2
Enabling SGACL Policy Enforcement Per Interface 5-3
Configuration Examples for Enabling SGACL Policy Enforcement Per Interface 5-3
Enabling SGACL Policy Enforcement on VLANs 5-3
Configuration Examples for Enabling SGACL Policy Enforcement on VLANs 5-3

Contents
vi
Cisco TrustSec Configuration Guide
OL-22192-01
Manually Configuring SGACL Policies 5-4
Manually Configuring and Applying IPv4 SGACL Policies 5-4
Configuration Examples for Manually Configuring SGACL Policies 5-5
Displaying SGACL Policies 5-6
Refreshing the Downloaded SGACL Policies 5-7
Configuring Endpoint Admission Control 6-1
Information About Endpoint Admission Control 6-1
Basic EAC Configuration Sequence 6-2
802.1X Authentication Configuration 6-2
Verifying the 802.1X Configuration 6-2
MAC Authentication Bypass Configuration 6-3
Verifying the MAB Configuration 6-3
Web Authentication Proxy Configuration 6-4
Verifying Web Authentication Proxy Configuration 6-4
Flexible Authentication Sequence and Failover Configuration 6-5
802.1X Host Modes 6-5
Pre-Authentication Open Access 6-5
DHCP Snooping and SGT Assignment 6-6
Verifying the SGT to Endpoint Host Binding 6-6
Cisco TrustSec Endpoint Access Control Feature Histories 6-7
Cisco TrustSec Command Summary 7-1
Notes for Catalyst 3000 and 2000 Series Switches and WLC 5700 Series Wireless LAN
Controllers A-1
Supported Hardware and Software A-1
Configuration Guidelines and Restrictions A-1
Global Cat3K Restrictions A-1
Catalyst 3850 and Catalyst 3650 Switches, and WLC 5700 Wireless LAN Controllers A-2
Catalyst 3750-X and Catalyst 3560-X switches A-2
Notes for Catalyst 4500 Series Switches B-1
Supported Hardware and Software B-1
TrustSec SGT and SGACL Configuration Guidelines and Limitations B-1

Contents
vii
Cisco TrustSec Configuration Guide
OL-22192-01
Notes for Catalyst 6500 Series Switches C-1
TrustSec Supported Hardware C-1
Flexible NetFlow Support C-1
Sample Configurations C-2
Configuration Excerpt of an IPV4 Flow Record (5-tuple, direction, SGT, DGT) C-2
Configuration Excerpt of an IPV6 Flow Record (5-tuple, direction, SGT, DGT) C-2
Configuration Excerpt of an IPv4 Flow Monitor C-2
Configuration Excerpt of an IPv6 Flow Monitor C-3
Configuration Excerpt of the Global Flow Monitor (IPv4 and IPv6) C-3
Configuration Excerpt of the Interface Monitor C-3
Flexible NetFlow Show Commands C-3
TrustSec System Error Messages C-4
FIPS Support C-4
TrustSec Considerations when Configuring FIPS C-4
Licensing Requirements for FIPS C-4
Prerequisites for FIPS Configuration C-5
Guidelines and Limitations for FIPS C-5
Default Settings for FIPS C-5
I NDEX

Contents
viii
Cisco TrustSec Configuration Guide
OL-22192-01

ix
Cisco TrustSec Switch Configuration Guide
OL-22192-02
Preface
Revised: October 16, 2013, OL-22192-02
Organization
This guide includes the following chapters and appendixes:
Chapter or Appendix Title Description
Chapter 1, “Cisco TrustSec
Overview”
Describes the elements and processes that create
the Cisco TrustSec network.
Chapter 2, “Configuring the Cisco
TrustSec Solution”
Provides an overview of configuration tasks
required to implement a Cisco TrustSec Network.
Chapter 3, “Configuring Identities,
Connections, and SGTs”
Provides NDAC and TrustSec seed device
configuration procedures.
Chapter 4, “Configuring SGT
Exchange Protocol over TCP (SXP)
and Layer 3 Transport”
Provides SGT over TCP Protocol (SXP)
configuration procedures.
Chapter 5, “Configuring SGACL
Policies”
Provides Security Group ACL configuration
procedures from the switch CLI.
Chapter 6, “Configuring Endpoint
Admission Control”
Provides 802.1X, MAB, and WebAuth
configuration procedures for a TrustSec context.
Chapter 7, “Cisco TrustSec
Command Summary”
Provides a list of Cisco TrustSec CLI commands
with brief descriptions.
Appendix A, “Notes for Catalyst
3000 and 2000 Series Switches and
WLC 5700 Series Wireless LAN
Controllers”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 3000 and 2000 Series
Switches and WLC 5700 Series Wireless LAN
Controllers.
Appendix B, “Notes for Catalyst
4500 Series Switches”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 4500 Series Switches.
Appendix C, “Notes for Catalyst
6500 Series Switches”
Describes constraints, limitations, or
considerations pertaining to TrustSec
implementation of Catalyst 6500 Series Switches.

x
Cisco TrustSec Switch Configuration Guide
OL-22192-02
Preface
Conventions
This document uses the following conventions:
Note Means reader take note.
Tip Means the following information will help you solve a problem.
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Timesaver Means the described action saves time. You can save time by performing the action described in
the paragraph.
Warning Means reader be warned. In this situation, you might perform an action that could result in
bodily injury.
Convention Indication
bold font Commands and keywords and user-entered text appear in bold font.
italic font Document titles, new or emphasized terms, and arguments for which you supply
values are in italic font.
[ ] Elements in square brackets are optional.
{x | y | z } Required alternative keywords are grouped in braces and separated by
vertical bars.
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.
courier font Terminal sessions and information the system displays appear in courier font.
< > Nonprinting characters such as passwords are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.