Cisco TrustSec Integration

Understanding Cisco TrustSec and SD-WAN Integration

This document provides essential information on integrating Cisco TrustSec with Cisco SD-WAN solutions. Cisco TrustSec is a network infrastructure designed to enforce role-based access control, identity-aware networking, and data confidentiality. It utilizes Security Group Tags (SGTs) to represent user and device groups, enabling granular policy enforcement across the network.

The guide focuses on the propagation of these SGTs within a Cisco SD-WAN environment, detailing two primary methods: Inline Tagging and the Security Group Tag Exchange Protocol (SXP).

Core Concepts: SGT Propagation

Inline Tagging

Inline Tagging utilizes a special Ethernet frame to carry SGTs between network hops, allowing for policy enforcement based on SGTs. This method is supported by Cisco IOS XE SD-WAN devices.

Security Group Tag Exchange Protocol (SXP)

SXP is an alternative protocol for propagating SGTs, particularly useful when hardware does not support inline tagging. It enables the dynamic exchange of IP address-to-SGT bindings, often leveraging Cisco Identity Services Engine (ISE) for management.

Benefits of Cisco TrustSec

• Provides secure access based on user and device identity.
• Applies policies network-wide using tags instead of IP addresses.
• Simplifies network access and security operations through software-defined segmentation.
• Enhances scalability and policy consistency.
• Reduces risk and facilitates microsegmentation without network redesign.

Configuration and Supported Platforms

The document outlines configuration procedures using Cisco vManage and the Command Line Interface (CLI). It details the steps for setting up SGT propagation, including dynamic IP-SGT binding via SXP and static configurations.

A range of Cisco devices and WAN Network Interface Modules (NIMs) are supported for SGT propagation, including various Integrated Services Routers and Catalyst platforms. Specific software releases for Cisco IOS XE and Cisco vManage are also noted for compatibility.