Cisco SGACL User manual

CHAPTER

5-1

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Configuring SGACL Policies

Revised: August 15, 2013, OL-22192-02

This section includes the following topics:

•Cisco TrustSec SGACL Feature Histories, page 5-1

•SGACL Policy Configuration Process, page 5-2

•Enabling SGACL Policy Enforcement Globally, page 5-2

•Enabling SGACL Policy Enforcement Per Interface, page 5-3

•Enabling SGACL Policy Enforcement on VLANs, page 5-3

•Manually Configuring SGACL Policies, page 5-4

•Displaying SGACL Policies, page 5-6

•Refreshing the Downloaded SGACL Policies, page 5-7

Cisco TrustSec SGACL Feature Histories

For a list of supported TrustSec features per platform and the minimum required IOS release, see

the Cisco TrustSec Platform Support Matrix at the following URL:

http://www.cisco.com/en/US/solutions/ns170/ns896/ns1051/trustsec_matrix.html

Otherwise, see product release notes for detailed feature introduction information.

5-2

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

SGACL Policy Configuration Process

Follow these steps to configure and enable Cisco TrustSec SGACL policies:

Step 1 Configuration of SGACL policies should be done primarily through the Policy Management function of

the Cisco Secure ACS or the Cisco Identity Services Engine (see the Configuration Guide for the Cisco

Secure ACS or the Cisco Identity Services Engine User Guide).

If you are not using AAA on a Cisco Secure ACS or a Cisco ISE to download the SGACL policy

configuration, you can manually configure the SGACL mapping and policies (see the “Manually

Configuring SGACL Policies” section on page 5-4 and the “Manually Configuring SGACL Policies”

section on page 5-4).

Note An SGACL policy downloaded dynamically from the Cisco Secure ACS or a Cisco ISE will

override any conflicting locally-defined policy.

Step 2 To enable SGACL policy enforcement on egress traffic on routed ports, enable SGACL policy

enforcement globally as described in the “Enabling SGACL Policy Enforcement Globally” section on

page 5-2.

Step 3 To enable SGACL policy enforcement on switched traffic within a VLAN, or on traffic that is forwarded

to an SVI associated with a VLAN, enable SGACL policy enforcement for specific VLANs as described

in the “Enabling SGACL Policy Enforcement on VLANs” section on page 5-3.

Enabling SGACL Policy Enforcement Globally

You must enable SGACL policy enforcement globally for Cisco TrustSec-enabled routed interfaces.

To enable SGACL policy enforcement on routed interfaces, perform this task:

Configuration Examples for Enabling SGACL Policy Enforcement Globally

Catalyst 6500, Catalyst 3850:

Switch(config)# cts role-based enforcement

Command Purpose

Step 1 Router# configure terminal Enters global configuration mode.

Step 2 Router(config)# cts role-based

enforcement

Enables Cisco TrustSec SGACL policy enforcement

on routed interfaces.

5-3

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Enabling SGACL Policy Enforcement Per Interface

You must first enable SGACL policy enforcement globally for Cisco TrustSec-enabled routed interfaces.

This feature is not supported on Port Channel interfaces.

To enable SGACL policy enforcement on Layer 3 interfaces, perform this task:

Detailed Steps Catalyst 6500

Configuration Examples for Enabling SGACL Policy Enforcement Per Interface

Catalyst 3850:

Switch# configure terminal

Switch(config)# interface gigabit 1/0/2

Switch(config-if)# cts role-based enforcement

Switch(config-if)# end

Enabling SGACL Policy Enforcement on VLANs

You must enable SGACL policy enforcement on specific VLANs to apply access control to switched

traffic within a VLAN, or to traffic that is forwarded to an SVI associated with a VLAN.

To enable SGACL policy enforcement on a VLAN or a VLAN list, perform this task:

Detailed Steps Catalyst 6500

Configuration Examples for Enabling SGACL Policy Enforcement on VLANs

Catalyst 3850:

Switch# configure terminal

Switch(config)# cts role-based enforcement vlan-list 31-35,41

Switch(config)# exit

Command Purpose

Step 1 Router# configure terminal Enters global configuration mode.

Step 2 Router(config)# interface gigabit 6/2 Specifies interface on which to enable or

disable SGACL enforcement.

Step 3 Router(config-if)# cts role-based enforcement Enables Cisco TrustSec SGACL policy

enforcement on routed interfaces.

Step 4 Router(config-if)# do show cts interface Verifies that SGACL enforcement is enabled.

Command Purpose

Step 1 Router# configure terminal Enters global configuration mode.

Step 2 Router(config)# cts role-based

enforcement vlan-list vlan-list

Enables Cisco TrustSec SGACL policy enforcement

on the VLAN or VLAN list.

5-4

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Manually Configuring SGACL Policies

A role-based access control list bound to a range of SGTs and DGTs forms an SGACL, a TrustSec policy

enforced on egress traffic. Configuration of SGACL policies are best done through the policy

management functions of the Cisco ISE or the Cisco Secure ACS. To manually (that is, locally)

configure SGACL policies, do the following:

1. Configure a role-based ACL.

2. Bind the role-based ACL to a range of SGTs.

Note An SGACL policy downloaded dynamically from the Cisco ISE or Cisco ACS overrides any conflicting

manually configured policy.

Manually Configuring and Applying IPv4 SGACL Policies

Detailed Steps for Catalyst 3850

Command Purpose

Step 1 Router# configure terminal Enters global configuration mode.

Step 2 ip access-list role-based rbacl-name

Example:

Switch(config)# ip access-list

role-based allow_webtraff

Creates a Role-based ACL and enters Role-based ACL

configuration mode.

Step 3 {[sequence-number] | default | permit |

deny | remark}

Example:

Switch(config-rb-acl)#10 permit tcp dst

eq 80 dst eq 20

Specifies the access control entries (ACEs) for the

RBACL.

You can use most of the commands and options

allowed in extended named access list configuration

mode, with the source and destination fields omitted.

Press Enter to complete an ACE and begin the next.

For full explanations of ACL configuration, keywords,

and options, see, Security Configuration Guide:

Access Control Lists, Cisco IOS XE Release 3S.

The following ACE commands or keywords are not

supported:

•reflect

•evaluate

•time-range

Step 4 Switch(config-rb-acl)# exit Exits to global configuration mode.

5-5

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Manually Configuring SGACL Policies

Configuration Examples for Manually Configuring SGACL Policies

Catalyst 3850 IPv4 Manual SGACL policy:

Switch(config)# ip access role allow_webtraff

Switch(config-rb-acl)# 10 permit tcp dst eq 80

Switch(config-rb-acl)# 20 permit tcp dst eq 443

Switch(config-rb-acl)# 30 permit icmp

Switch(config-rb-acl)# 40 deny ip

Switch(config-rb-acl)# exit

Switch(config)# cts role-based permissions from 55 to 66 allow_webtraff

Switch# show ip access allow_webtraff

Role-based IP access list allow_webtraff

10 permit tcp dst eq www

20 permit tcp dst eq 443

30 permit icmp

40 deny ip

Switch# show show cts role-based permissions from 50 to 70

XXX need output XX

Step 5 [no] cts role-based permissions {default

|[from {sgt_num | unknown} to {dgt_num |

unknown}]{rbacls | ipv4 rbacls}

Example:

Switch(config)# cts role-based

permissions from 55 to 66 allow_webtraff

Binds SGTs and DGTs to the RBACL. The

configuration is analogous to populating the

permission matrix configured on the Cisco ISE or the

Cisco Secure ACS.

•Default—Default permissions list

•sgt_num—0 to 65,519. Source Group Tag

•dgt_num—0 to 65,519. Destination Group Tag

•unknown—SGACL applies to packets where the

security group (source or destination) cannot be

determined.

•ipv4—Indicates the following RBACL is IPv4.

•rbacls—Name of RBACLs

Step 6 Switch(config)# end Exits to Privileged Exec mode.

Step 7 Switch# show cts role-based permissions Displays permission to RBACL configurations.

Step 8 Switch# show ip access-lists

allow_webtraff

Displays ACEs of all RBACLs or a specified RBACL.

Command Purpose

5-6

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Displaying SGACL Policies

After configuring the Cisco TrustSec device credentials and AAA, you can verify the Cisco TrustSec

SGACL policies downloaded from the authentication server or configured manually. Cisco TrustSec

downloads the SGACL policies when it learns of a new SGT through authentication and authorization

on an interface, from SXP, or from manual IP address to SGT mapping.

To display the contents of the SGACL policies permissions matrix, perform this task:

Detailed Steps for Catalyst 6500

Using the keywords, you can display all or part of the permissions matrix:

•If the from keyword is omitted, a column from the permissions matrix is displayed.

•If the to keyword is omitted, a row from the permissions matrix is displayed.

•If the from and to keywords are omitted, the entire permissions matrix is displayed.

•If the from and to keywords are specified, a single cell from the permissions matrix is displayed and

the details keyword is available. When details is entered, the ACEs of the SGACL of the single cell

are displayed.

This example shows how to display the content of the SGACL policies permissions matrix for traffic

sourced from security group 3:

Router# show cts role-based permissions from 3

Role-based permissions from group 3 to group 5:

SRB3

SRB5

Role-based permissions from group 3 to group 7:

SRB4

Command Purpose

Step 1 Router# show cts role-based permissions

default [ipv4 | ipv6 | details]

Displays the list of SGACL of the default policy.

Router# show cts role-based permissions

[from {source-sgt | unknown}] [to {dest-sg

| unknown}] [ipv4 | ipv6] [details]

Displays the contents of the permissions matrix,

including SGACLs downloaded from the

authentication server and manually configured on

the switch.

5-7

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Refreshing the Downloaded SGACL Policies

Detailed Steps for Catalyst 6500, Catalyst 3850, Catalyst 3650

Command Purpose

Step 1 cts refresh policy {peer [peer-id]

| sgt [sgt_number|

default|unknown]}

Switch3850# cts refresh policy

peer my_cisco_ise

Performs an immediate refresh of the SGACL policies from

the authentication server.

•If a peer-id is specified, only the policies related to the

specified peer connection are refreshed. To refresh all

peer policies, press Enter without specifying an ID.

•If an SGT number is specified, only the policies related

to that SGT are refreshed. To refresh all security group

tag policies, press Enter without specifying an SGT

number. Select default to refresh the default policy.

Select unknown to refresh unknown policy.

5-8

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Chapter 5 Configuring SGACL Policies

Refreshing the Downloaded SGACL Policies

This manual suits for next models

Table of contents

Other Cisco Software manuals

Cisco

Cisco 4700M Instruction Manual

Cisco

Cisco Network Assistant User manual

Cisco

Cisco SMART BUSINESS COMMUNICATIONS SYSTEM - FEATURE ... Owner's manual

Cisco

Cisco ONS 15327 User manual

Cisco

Cisco 1811W - Integrated Services Router Wireless Instruction Manual

Cisco

Cisco IP Communicator Instruction Manual

Cisco

Cisco III - Supervisor Engine III User manual

Cisco

Cisco CISCOWORKS COMMON SERVICES 3.0 User manual

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE User manual

Cisco

Cisco IPS-4240-K9 - Intrusion Protection Sys 4240 User manual

Cisco

Cisco MCS 7825 Series User manual

Cisco

Cisco Unified Videoconferencing Manager User manual

Cisco

Cisco CiscoWorks 1105 User manual

Cisco

Cisco OL-11757-01 Instruction Manual

Cisco

Cisco AP775A - Nexus Converged Network Switch 5010 Service manual

Cisco

Cisco 6503-E - Catalyst Chassis With Supervisor Engine 32... Instruction Manual

Cisco

Cisco OL-4015-08 User manual

Cisco

Cisco TELEPRESENCE MOVI 4.1 - ADMINISTRATOR GUIDE... Service manual

Cisco

Cisco 5520 - ASA IPS Edition Bundle User manual

Cisco

Cisco 3.3 User manual

Cisco

Cisco OL-10426-01 User manual

Cisco

Cisco WS-SUP32-GE-3B - Supervisor Engine 32 User manual

Cisco

Cisco Surveillance Media Server Instruction Manual

Cisco

Cisco 4700M User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual