Cisco TrustSec User manual

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco TrustSec Switch Configuration

Guide

For Cisco Catalyst Switches

Updated: October 2013

Text Part Number: OL-22192-02

CCVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of

Cisco Systems, Inc.; and Access Registrar, Aironet, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo,

Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step,

Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study,

LightStream, Linksys, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way

to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship

between Cisco and any other company. (0711R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display

output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in

illustrative content is unintentional and coincidental.

Cisco TrustSec Switch Configuration Guide

iii

Cisco TrustSec Configuration Guide

OL-22192-01

CONTENTS

Preface ix

Cisco TrustSec Overview 1-1

Information about Cisco TrustSec Architecture 1-1

Authentication 1-3

Cisco TrustSec and Authentication 1-3

Device Identities 1-6

Device Credentials 1-6

User Credentials 1-6

Security Group-Based Access Control 1-7

Security Groups and SGTs 1-7

SGACL Policies 1-7

Ingress Tagging and Egress Enforcement 1-8

Determining the Source Security Group 1-9

Determining the Destination Security Group 1-10

SGACL Enforcement on Routed and Switched Traffic 1-10

Authorization and Policy Acquisition 1-10

Environment Data Download 1-11

RADIUS Relay Functionality 1-12

Link Security 1-12

Using Cisco TrustSec-Incapable Devices and Networks in a Cisco TrustSec Network 1-13

SXP for SGT Propagation Across Legacy Access Networks 1-13

Layer 3 SGT Transport for Spanning Non-TrustSec Regions 1-14

Cisco TrustSec Reflector for Cisco TrustSec-Incapable Switching Modules 1-15

Ingress Reflector 1-16

Egress Reflector 1-16

VRF-Aware SXP 1-17

Layer 2 VRF-Aware SXP and VRF Assignment 1-17

Contents

Cisco TrustSec Configuration Guide

OL-22192-01

Configuring the Cisco TrustSec Solution 2-1

Configuration Overview 2-1

Cisco TrustSec Configuration How-to Documents 2-1

Supported Hardware and Software 2-2

Prerequisites for Cisco TrustSec 2-2

Cisco TrustSec Guidelines and Limitations 2-3

Default Settings 2-3

Additional Documentation 2-3

Release-Specific Documents 2-3

Platform-Specific Documents 2-4

Cisco IOS TrustSec Documentation Set 2-5

Configuring Identities, Connections, and SGTs 3-1

Cisco TrustSec Identity Configuration Feature Histories 3-1

Configuring Credentials and AAA for a Cisco TrustSec Seed Device 3-2

Configuration Examples for Seed Device 3-3

Configuring Credentials and AAA for a Cisco TrustSec Non-Seed Device 3-3

Configuration Examples for Non-Seed Device 3-4

Enabling Cisco TrustSec Authentication and MACsec in 802.1X Mode on an Uplink Port 3-5

Configuration Examples for 802.1X on Uplink Port 3-6

Configuring Cisco TrustSec and MACsec in Manual Mode on an Uplink Port 3-6

Configuration Examples for Manual Mode and MACsec on an Uplink Port 3-8

Regenerating SAP Key on an Interface 3-9

Verifying the Cisco TrustSec Interface Configuration 3-9

Manually Configuring a Device SGT 3-11

Configuration Examples for Manually Configuring a Device SGT 3-11

Manually Configuring IP-Address-to-SGT Mapping 3-12

Subnet to SGT Mapping 3-12

Default Settings 3-12

Configuring Subnet to SGT Mapping 3-12

Verifying Subnet to SGT Mapping Configuration 3-15

Configuration Examples for Subnet to SGT Mapping 3-15

VLAN to SGT Mapping 3-16

Default Settings 3-17

Configuring VLAN to SGT Mapping 3-17

Verifying VLAN to SGT Mapping 3-19

Configuration Example for VLAN to SGT Mapping for a Single Host Over an Access Link 3-19

Contents

Cisco TrustSec Configuration Guide

OL-22192-01

Layer 3 Logical Interface to SGT Mapping (L3IF–SGT Mapping) 3-20

Feature History for L3IF-SGT Mapping 3-21

Default Settings 3-21

Configuring L3IF to SGT Mapping 3-21

Verifying L3IF to SGT Mapping 3-21

Configuration Example for L3IF to SGT Mapping on an Ingress Port 3-22

Binding Source Priorities 3-22

Configuring Additional Authentication Server-Related Parameters 3-23

Automatically Configuring a New or Replacement Password with the Authentication Server 3-24

Configuring SGT Exchange Protocol over TCP (SXP) and Layer 3 Transport 4-1

Cisco TrustSec SGT Exchange Protocol Feature Histories 4-1

Configuring Cisco TrustSec SXP 4-2

Enabling Cisco TrustSec SXP 4-2

Configuring an SXP Peer Connection 4-2

Configuring the Default SXP Password 4-4

Configuring the Default SXP Source IP Address 4-4

Changing the SXP Reconciliation Period 4-5

Changing the SXP Retry Period 4-5

Creating Syslogs to Capture Changes of IP Address to SGT Mapping Learned Through SXP 4-5

Verifying the SXP Connections 4-6

Configuring Layer 3 SGT Transport Between Cisco TrustSec Domains 4-6

Configuring Cisco TrustSec Reflector for Cisco TrustSec-Incapable Switching Modules 4-8

Configuring Cisco TrustSec Caching 4-9

Enabling Cisco TrustSec Caching 4-9

Clearing the Cisco TrustSec Cache 4-10

Configuring SGACL Policies 5-1

Cisco TrustSec SGACL Feature Histories 5-1

SGACL Policy Configuration Process 5-2

Enabling SGACL Policy Enforcement Globally 5-2

Configuration Examples for Enabling SGACL Policy Enforcement Globally 5-2

Enabling SGACL Policy Enforcement Per Interface 5-3

Configuration Examples for Enabling SGACL Policy Enforcement Per Interface 5-3

Enabling SGACL Policy Enforcement on VLANs 5-3

Configuration Examples for Enabling SGACL Policy Enforcement on VLANs 5-3

Contents

Cisco TrustSec Configuration Guide

OL-22192-01

Manually Configuring SGACL Policies 5-4

Manually Configuring and Applying IPv4 SGACL Policies 5-4

Configuration Examples for Manually Configuring SGACL Policies 5-5

Displaying SGACL Policies 5-6

Refreshing the Downloaded SGACL Policies 5-7

Configuring Endpoint Admission Control 6-1

Information About Endpoint Admission Control 6-1

Basic EAC Configuration Sequence 6-2

802.1X Authentication Configuration 6-2

Verifying the 802.1X Configuration 6-2

MAC Authentication Bypass Configuration 6-3

Verifying the MAB Configuration 6-3

Web Authentication Proxy Configuration 6-4

Verifying Web Authentication Proxy Configuration 6-4

Flexible Authentication Sequence and Failover Configuration 6-5

802.1X Host Modes 6-5

Pre-Authentication Open Access 6-5

DHCP Snooping and SGT Assignment 6-6

Verifying the SGT to Endpoint Host Binding 6-6

Cisco TrustSec Endpoint Access Control Feature Histories 6-7

Cisco TrustSec Command Summary 7-1

Notes for Catalyst 3000 and 2000 Series Switches and WLC 5700 Series Wireless LAN

Controllers A-1

Supported Hardware and Software A-1

Configuration Guidelines and Restrictions A-1

Global Cat3K Restrictions A-1

Catalyst 3850 and Catalyst 3650 Switches, and WLC 5700 Wireless LAN Controllers A-2

Catalyst 3750-X and Catalyst 3560-X switches A-2

Notes for Catalyst 4500 Series Switches B-1

Supported Hardware and Software B-1

TrustSec SGT and SGACL Configuration Guidelines and Limitations B-1

Contents

vii

Cisco TrustSec Configuration Guide

OL-22192-01

Notes for Catalyst 6500 Series Switches C-1

TrustSec Supported Hardware C-1

Flexible NetFlow Support C-1

Sample Configurations C-2

Configuration Excerpt of an IPV4 Flow Record (5-tuple, direction, SGT, DGT) C-2

Configuration Excerpt of an IPV6 Flow Record (5-tuple, direction, SGT, DGT) C-2

Configuration Excerpt of an IPv4 Flow Monitor C-2

Configuration Excerpt of an IPv6 Flow Monitor C-3

Configuration Excerpt of the Global Flow Monitor (IPv4 and IPv6) C-3

Configuration Excerpt of the Interface Monitor C-3

Flexible NetFlow Show Commands C-3

TrustSec System Error Messages C-4

FIPS Support C-4

TrustSec Considerations when Configuring FIPS C-4

Licensing Requirements for FIPS C-4

Prerequisites for FIPS Configuration C-5

Guidelines and Limitations for FIPS C-5

Default Settings for FIPS C-5

NDEX

Contents

viii

Cisco TrustSec Configuration Guide

OL-22192-01

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Preface

Revised: October 16, 2013, OL-22192-02

Organization

This guide includes the following chapters and appendixes:

Chapter or Appendix Title Description

Chapter 1, “Cisco TrustSec

Overview”

Describes the elements and processes that create

the Cisco TrustSec network.

Chapter 2, “Configuring the Cisco

TrustSec Solution”

Provides an overview of configuration tasks

required to implement a Cisco TrustSec Network.

Chapter 3, “Configuring Identities,

Connections, and SGTs”

Provides NDAC and TrustSec seed device

configuration procedures.

Chapter 4, “Configuring SGT

Exchange Protocol over TCP (SXP)

and Layer 3 Transport”

Provides SGT over TCP Protocol (SXP)

configuration procedures.

Chapter 5, “Configuring SGACL

Policies”

Provides Security Group ACL configuration

procedures from the switch CLI.

Chapter 6, “Configuring Endpoint

Admission Control”

Provides 802.1X, MAB, and WebAuth

configuration procedures for a TrustSec context.

Chapter 7, “Cisco TrustSec

Command Summary”

Provides a list of Cisco TrustSec CLI commands

with brief descriptions.

Appendix A, “Notes for Catalyst

3000 and 2000 Series Switches and

WLC 5700 Series Wireless LAN

Controllers”

Describes constraints, limitations, or

considerations pertaining to TrustSec

implementation of Catalyst 3000 and 2000 Series

Switches and WLC 5700 Series Wireless LAN

Controllers.

Appendix B, “Notes for Catalyst

4500 Series Switches”

Describes constraints, limitations, or

considerations pertaining to TrustSec

implementation of Catalyst 4500 Series Switches.

Appendix C, “Notes for Catalyst

6500 Series Switches”

Describes constraints, limitations, or

considerations pertaining to TrustSec

implementation of Catalyst 6500 Series Switches.

Cisco TrustSec Switch Configuration Guide

OL-22192-02

Preface

Conventions

This document uses the following conventions:

Note Means reader take note.

Tip Means the following information will help you solve a problem.

Caution Means reader be careful. In this situation, you might perform an action that could result in equipment

damage or loss of data.

Timesaver Means the described action saves time. You can save time by performing the action described in

the paragraph.

Warning

Means reader be warned. In this situation, you might perform an action that could result in

bodily injury.

Convention Indication

bold font Commands and keywords and user-entered text appear in bold font.

italic font Document titles, new or emphasized terms, and arguments for which you supply

values are in italic font.

[ ] Elements in square brackets are optional.

{x | y | z } Required alternative keywords are grouped in braces and separated by

vertical bars.

[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by

vertical bars.

string A nonquoted set of characters. Do not use quotation marks around the string or

the string will include the quotation marks.

courier font Terminal sessions and information the system displays appear in courier font.

< > Nonprinting characters such as passwords are in angle brackets.

[ ] Default responses to system prompts are in square brackets.

!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code

indicates a comment line.

Table of contents

Other Cisco Switch manuals

Cisco

Cisco Nexus 3548 series User manual

Cisco

Cisco Catalyst 3750-X Series User manual

Cisco

Cisco CGS 2520 Manual

Cisco

Cisco AJ732A - MDS 9134 Fabric Switch User manual

Cisco

Cisco Nexus 7000 Series Instruction Manual

Cisco

Cisco Nexus 9316D-GX Manual

Cisco

Cisco MDS 9000 Series User manual

Cisco

Cisco SF500-24P User manual

Cisco

Cisco MDS 9396V Manual

Cisco

Cisco BTS 10200 Operating instructions

Cisco

Cisco 200E Series User manual

Cisco

Cisco CBS 220 Series User manual

Cisco

Cisco ME 6500 Operating and safety instructions

Cisco

Cisco Catalyst 2955 Series User manual

Cisco

Cisco Nexus 9000 Series User manual

Cisco

Cisco Catalyst 3650 User manual

Cisco

Cisco Nexus 9808 Manual

Cisco

Cisco WS-C2948G-GE-TX User manual

Cisco

Cisco Nexus 9200 Series User manual

Cisco

Cisco Catalyst C9200L-24PXG-4X-E Manual

Cisco

Cisco Catalyst 6880-X Manual

Cisco

Cisco Small Business 300 User manual

Cisco

Cisco Catalyst 6807-XL Operating instructions

Cisco

Cisco Catalyst 2960-S Series Manual

Popular Switch manuals by other brands

URC

URC Total Control MFS-8 installation manual

Azbil

Azbil HPQ-D11 user manual

Sony

Sony DFS-900M operating instructions

SICK

SICK i17S operating instructions

F&F

F&F SZR-277 quick start guide

Shure

Shure UAMS/BK user guide

Dräger

Dräger X-zone Switch Off Instructions for use

Asco

Asco Joucomatic 349 Series manual

BT Mini Hub user guide

D-Link

D-Link DES-1226G manual

Johnson Controls

Johnson Controls FS80-C installation instructions

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Configuration guide

MicroNet

MicroNet SP1200A user manual

Ruijie

Ruijie RG-PF2920 Series Hardware installation and reference guide

Altinex

Altinex DA1914SX user guide

MiLAN

MiLAN MIL-SM2401M user guide

RJM

RJM MASTERMIND PBC/6X user manual

Atlas

Atlas MMK-KVM8 owner's manual