Cisco TrustSec Switch Configuration Guide

Cisco TrustSec Configuration How-to Documents

A series of “How-to” configuration documents provides deployment guidelines and best practices for proven network architectures in complex scenarios:

Cisco TrustSec How-to Guide: ISE Profiling Design Guide includes the following topics:

• Introduction
• Cisco ISE Profiling Services
• Profiling Service Requirements
• Profiling Services Global Configuration
• Configuring Probes
• Device Sensor
• Configuring Profiling Policies
• Profiling Design and Best Practices

Supported Hardware and Software

For a list of TrustSec supported hardware and software per TrustSec release, see,
Release Notes for Cisco TrustSec General Availability Releases at the following URL:
http://www.cisco.com/en/US/docs/switches/lan/trustsec/release/notes/rn_cts_crossplat.html

See also, the Release Notes, Configuration Guides, and Command References for your device.

Prerequisites for Cisco TrustSec

The following are the prerequisites for establishing a TrustSec network with Catalyst switches:

• TrustSec software on all network devices
• Connectivity between all network devices
• Network availability of the Cisco Secure ACS 5.1, or Cisco ISE operating with a TrustSec license
• Directory, DHCP, DNS, certificate authority, and NTP servers functioning in the network

Cisco TrustSec Guidelines and Limitations

Cisco TrustSec has the following guidelines and limitations for Catalyst switches:

• AAA for Cisco TrustSec uses RADIUS and is supported only by the Cisco Secure Access Control System (ACS), version 5.1 or later.
• You must enable the 802.1X feature globally for Cisco TrustSec to perform NDAC authentication. If you disable 802.1X globally, you will disable NDAC.
• Cisco TrustSec is supported only on physical interfaces, not on logical interfaces.
• Cisco TrustSec does not support IPv6 in the releases referenced in this guide.
• If the default password is configured on a switch, the connection on that switch should configure the password to use the default password. If the default password is not configured on a switch, the connection on that switch should also not configure a password. The configuration of the password option should be consistent across the deployment network.
• Configure the retry open timer command to a different value on different switches.
• SXP conveys IP-SGT mapping to RBACL enforcing switches in the network. If the access layer switch is in a different NAT domain than the RBACL enforcing switch, then clearly the IP-SGT map it uploads will be meaningless because the IP address included in the map will belong to the wrong NAT domain. The RBACL enforcing switch will never see the source IP address enumerated in the map and therefore IP-SGT database lookup will yield nothing. This means it will not be possible to apply RBACL

Default Settings

Table 2-1 lists the default settings for Cisco TrustSec parameters.

Release-Specific Documents

Platform-Specific Documents

Cisco IOS TrustSec Documentation Set