WLC still supports SXPv2 Speaker mode to propagate IP to SGT bindings to neighboring devices, we don't support SXPv4. AP will support SXPv4 listener and speaker mode.

Any device that participates in the CTS network requires it to be authenticated and trusted. In order to facilitate the authentication process new devices connected to CTS network under goes an enrollment process where in the device obtains the credentials that is specifically needed for CTS device authentication and obtain general CTS environment information.

The WLC device enrollment is initiated by the WLC as part of PAC provisioning with ISE server. The WLC will initiate EAP-FAST and obtains a PAC. This is accomplished by using the infrastructure of LOCAL-EAP EAP-FAST PAC-provisioning. The PAC obtained uniquely maps to the Device ID. If the Device ID changes, PAC data associated with the previous Device ID is removed from the PAC store. PAC provisioning is triggered when a radius server instance is enabled to provision the PAC.

In case of High Availability (HA) setup, PACs will be synced to the standby box.

CTS Environment data is a set of information or attributes that helps the device to perform CTS related functions.

The device (AirOS WLC) acquires the environment data from the authentication server when the device first joins a Cisco Trust Sec domain by sending a secure radius access-request. The authentication server returns RADIUS Access-Accept with attributes including environment expiry timeout attributes. This is the time interval that controls how often the Cisco Trust Sec device must refresh its environment data.

Inline tagging functionality is a transport mechanism by which a wireless controller or an access point understand the source SGT (S-SGT). It covers the following two types:

• Central switching: For centrally switched packets, WLC performs inline tagging for all packets sourced from wireless clients that reside on the WLC by tagging it with Cisco Meta Data (CMD) tag. For packets inbound from the DS, inline tagging also involves WLC will strip the packet of the header and send it to the AP over CAPWAP for the AP to learn the S-SGT tag. SGACL enforcement will happen at the AP.

• Local switching: For transmitting ,locally switched traffic AP performs inline tagging for packets sourced from clients that reside on the AP. When receiving traffic, AP will handle both locally switched and centrally switched packets and use S-SGT tag for packets and apply the SGACL policy.

With wireless TrustSec enabled on WLC the choice of also enabling and configuring SXP to exchange tags with the switches is optional and both modes i.e. SXP speaker mode and inline tagging are supported; however there is no use case to have both SXP and wireless TrustSec on AP to be enabled simultaneously

• Basic Infrastructure setup: Certificates, Active Directory integration and so on.

• Create Security Group Tags to be used in the network.

• Setup Network Device Admission Control (NDAC).

• Define Authentication and Authorization policies for users and devices.

• Configure SGACL and Egress Policies.

The following procedure shows ISE configuration for adding device:

1. Verify WLC is added to ISE for Radius and TrustSec. Go to Administration > Network Resources > Network Devices from ISE main menu.

   
   

   

   
   

   
   

   

   
   

   We have pre-configured the Network Device page with the following inputs:

   • WLC Name

   • IP Address of WLC

   • Enabled Radius Authentication Settings by checking the box

   • Shared secret

   • Enabled Advance TrustSec Settings > Identification by checking the box for use Device ID

   • Under Device Authentication Settings, configured password

     
     
     
     
     

   Any device that participates in the CTS network requires it to be authenticated and trusted. In order to facilitate the authentication process new devices connected to CTS network under goes an enrollment process where in the device obtains the credentials that is specifically needed for CTS device authentication and obtain general CTS environment information

   
   
   
   
   

2. For ISE TrustSec Policy Configuration, go to Work Centers > TrustSec from ISE main menu.

   
   
   
   
   

3. Under Work Centers>TrustSec> Components, Security Groups and the associated SGT are listed.

   

4. To create a SGACL, go to TrustSec > Components > Security Group ACLs. Example on how to configure a SGACL is shown below:

   
   
   
   
   

5. Go to Work Centers>TrustSec>TrustSec Policy and view the created policies. We have configured a policy to deny employee and contractor from communicating with each other. Notice that the employee tag is 4 and contractor tag is 5. These tags will be inherited by clients once they associate to the WLAN.

   
   
   
   
   

   Default Rule can be Permit or Deny

   Following is the SGACL configuration to deny rule:

   
   
   
   
   

6. Also, under Policy > Authorization we have configured Authorization rules for employee and contractor to pass the tags once the clients get authenticated.

   
   
   
   
   

7. For integrating Wireless LAN Controller with ISE, go to Security >RADIUS>Authentication from WLC GUI main menu and verify that ISE server is added.

   
   
   
   
   

8. Click on server index for ISE and verify that PAC Provisioning is 'Enabled' and the PAC parameters are downloaded from ISE.

   
   
   
   
   

   
   

   

   
   

9. Verify the following from Security > TrustSec > General:

   • CTS is Enabled

   • Configure Device ID

   • Password is configured the same as on ISE

   • Current Status shows Complete

   • Security Group Table should be populated

   
   

   

   
   

10. Navigate to SECURITY > TrustSec > Policy and verify the SGT-TAG list to see that the policy is downloaded on the WLC.

    Note

    In order for the SGT-TAG list to populate on the Wireless LAN Controller (WLC), a client must first connect with the target SGT. Once the client is connected, the WLC will pull the SGT-TAG list and install it, similar to the process on the wired side. Ensure that a client connection is established to trigger this synchronisation.

    
    
    
    
    

    Drill down the Policy and you can see the SGACL:

    
    
    
    
    

    You can drill down further to see the ACEs per SGACL:

    
    
    
    
    

11. To configure WLANs on WLC, Select Create New from WLANs and click Go.

    
    
    
    
    

    Set the profile name as POD1-CTS and click Apply.

    
    
    
    
    

    From General Tab, Enable the WLAN.

    
    
    
    
    

12. From Security > AAA Servers, select the AAA server which is configured above and clickApply.

    
    
    
    
    
13. Once you enable ISE default settings, the WLC automatically configures the following settings on the WLAN advance tab:

    • Allow AAA override=Enabled

      
      
      
      
      

14. To test with client traffic without enforcing SGACL on the AP, follow the below steps:

    1. Using your client devices, log in as an employee from one client and as a contractor from a different client.

       
       
       
       
       
       
       
       
       

    2. From the WLC page, check client details under Monitor > Clients for both users and SGT security tag pushed on both.

       
       
       
       
       
       
       
       
       

    3. To test applications per SGACL, use one device to connect as an employee and other device as a contractor, and make sure that both clients can ping each other. Below is an example of ICMP communication from Contractor device to an employee device (IP: 10.10.40.200).

       
       
       
       
       

15. 1. To enable TrustSec enforcement on a local mode AP, navigate to Wireless tab > Select an Access point > Advanced tab and enforce SGACL as shown below.

       
       
       
       
       
       
       

       

       
       

    2. To add SXP or inline config on a Flexconnect AP, go to Wireless > AP > Advanced > Trusted Security > TrustSec Config.

       
       
       
       
       

16. After enforcing "TrustSec" on AP, you should not be able to ping between the two clients (employee and contractor) as shown below.