The following image illustrates how SGT is propagated in Cisco Catalyst SD-WAN from one branch to another.

In this illustration, Branch 1 and Branch 2 are equipped with Cisco TrustSec-enabled switches, and these branches are connected to the Cisco IOS XE Catalyst SD-WAN devices. The Cisco TrustSec switch in Branch 1 performs SGT Inline tagging in the Ethernet CMD frame toward Edge Router 1. Edge Router 1 then de-encapsulates the CMD frame, extracts the SGT, and propagates it over Cisco Catalyst SD-WAN IPSec or GRE tunnels. The Edge Router 2 on Cisco Catalyst SD-WAN extracts the SGT from Cisco Catalyst SD-WAN, generates the Ethernet CMD frame, and copies the that is SGT received. The Cisco TrustSec switch on Branch 2 inspects the SGT, and looks it up against the destination SGT to determine if the traffic must be allowed or denied.

The following image is an illustration of SGT being carried through in an Cisco Catalyst SD-WAN packet and an additional eight bytes of data is added to it.

The following table describes how SGT propagation between edge devices in the Cisco Catalyst SD-WAN network varies based on the type of edge device and software release installed on the device.

• Enabling the cts manual command momentarily causes the interface to flap. Therefore, we recommend that you configure Cisco TrustSec manual on the Cisco IOS XE Catalyst SD-WAN device before configuring it on the switch.

• You cannot enable Cisco TrustSec by using the cts manual command on port-channel sub-interfaces.

• If you are configuring subinterfaces on a Cisco IOS XE Catalyst SD-WAN device, Cisco TrustSec must be enabled on the physical interface and on all the subinterfaces.

• Ony devices on Cisco IOS XE Catalyst SD-WAN Release 17.3.1a support propagation of SGT.

• Inline tagging is supported only on the L3 (WAN) ports of the Cisco IOS XE Catalyst SD-WAN devices, and not on switch ports.

• For releases prior to Cisco IOS XE Release 17.3.3, Cisco Catalyst SD-WAN multicast overlay traffic is not supported on interfaces enabled with the Cisco TrustSec feature.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose a Cisco IOS XE Catalyst SD-WAN device from the list.

4. Choose one of the available Cisco VPN Interface templates, for example, Cisco VPN Interface Ethernet .

5. Enter a name and a description for the feature template.

6. To enable SGT propagation, use the following options:

   • For Transport interface (VPN 0):

     1. Click Tunnel.

     2. In the CTS SGT Propagation field, click On to enable SGT propagation for inline tagging. By default, this option is disabled.

   • For service-side interface (VPN x):

     1. Click TrustSec.

     2. From the Enable SGT Propagation drop-down list, choose Global, and then click On. Additional propagation options are displayed.

     3. To propagate SGT in Cisco Catalyst SD-WAN, set Propagate to On.

   The following table displays the SGT propagation options, and the LAN to WAN and WAN to LAN behavior based on the option you choose for SGT propagation. The options are displayed in the following table and available to you only if you set the Enable SGT Propagation to On.

   Table 3. SGT Propagation options

   SGT Propagation Options	LAN to WAN	WAN to LAN	Notes
   Propagate = On Security Group Tag = <SGT Value> Trusted = On	SGT is propagated from LAN to WAN.	SGT is propagated from WAN to LAN.	This is the most common configuration. Usually, the SGT value is 2 defined for Cisco TrustSec devices on Cisco Identity Services Engine (ISE).
   Propagate = On Security Group Tag = <SGT Value> Trusted = Off	SGT is propagated from LAN to WAN with a configured SGT value.	SGT is propagated from WAN to LAN. No effect to the incoming SGT.	Overrides the incoming SGT from LAN to WAN because Trusted is set to Off.
   Propagate = Off Security Group Tag = <SGT Value> Trusted = On	SGT is propagated from LAN to WAN. No effect to the incoming SGT.	SGT is not propagated from WAN to LAN.
   Propagate = Off Security Group Tag = <SGT Value> Trusted = Off	SGT is propagated from LAN to WAN with a configured SGT value.	SGT is not added to the LAN packets. SGT is not propagated to LAN.	Overrides the incoming SGT from LAN to WAN because Trusted is set to Off.
   Propagate = On	SGT propagated from LAN to WAN with SGT value 0.	SGT is propagated from WAN to LAN with SGT value 0.	This can be configured only on a physical interface if there are existing sub interfaces.

   Note

   Enterprise Network Compute System (ENCS) LAN and WAN ports allow propagation of SGT tags on its physical ports. The LAN interfaces must be connected to the LAN side and the WAN interfaces must be connected to the WAN side of the network. You must deploy Cisco Catalyst 8000V router or Integrated Services Virtual router to process the tagging.

7. Click Save.

8. Configure the routing protocols using the Cisco SD-WAN Manager templates. You can choose to use any of the routing protocols. For BGP template, see Configure BGP Using Cisco SD-WAN Manager templates.

9. Attach the feature template to the device template.

The following example shows SGT propagation configured on a Cisco IOS XE Catalyst SD-WAN device . In this example:

• A network connection is established between a switch in the branch and a Cisco IOS XE Catalyst SD-WAN device.

• Two VRF instances, and subinterfaces are configured on the Cisco IOS XE Catalyst SD-WAN device.

• SGT propagation is enabled on the subinterfaces.

• SGT propagation is configured on the network using BGP.

! VRF 1
vrf definition 1
 rd 1:1
 !

! VRF 2
vrf definition 2
 rd 1:2
 !

! Link between switch and router
interface GigabitEthernet0/0/2
 no ip address
 no ip redirects
 negotiation auto
 ip mtu  1504
 mtu 1504
cts manual
!

! sub-interface on VRF 1
interface GigabitEthernet0/0/2.2
 encapsulation dot1Q 2
 vrf forwarding 1
 ip address 77.27.9.2 255.255.255.0
 ip mtu 1500
 cts manual
  policy static sgt 2 trusted
!

! sub-interface on VRF 2
interface GigabitEthernet0/0/2.3
 encapsulation dot1Q 3
 vrf forwarding 2
 ip address 77.27.19.2 255.255.255.0
 ip mtu 1500
 cts manual
  policy static sgt 2 trusted
!

! BGP configuration 
router bgp 64005
 bgp log-neighbor-changes
 distance bgp 20 200 20
 !
 ! BGP neighbor VRF 1
 address-family ipv4 vrf 1
  network 77.27.9.0 mask 255.255.255.0
  redistribute connected
  redistribute static
  redistribute omp
  neighbor 77.27.9.1 remote-as 64006
  neighbor 77.27.9.1 activate
  neighbor 77.27.9.1 send-community both
 exit-address-family
 !
 ! BGP neighbor VRF 2
 address-family ipv4 vrf 2
  redistribute connected
  redistribute static
  redistribute omp
  neighbor 77.27.19.1 remote-as 64006
  neighbor 77.27.19.1 activate
  neighbor 77.27.19.1 send-community both
 exit-address-family
 !

To view Cisco TrustSec SGT Propagation configuration, follow these steps:

1. From the Cisco SD-WAN Manager menu, choose Monitor > Devices.

   Cisco vManage Release 20.6.x and earlier: From the Cisco SD-WAN Manager menu, choose Monitor > Network.

2. Choose a device from the list of devices.

3. Click Real Time in the left pane.

4. From Device Options drop-down list, choose Interface TrustSec to view SGT propagation configuration.

If hardware does not support SGT propagation through inline tagging, you can propagate SGT using SXP.

If a branch is equipped with Cisco TrustSec-enabled hardware, the branch is referred to as a TrustSec branch. You can propagate SGTs to a TrustSec branch through inline tagging. For information about Inline Tagging, see SGT Propagation in Cisco Catalyst SD-WAN.

If a branch is not equipped with Cisco TrustSec-enabled hardware, the branch is referred to as a non-TrustSec branch. You can propagate SGT to a non-TrustSec branch using SXP.

In the case of a non-TrustSec branch, for SD-WAN ingress, a Cisco IOS XE Catalyst SD-WAN device performs SGT tagging based on source IP address of the packet and IP-SGT binding dynamically learned from ISE using SXP or based on static IP-SGT binding configuration. For SD-WAN egress, the Cisco IOS XE Catalyst SD-WAN device performs a destination SGT lookup based on the destination IP address using IP-SGT bindings (received through SXP or static configuration), and the SGT is determined. Policies for the SGT traffic on SD-WAN egress is enforced either by downloading SGACL policies from ISE or by configuring static SGACL policies.

You can configure an SXP connection for downloading the IP-SGT binding from Cisco ISE to a Cisco IOS XE Catalyst SD-WAN device.

To configure an SXP connection in Cisco SD-WAN Manager:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under OTHER TEMPLATES section, choose TrustSec.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 - 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any of the characters and spaces.

7. Enter the details for setting up an SXP connection:

   Parameter Name	Description
   Device SGT	Enter a value to configure the SGT for packets sent from a device. Range: 2 to 65519.
   Credentials ID	Enter a TrustSec ID for the device. This ID must be the same as that in ISE and must not exceed 32 characters.
   Credentials Password	Enter a TrustSec password for the device.
   Enable Enforcement	Click On to enable at a global level. Click Off to disable SGT enforcement. Note   You can enable this configuration either at a global level here, or at an interface level in step 8 of Configuring SGT Enforcement at an interface level in Cisco SD-WAN Manager, but not both.

8. Configure SXP for dynamic IP/SGT.

   Parameter Name	Description
   Enable SXP	Click On to enable an SXP connection on the device. When you enable SXP, you must enter a Node ID and a Node ID type. Note   When you change a Node ID, you must first disable SXP and then push the template to the device. Then, you change the Node ID, and then push the template to the device again.
   Source IP	Enter an IP address to set up a source IP address for SXP.
   Password	Enter a default password for SXP.
   Key Chain Name	Enter a name to configure the key chain for SXP.
   Log Binding Changes	Click On to enable logging for IP-to-SGT binding changes.
   Reconciliation Period (seconds)	Enter a time (in seconds) to configure the SXP reconciliation period. After a peer terminates an SXP connection, an internal hold-down timer starts. If the peer reconnects before the internal hold-down timer expires, the SXP reconciliation period timer starts. While the SXP reconciliation period timer is active, the Cisco TrustSec software retains the SGT mapping entries learned from the previous connection and removes the invalid entries. The default value is 120 seconds (2 minutes). Setting the SXP reconciliation period to 0 seconds disables the timer and causes all the entries from the previous connection to be removed.
   Retry Period (seconds)	Enter a time (in seconds) to configure the retry period for SXP reconnection.
   Speaker Hold Time (seconds)	Enter time (in seconds) to configure the global hold-time period for a speaker device.
   Minimum Listener Hold Time (seconds)	Enter a time (in seconds) to configure the minimum allowed hold-time period for a listener device.
   Maximum Listener Hold Time (seconds)	Enter a time (in seconds) to configure the maximum allowed hold-time period for a listener device.
   Node ID Type	Choose a node ID type.
   Node ID	Enter a node ID. A node ID is used to identify the individual devices within the network.

9. Click New Connection to add a new SXP peer connection details.

   Parameter Name	Description
   Peer IP	Configure a peer IPv4 address for SXP.
   Source IP	Configure a source IPv4 address for SXP.
   Preshared Key	Choose a preshared key type.
   Mode	Choose a connection mode. Local refers to the local device, and Peer refers to a peer device.
   Mode Type	Choose a role for the device.
   Minimum Hold Time	Enter time (in seconds) to configure the minimum hold time for the SXP connection.
   Maximum Hold Time	Enter time (in seconds) to configure the maximum hold time for the SXP connection.
   VPN ID	Enter a VPN or VRF ID for the SXP connection.

   Note

   Maximum Hold Time and Minimum Hold Time can be configured only when you choose Mode as Local and Mode Type as Listener, or when Mode is Peer and Mode Type is Speaker. Only Minimum Hold Time is configurable when Mode is Local and Mode Type is Speaker or when Mode is Peer and Mode Type is Listener. Hold time cannot be configured if you choose Mode Type as Both (that is Listener and Speaker).

10. Click Save to save your configuration for an SXP connection.

To configure static IP-SGT, use the CLI add-on template in Cisco SD-WAN Manager:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under OTHER TEMPLATES section, choose CLI Add-On Template as the feature template.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 - 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any of the characters and spaces.

7. In the CLI Configuration area, enter the following configuration:

   cts role-based sgt-map vrf instance_name {ipv4_netaddress|ipv4_netaddress/prefix} sgt sgt-number
   cts role-based sgt-map vrf instance_name host {ipv4_hostaddress} sgt sgt-number

8. Click Save to save this configuration. This configuration can now be pushed to a Cisco IOS XE Catalyst SD-WAN device for propagation of the SGT over a Cisco Catalyst SD-WAN network.

Cisco TrustSec SXP peers exchange IP-SGT bindings over a TCP connection. TCP Authentication Option (TCP-AO) is used to guard against spoofed TCP segments in Cisco TrustSec SXP sessions between the peers. TCP-AO is resistant to collision attacks and provides algorithmic agility and support for key management.

To enable TCP-AO for an SXP connection, a TCP-AO key chain must be specified for the connection.

To establish an SXP peer connection with TCP-AO:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under BASIC INFORMATION section, choose Cisco Security as the feature template.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any of the characters and spaces.

7. Configure TCP-AO key chain and keys.

   Parameter Name	Description
   Keychain Name	Specify a TCP-AO key chain name. The key chain name can have a maximum of 256 characters.
   Key ID	Specify a key identifier. Range: 0 to 2147483647.
   Send ID	Specify the send identifier for the key. Range: 0 to 255.
   Receiver ID	Specify the receive identifier for the key. Range: 0 to 255.
   Include TCP Options	This field indicates whether TCP options other than TCP-AO must be used to calculate Message Authentication Codes (MACs). A MAC is computed for a TCP segment using a configured MAC algorithm, relevant traffic keys, and the TCP segment data prefixed with a pseudoheader. When options are included, the content of all options is included in the MAC with TCP-AO's MAC field is filled with zeroed. When the options are not included, all options other than TCP-AO are excluded from all MAC calculations.
   Accept AO Mismatch	This field indicates whether the receiver must accept the segments for which the MAC in the incoming TCP-AO does not match the MAC that is generated on the receiver.
   Crypto Algorithm	Specify the algorithm to be used to compute MACs for TCP segments. You can choosese one of these: aes-128-cmac hmac-sha-1 hmac-sha-256
   Key String	Specify the master key for deriving the traffic keys. The master keys must be identical on both the peers. If the master keys do not match, authentication fails and segments may be rejected by the receiver. Range: 0 to 80 characters.
   Send Lifetime Local	Specify the time in seconds that is entered in Cisco SD-WAN Manager for which the key to be used in TCP-AO authentication is valid. Specify the start time in the local time zone. By default, the start time corresponds to UTC time. The end time can be specified in three ways—infinite (no expiry), duration (1 to 2147483646 sec), exact time – (either UTC or local).
   Accept Lifetime Local	Specify the time in seconds that is entered in Cisco SD-WAN Manager for which the key to be accepted for TCP-AO authentication is valid. Specify the start time in the local time zone. By default, the start time corresponds to UTC time. The end time can be specified in three ways—infinite (no expiry), duration (1 to 2147483646 sec), exact time – (either UTC or local).

   Note	When you configure a key chain for an SXP connection, at least one key in the key chain must be configured with the current time. All keys in the key chain cannot be configured completely with a future time.

Device(config)# key chain key1 tcp
Device(onfig-keychain)# key 1000
Device(config-keychain-key)# cryptographic-algorithm hmac-sha-256
Device(config-keychain-key)# key-string 6 _RPB[dVI]SO^BAOVNMKATgOZKMXFGXFTa
Device(config-keychain-key)# accept-lifetime local 18:00:00 Jan 12 2021 06:00:00 Jan 12 2022
Device(config-keychain-key)# send-lifetime local 18:00:00 Jan 12 2021 01:00:00 Jan 12 2022
Device(config-keychain-key)# send-id 215
Device(config-keychain-key)# recv-id 215
Device(config)#

When configured in Cisco ISE, SGACL policies can be downloaded dynamically from Cisco ISE to a Cisco IOS XE Catalyst SD-WAN device using a RADIUS server.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under Basic Information, choose Cisco AAA as the feature template.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any of the characters and spaces.

7. Click Radius to configure a connection to a RADIUS server. The followin fields are displayed:

   Parameter Name	Description
   Address	Enter the IP address of the RADIUS server.
   Authentication Port	Enter the UDP destination port to use for authentication requests to the RADIUS server. If the server is not used for authentication, configure the port number to be 0. Range: 0 to 65535.
   Accounting Port	Enter the UDP port that will be used to send 802.1X and 802.11i accounting information to the RADIUS server. Range: 0 to 65535.
   Timeout	Specify how long to wait to receive a reply from the RADIUS server before retransmitting a request. Range: 1 through 1000.
   Retransmit Count	Specify how many times to search through the list of RADIUS servers while attempting to locate a server. Range: 1 through 1000.
   Key Type	Click PAC as key type.
   Key	Enter the key the Cisco IOS XE Catalyst SD-WAN device passes to the RADIUS server for authentication and encryption. You can enter the key as a text string from—1 to 31 characters long,—and it is immediately encrypted, or you can type an AES 128-bit encrypted key. The key must match the AES encryption key used on the RADIUS server.

8. Click Radius Group to add a new RADIUS group. The following fields are displayed:

   Parameter Name	Description
   Group Name	Displays the RADIUS group name. This field is automatically populated based on the VPN ID that you configure.
   VPN ID	Enter a VPN ID.
   Source Interface	Set the interface that will be used to reach the RADIUS server.
   Radius Server	Choose an IP address for the RADIUS server.

9. Click Radius COA to configure the settings to accept change of authorization (CoA) requests from a RADIUS or other authentication server, and to act on requests to a connection to the RADIUS server.

   Updated policies are downloaded to the Cisco IOS XE Catalyst SD-WAN device when SGACL policies are modified on ISE and a CoA is pushed to the Cisco IOS XE Catalyst SD-WAN device.

   On clicking Radius COA, the following fields are displayed:

   Parameter Name	Description
   Client	Displays the RADIUS client from which a device accepts Change of Authorization (CoA) and disconnect requests.
   Domain Stripping	Configure domain stripping at the server group level. The stripping keyword compares the incoming username with the names oriented to the left of the @ domain delimiter.
   Port	Specify the RADIUS Dynamic Author port. Range: 0 to 65535

10. Click TrustSec to configure more details for authorization. The following details are displayed:

    Parameter Name	Description
    CTS Authorization List	Specify a name of a list for authentication, authorization, and accounting (AAA) servers.
    Radius group	Choose a RADIUS server.

11. Click Save.

To configure static SGACL policies, use the CLI Add-On template in Cisco SD-WAN Manager.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under OTHER TEMPLATES section,, choose CLI Add-On Template as the feature template.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any of any characters and spaces.

7. In the CLI configuration area, enter the following configuration:

   interface gigabitethernet 1/1/3
   cts role-based enforcement
   cts role-based sgt-map sgt 2
   interface gigabitethernet 1/1/4
   no cts role-based enforcement[no] cts role-based permissions {[ default | from | [source-sgt] | to | [dest-sgt]]}
   [no] cts role-based permissions {[ default | from | [source-sgt] | to | [dest-sgt]]}

8. Click Save.

   This configuration can now be pushed to the Cisco IOS XE Catalyst SD-WAN device for enforcement of SGACL policies.

To enforce SGT using SGACL policies at the interface level in Cisco SD-WAN Manager:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. Choose the device for which you are creating the template.

4. Under Basic Information, choose Cisco VPN Interface Ethernet as the feature template.

5. In the Template Name field, enter a name for the feature template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 - 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

6. In the Description field, enter a description for the feature template. This field is mandatory, and it can contain any characters and spaces.

7. Click TrustSec.

8. In the Enable Enforcement field, click On to enable SGT enforcement on a particular interface.

   Note	You can enable this configuration either at an interface level in this step, or a global level using the Enable Enforcement field in Configuring SXP for Dynamic IP/SGT using Cisco SD-WAN Manager, but not both.

9. In the Enter a SGT value field, enter a value that can be used as a tag for enforcement .

10. Click Save.

Use the following command to configure SGT enforcement:

Device(config)# interface <interface-type> <number>
Device(config-if)# cts role-based enforcement