Cisco TrustSec Overview Cisco TrustSec builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers. Communication on the links between devices in the domain is secured with a combination of encryption, message integrity check, and data-path replay protection mechanisms.
Restrictions for Cisco TrustSec, on page 1 Information About Cisco TrustSec Architecture , on page 2 Device Identities, on page 4 Device Credentials, on page 5 User Credentials, on page 5 Protected Access Credential (PAC), on page 5 PAC Provisioning , on page 6 Deploying Devices in High Availability Setup, on page 6 PAC-less Authentication, on page 7 Configuring Cisco TrustSec Credentials, on page 7 Security Group-Based Access Control, on page 9 Authorization and Policy Acquisition, on page 14 Environment Data Download, on page 15 RADIUS Relay Functionality, on page 15 Link Security, on page 16 SXP for SGT Propagation Across Legacy Access Networks, on page 18 Layer 3 SGT Transport for Spanning Non-TrustSec Regions, on page 19 VRF-Aware SXP, on page 20 Feature History for Cisco TrustSec Overview, on page 20 Restrictions for Cisco TrustSec • Protected access credential (PAC) provisioning fails and remains in hung state, when an invalid device ID is specified.
Even after clearing the PAC, and configuring the correct device ID and password, PAC still fails. As a workaround, in the Cisco Identity Services Engine (ISE), uncheck the Suppress Anomalous Clients option in the Administration> System> Settings> Protocols> Radius menu for PAC to work. • Cisco TrustSec is not supported in FIPS mode when PAC is enabled. • Cisco TrustSec over Radsec is not supported. Cisco TrustSec Overview 1