Figure 5: NDAC and SAP Negotiation Environment Data Download The Cisco TrustSec environment data is a collection of information or policies that assists a device to function as a Cisco TrustSec node. The device acquires the environment data from the authentication server when the device first joins a Cisco TrustSec domain, although you might also manually configure some of the data on a device. For example, you must configure the seed Cisco TrustSec device with the authentication server information, which can later be augmented by the server list that the device acquires from the authentication server. The device must refresh the Cisco TrustSec environment data before it expires.
The device can also cache the environment data and reuse it after a reboot if the data has not expired. The device uses RADIUS to acquire the following environment data from the authentication server: • Server lists: List of servers that the client can use for future RADIUS requests (for both authentication and authorization). PAC refresh happens through these servers. • Device SG: Security group to which the device itself belongs. • Expiry timeout: Interval that controls how often the Cisco TrustSec device should refresh its environment data.
RADIUS Relay Functionality The device that plays the role of the Cisco TrustSec authenticator in the 802.1X authentication process has IP connectivity to the authentication server, allowing the device to acquire the policy and authorization from the authentication server by exchanging RADIUS messages over UDP/IP. The supplicant device may not have IP connectivity with the authentication server. In such cases, Cisco TrustSec allows the authenticator to act as a RADIUS relay for the supplicant. Cisco TrustSec Overview Environment Data Download Cisco TrustSec Overview 15