• Cisco TrustSec cannot be configured on a pure bridging domain with the IPSG enabled. • System generated packets are not sent with Cisco TrustSec tag on the Cisco TrustSec manual link for the egress interface. Restrictions for configuring Cisco TrustSec in PAC-less mode: • PAC-less mode is only supported on ISE 3.4.x and later. • When the device is in PAC-less mode, all servers within the server group must be configured with the PAC-Less configuration (key ). Mixing configurations, such as having one server with a PAC key configuration and another with PAC-less configuration, is not allowed.
• In PAC-less mode, the Cisco TrustSec credential command with the device ID is the only parameterneeded to download environment data. However, SGACL requests do not require any credential information. • Device in PAC-Less mode can be identified by “cts-pac-less” attribute by radius debug. • IPv6 support for PAC-less is not available. • Multi-ISE support is limited to up to 2 ISEs. Information About Cisco TrustSec Architecture The Cisco TrustSec security architecture builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers.
Communication on the links between devices in the domain is secured with a combination of encryption, message integrity check, and data-path replay protection mechanisms. Cisco TrustSec uses the device and user credentials acquired during authentication for classifying the packets by security groups (SGs) as they enter the network. This packet classification is maintained by tagging packets on ingress to the Cisco TrustSec network so that they can be properly identified for the purpose of applying security and other policy criteria along the data path.
The tag, called the security group tag (SGT), allows the network to enforce the access control policy by enabling the endpoint device to act upon the SGT to filter traffic. Note Cisco TrustSec IEEE 802.1X links are not supported on platforms supported in the Cisco IOS XE Denali (16.1.x to 16.3.x), Cisco IOS XE Everest (16.4.x to 16.6.x), and Cisco IOS XE Fuji (16.7.x to 16.9.x) releases, and hence only the Authenticator is supported; the Supplicant is not supported. The Cisco TrustSec architecture incorporates three key components:
• Authenticated networking infrastructure—After the first device (called the seed device) authenticates with the authentication server to begin the Cisco TrustSec domain, each new device added to the domain is authenticated by its peer devices already within the domain. The peers act as intermediaries for the domain’s authentication server. Each newly-authenticated device is categorized by the authentication server and assigned a security group number based on its identity, role, and security posture.
• Security group-based access control—Access policies within the Cisco TrustSec domain are topology-independent, based on the roles (as indicated by security group number) of source and destination devices rather than on network addresses. Individual packets are tagged with the security group number of the source. Cisco TrustSec Overview Information About Cisco TrustSec Architecture Cisco TrustSec Overview 2