Prerequisites for SGACL and Environment Data Download over REST, on page 1 Restrictions for SGACL and Environment Data Download over REST, on page 1 Information About SGACL and Environment Data Download over REST, on page 2 How to Configure SGACL and Environment Data Download over REST, on page 7 Verifying the SGACL and Environment Data Download over REST, on page 11 Debugging the SGACL and Environment Data over REST Configuration, on page 12 Configuration Examples for SGACL and Environment Data Download over REST, on page 13 Feature History for SGACL and Environment Data Download over REST, on page 13 Prerequisites for SGACL and Environment Data Download over REST • Cisco Identity Services Engine (ISE) Version should be 2.7 and above.

• Cisco TrustSec-enabled devices must use Cisco IOS XE Amsterdam 17.1.1 and later releases. • The network device configuration on Cisco ISE must be updated to include the configuration to allow REST API calls from a network device IP address (NAS-IP). The device ID and password specified in the Cisco ISE configuration is included as the username and password by the network device that makes REST API calls to Cisco ISE. Restrictions for SGACL and Environment Data Download over REST • Cisco TrustSec Change of Authorization (CoA) uses RADIUS as the protocol. • Only port 9063 is supported as the ERS server port. • Server statistics is not persistent after a refresh of the environment data.

SGACL and Environment Data Download over REST 1

Page 1

Cisco TrustSec Environment Data

• Only one Fully Qualified Domain Name (FQDN) per server is supported. • RADIUS Automated Testing feature is not supported in a VRF environment. • For RADIUS, policy download over IPv6 server is not supported. Information About SGACL and Environment Data Download over REST SGACL and Environment Data Download over REST Overview Cisco TrustSec uses the REST-based transport protocol for policy provisioning and environment data download from Cisco Identity Services Engine (ISE). The REST-based protocol is more secure, and provides reliable, and faster Security Group access control list (SGACL) policy and environment data provisioning, than older RADIUS protocols.

Both the REST API-based and RADIUS-based download of Cisco TrustSec data is supported. However, only one protocol can be active on a device. REST-based protocol is the default, however, you can change the protocol to RADIUS by configuring the cts authorization list command. Cisco TrustSec Change of Authorization (CoA) will still use RADIUS as the protocol. Note Cisco TrustSec Security Group Access Control List (SGACL) and environment data are synchronized from the active device to the standby device, after the policy is installed. However, REST API connections or sessions are not synchronized during a switchover. 8 IPv4 and 8 IPv6 addresses are supported per server.

Cisco TrustSec device honors the 429 response code from Cisco ISE. This response code is sent by Cisco ISE, when it is overloaded. Once a 429 response code is received for a particular server, the device marks the server as dead, and switches to the next server in the list (private or public). The next retry attempt is done after 60 seconds. Cisco TrustSec Environment Data Environment data comprises of operational data that supplement Cisco TrustSec functions. The environment data request from a device to Cisco ISE consists of the following data: • Device name: Specifies the name of the device. • Device capability: Specifies additional data.

The environment data response from Cisco ISE to a device consists of the following data: • Device security group tag (SGT): Derived from Cisco ISE based on the device name. • Server list: Displays the list of Cisco TrustSec servers specified in Cisco ISE. • SG-Name Table: Displays the mapping between SGT and the device name. SGT is displayed in numerals and the device name in text format. SGACL and Environment Data Download over REST Information About SGACL and Environment Data Download over REST SGACL and Environment Data Download over REST 2

Page 2

Message Flow Between a Network Device and a Server

• Refresh time: Indicates the time when the environment data will be refreshed. Note • As part of Cisco TrustSec environment data refresh, the last received servers are deleted and newly received servers are added to the server list. As a result of the refresh, the server list statistics restarts from zero, and the server status is set to Inactive and the IP address state is set to Reachable . The device then updates the server statistics and status based on the subsequent policy request and response. • Starting with Cisco IOS XE Bengaluru 17.4.1, you can configure automated tester to be VRF aware.

You can use the vrf keyword with the automate-tester command to enable automate-tester for a non-default VRF. For VRF aware automate-tester to work, you have to configure global config ipv4/ipv6 source interface interface-name vrf vrf-name command. Message Flow Between a Network Device and a Server The following illustration displays the connection management for REST calls between a network device and server. SGACL and Environment Data Download over REST Message Flow Between a Network Device and a Server SGACL and Environment Data Download over REST 3

Page 3

Message Flow Between a Network Device and a Server

Figure 1: Message Flow Between a Network Device and a Server • Cisco ISE REST API service runs on a secure socket that runs Transport Layer Security (TLS) 1.2 server on port 9063 to service network device requests for SGACL and environment data. • The device uses a make or break approach to the TLS connection establishment, and there is no persistent TLS connection between the device and Cisco ISE. After the TLS connection is established, the device can use this connection to submit multiple REST API calls to specific resource uniform resource locators (URLs). After all REST requests are processed, the server terminates the connection through a TCP-FIN message.

For new REST API calls a new connection must be established with the server. • The REST API call from the device to Cisco ISE starts with a TCP connection establishment. Cisco ISE must be configured with device IP address to allow ingress connections from the device. TCP connection requests from source IP addresses that are not configured on Cisco ISE are dropped, and an audit log created. • Username and password: Every RESTAPI call must include the username and password authentication while requesting access to a resource uniform resource identifier (URI). The authentication helps the server to determine if the caller should be given access to the resource or to deny the request.

• A successful TLS connection establishment with Cisco ISE requires its server-certificate signature or PEM to be installed as the trustpoint (by using the crypto pki trustpoint command) on the device to SGACL and Environment Data Download over REST Message Flow Between a Network Device and a Server SGACL and Environment Data Download over REST 4

Page 4

Related manuals

Contents

Document text

Restrictions for SGACL and Environment Data Download over REST

Cisco TrustSec Environment Data

Message Flow Between a Network Device and a Server

Message Flow Between a Network Device and a Server