• Look up the source SGT based on the source identity—With Identity Port Mapping (IPM), you can manually configure the link with the identity of the connected peer. The network device requests policy information, including SGT and trust state, from the authentication server. • Look up the source SGT based on the source IP address—In some cases, you can manually configure the policy to decide the SGT of a packet based on its source IP address. The SGT Exchange Protocol (SXP) can also populate the IP-address-to-SGT mapping table. Determining the Destination Security Group The egress network device in a Cisco TrustSec domain determines the destination group (DGT) for applying the SGACL.
The network device determines the destination security group for the packet using the same methods used for determining the source security group, with the exception of obtaining the group number from a packet tag. The destination security group number is not included in a packet tag. In some cases, ingress devices or other non-egress devices might have destination group information available. In those cases, SGACLs might be applied in these devices rather than egress devices. SGACL Enforcement on Routed and Switched Traffic SGACL enforcement is applied only on IP traffic, but enforcement can be applied to either routed or switched traffic.
For routed traffic, SGACL enforcement is performed by an egress switch, typically a distribution switch or an access switch with a routed port connecting to the destination host. When you enable SGACL enforcement globally, enforcement is automatically enabled on every Layer 3 interface except for SVI interfaces. For switched traffic, SGACL enforcement is performed on traffic flowing within a single switching domain without any routing function. An example would be SGACL enforcement performed by a data center access switch on server-to-server traffic between two directly connected servers. In this example, the server-to-server traffic would typically be switched.
SGACL enforcement can be applied to packets switched within a VLAN or forwarded to an SVI associated with a VLAN, but enforcement must be enabled explicitly for each VLAN. SGACL Logging and ACE Statistics When logging is enabled in SGACL, the device logs the following information: • The source security group tag (SGT) and destination SGT • The SGACL policy name • The packet protocol type • The action performed on the packet The log option applies to individual ACEs and causes packets that match the ACE to be logged. The first packet logged by the log keyword generates a syslog message. Subsequent log messages are generated and reported at five-minute intervals.
If the logging-enabled ACE matches another packet (with characteristics identical to the packet that generated the log message), the number of matched packets is incremented (counters) and then reported. To enable logging, use the log keyword in front of the ACE definition in the SGACL configuration. For example, permit ip log . Cisco TrustSec Overview Determining the Destination Security Group Cisco TrustSec Overview 12