Cisco Security Group ACL Policies Configuration Guide: User Manual PDF (EN)

Restrictions for Configuring Security Group ACL Policies

Configuring Security Group ACL Policies Using security group access control lists (SGACLs), you can control the operations that users can perform based on the security group assignments of users and destination resources. Policy enforcement within the Cisco TrustSec domain is represented by a permissions matrix, with source security group numbers on one axis and destination security group numbers on the other axis. Each cell in the body of the matrix can contain an ordered list of SGACLs, which specifies the permissions that should be applied to packets originating from the source security group and destined for the destination security group.

Restrictions for Configuring Security Group ACL Policies, on page 1 Information About Security Group ACL Policies, on page 2 How to Configure Security Group ACL Policies, on page 2 Configuration Examples for Security Group ACL Policies, on page 14 Feature History for Security Group ACL Policies, on page 16 Restrictions for Configuring Security Group ACL Policies • Due to hardware limitations, Cisco TrustSec SGACLs cannot be enforced for punt (CPU bound) traffic in hardware. SGACL enforcement in software is bypassed wfor CPU-bound traffic for switch virtual interface (SVI) and Layer 2 and Layer 3 Location Identifier Separation Protocol (LISP), and loopback interfaces.

• When configuring SGACL policies, if you change the IP version dynamically from IPv4 or IPv6 to Agnostic (applies to both IPv4 and IPv6) and vice-versa, the corresponding SGACL policies for IPv4 and IPv6 are not downloaded completely through the management VRF interface. • When configuring SGACL policies, if you change the existing IP version to any other version ( IPv4 , IPv6 , or Agnostic ) and vice-versa, Change of Authorization (CoA) from Cisco Identity Services Engine (ISE) cannot be performed using RADIUS. Instead, use SSH and run the cts refresh policy command to perform a manual policy refresh.

• When using an allowed SGT model with default action as deny all , in some cases, Cisco TrustSec policies are only partially downloaded from the ISE server after a device reload. To prevent this, define a static policy on the device. Even if the deny all option is applied, the static policy permits traffic that allows the device to download policies from the ISE server and overwrite the defined static policies. For device SGT, configure the following commands in global configuration mode: cts role-based permissions from to unknown cts role-based permissions from unknown to Configuring Security Group ACL Policies 1

Стр. 1

SGACL Policy Configuration Process

Information About Security Group ACL Policies The following sections provide information about configuring SGACL policies. SGACL Logging A device can provide logging messages about packets that are permitted or denied by a standard IP access list. That is, any packet that matches an SGACL causes an informational logging message about the packet to be sent to the console. The limit of messages logged to the console is controlled by the logging console command that controls the syslog messages. In releases prior to Cisco IOS XE Amsterdam 17.3.1, SGACL logging was done as a CPU-intensive mechanism.

From Cisco IOS XE Amsterdam 17.3.1 release, SGACL logging has been enhanced to use NetFlow hardware, which allows much larger logging rates. SGACL logging in hardware is only supported for Role-Based access control list (RBACL). Note The first packet that triggers the SGACL creates a flow, and logging is done at the NetFlow timeout of 30 seconds and 1 minute for inactive and active flows respectively. Subsequent packets are collected over 5-minute intervals before they are logged.

The logging message includes the access list number, whether the packet was permitted or denied, the source and destination IP addresses of the packet, the interface on which the packet was ingressed, and the number of packets from that source permitted or denied in the previous 5-minute interval. Note • Because SGACL logging in the hardware is done using NetFlow, if a NetFlow-based feature is applied to an interface, logging for that interface falls back to the old mechanism. Logging through NetFlow hardware starts again for that interface after the NetFlow-based feature is removed. The rest of the interfaces continue logging through NetFlow hardware.

• Only 15 NetFlow monitors can be attached to the device at a given time. SGACL logging requires one NetFlow monitor each for IPv4 and IPv6 logging. If NetFlow monitors are not available for logging, SGACL logging is done through the earlier mechanism. Once the required number of NetFlow monitors are available, run the cts role-based permissions command to trigger logging through the NetFlow hardware again. • If a log access control entry (ACE) has fields other than source port number, destination port number and the protocol in use, logging is done through the earlier mechanism.

How to Configure Security Group ACL Policies The following sections provide information about various SGACL policy configurations. SGACL Policy Configuration Process Follow these steps to configure and enable SGACL policies: Configuring Security Group ACL Policies Information About Security Group ACL Policies Configuring Security Group ACL Policies 2

Стр. 2

Enabling SGACL Policy Enforcement Globally

1. Configuration of SGACL policies should be done primarily through the Policy Management function of the Cisco Secure Access Control Server (ACS) or the Cisco Identity Services Engine (ISE). If you are not using AAA on a Cisco Secure ACS or a Cisco ISE to download the SGACL policy configuration, you can manually configure the SGACL mapping and policies. An SGACL policy that is downloaded dynamically from the Cisco Secure ACS or a Cisco ISE will override any conflicting locally-defined policy. Note 2. To enable SGACL policy enforcement on egress traffic on routed ports, enable SGACL policy enforcement globally as described in the Enabling SGACL Policy Enforcement Globally section. 3.

To enable SGACL policy enforcement on switched traffic within a VLAN, or on traffic that is forwarded to an SVI that is associated with a VLAN, enable SGACL policy enforcement for specific VLANs, as described in the Enabling SGACL Policy Enforcement on VLANs section. Enabling SGACL Policy Enforcement Globally You must enable SGACL policy enforcement globally for Cisco TrustSec-enabled routed interfaces. To enable SGACL policy enforcement on routed interfaces, perform this task: Procedure Configuring Security Group ACL Policies Enabling SGACL Policy Enforcement Globally Command or Action Purpose Step 1 enable Example: Device# enable Enables privileged EXEC mode.

Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 cts role-based enforcement Example: Device(config)# cts role-based enforcement Enables Cisco TrustSec SGACL policy enforcement on routed interfaces. Step 4 end Example: Device(config)# end Exits global configuration mode and returns to privileged EXEC mode. Configuring Security Group ACL Policies 3

Стр. 3

Enabling SGACL Policy Enforcement on VLANs

Enabling SGACL Policy Enforcement Per Interface You must first enable SGACL policy enforcement globally for Cisco TrustSec-enabled routed interfaces. This feature is not supported on port channel interfaces. To enable SGACL policy enforcement on Layer 3 interfaces, perform this task: Procedure Enabling SGACL Policy Enforcement on VLANs You must enable SGACL policy enforcement on specific VLANs to apply access control to switched traffic within a VLAN, or to traffic that is forwarded to an SVI associated with a VLAN. To enable SGACL policy enforcement on a VLAN or a VLAN list, perform this task:

Configuring Security Group ACL Policies Enabling SGACL Policy Enforcement Per Interface Command or Action Purpose Step 1 enable Example: Device# enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 interface type slot/port Example: Device(config)# interface gigabitethernet 6/2 Configures an interface and enters interface configuration mode. Step 4 cts role-based enforcement Example: Device(config-if)# cts role-based enforcement Enables Cisco TrustSec SGACL policy enforcement on routed interfaces. Step 5 end Example:

Device(config-if)# end Exits interface configuration mode and returns to privileged EXEC mode. Step 6 show platform software fed [switch] [active | standby] sgacl port Example: Device# show platform software fed switch active sgacl port | i Port|6/2 (Optional) Displays the status of Cisco TrustSec SGACL policy enforcement on the interface. Configuring Security Group ACL Policies 4

Стр. 4