Cisco TrustSec: Настройка отображения тегов безопасности (SGT) для подсетей (EN)

Information About SGT Mapping

Configuring Security Group Tag Mapping Subnet to security group tag (SGT) mapping binds an SGT to all host addresses of a specified subnet. Once this mapping is implemented, Cisco TrustSec imposes the SGT on any incoming packet that has a source IP address which belongs to the specified subnet. Restrictions for SGT Mapping, on page 1 Information About SGT Mapping, on page 1 How to Configure SGT Mapping, on page 4 Verifying SGT Mapping, on page 10 Configuration Examples for SGT Mapping, on page 11 Feature History for Security Group Tag Mapping, on page 14 Restrictions for SGT Mapping Restrictions for Subnet-to-SGT Mapping • An IPv4 subnetwork with a /31 prefix cannot be expanded.

• Subnet host addresses cannot be bound to Security Group Tags (SGT)s when the network-map bindings bindings parameter is less than the total number of subnet hosts in the specified subnets, or when bindings is 0. • IPv6 expansions and propagation only occurs when Security Exchange Protocol (SXP) speaker and listener are running SXPv3, or more recent versions. Restriction for Default Route SGT Mapping • Default route configuration is accepted only with the subnet /0 . Entering only the host-ip without the subnet /0 displays the following message:

Device(config)# cts role-based sgt-map 0.0.0.0 sgt 1000 Default route configuration is not supported for host ip Information About SGT Mapping This section provides information about SGT mapping. Configuring Security Group Tag Mapping 1

Стр. 1

Overview of VLAN-to-SGT Mapping

Overview of Subnet-to-SGT Mapping Subnet-to-SGT mapping binds an SGT to all host addresses of a specified subnet. Cisco TrustSec imposes the SGT on an incoming packet when the packet’s source IP address belongs to the specified subnet. The subnet and SGT are specified in the CLI with the cts role-based sgt-map net_address/prefix sgt sgt_number global configuration command. A single host may also be mapped with this command. In IPv4 networks, Security Exchange Protocol (SXP)v3, and more recent versions, can receive and parse subnet net_address/prefix strings from SXPv3 peers.

Earlier SXP versions convert the subnet prefix into its set of host bindings before exporting them to an SXP listener peer. For example, the IPv4 subnet 192.0.2.0/24 is expanded as follows (only 3 bits for host addresses): • Host addresses 198.0.2.1 to 198.0.2.7—tagged and propagated to SXP peer. • Network and broadcast addresses 198.0.2.0 and 198.0.2.8—not tagged and not propagated. To limit the number of subnet bindings SXPv3 can export, use the cts sxp mapping network-map global configuration command. Subnet bindings are static, there is no learning of active hosts. They can be used locally for SGT imposition and SGACL enforcement.

Packets tagged by subnet-to-SGT mapping can be propagated on Layer 2 or Layer 3 Cisco TrustSec links. For IPv6 networks, SXPv3 cannot export subnet bindings to SXPv2 or SXPv1 peers. Overview of VLAN-to-SGT Mapping The VLAN-to-SGT mapping feature binds an SGT to packets from a specified VLAN. This simplifies the migration from legacy to Cisco TrustSec-capable networks as follows: • Supports devices that are not Cisco TrustSec-capable but are VLAN-capable, such as, legacy switches, wireless controllers, access points, VPNs, etc. • Provides backward compatibility for topologies where VLANs and VLAN ACLs segment the network, such as, server segmentation in data centers.

The VLAN-to-SGT binding is configured with the cts role-based sgt-map vlan-list global configuration command. When a VLAN is assigned a gateway that is a switched virtual interface (SVI) on a Cisco TrustSec-capable switch, and IP Device Tracking is enabled on that switch, then Cisco TrustSec can create an IP-to-SGT binding for any active host on that VLAN mapped to the SVI subnet. IP-SGT bindings for the active VLAN hosts are exported to SXP listeners. The bindings for each mapped VLAN are inserted into the IP-to-SGT table associated with the VRF the VLAN is mapped to by either its SVI or by the cts role-based l2-vrf command.

VLAN-to-SGT bindings have the lowest priority of all binding methods and are ignored when bindings from other sources are received, such as from SXP or CLI host configurations. Binding priorities are listing in the Binding Source Priorities section. Configuring Security Group Tag Mapping Overview of Subnet-to-SGT Mapping Configuring Security Group Tag Mapping 2

Стр. 2

Default Route SGT

Interface Level VLAN-to-SGT Mapping The Interface-Level VLAN-SGT Mapping feature allows users to assign SGTs to VLANs on a per-interface basis. This feature supports both voice VLAN and data VLAN to SGT mapping, providing enhanced security and flexibility. The feature is only supported on physical Layer 2 interfaces. It is not supported on routers or wireless controllers. Interface-level VLAN-SGT mapping takes precedence over global VLAN-SGT mapping. If an interface-level mapping is not found, the system will search for a global VLAN-SGT mapping. Only two VLAN-SGT mappings are allowed per interface.

If more than two mappings are configured, the system will issue a warning and reject the additional configuration. Use the cts role-based sgt-map vlanid vlan id sgt sgt-number command to assign an SGT to a data VLAN or voice VLAN. The cts manual command and cts role-based sgt-map vlanid sgt command are mutually exclusive. Only one type of SGT mapping can be configured per interface. Note Binding Source Priorities Cisco TrustSec resolves conflicts among IP-SGT binding sources with a strict priority scheme. For example, an SGT may be applied to an interface with the policy { dynamic identity peer-name | static sgt tag } Cisco Trustsec Manual interface mode command (Identity Port Mapping).

The current priority enforcement order, from lowest (1) to highest (7), is as follows: 1. VLAN: Bindings learned from snooped ARP packets on a VLAN that has VLAN-SGT mapping configured. 2. CLI: Address bindings configured using the IP-SGT form of the cts role-based sgt-map global configuration command. 3. SXP: Bindings learned from SXP peers. 4. IP_ARP: Bindings learned when tagged ARP packets are received on a CTS capable link. 5. LOCAL: Bindings of authenticated hosts which are learned via EPM and device tracking. This type of binding also include individual hosts that are learned via ARP snooping on L2 [I]PM configured ports. 6. INTERNAL:

Bindings between locally configured IP addresses and the device own SGT. If the source IP address matches multiple subnet prefixes with different assigned SGTs, then the longest prefix SGT takes precedence unless priority differs. Note Default Route SGT Default Route Security Group Tag (SGT) assigns an SGT number to default routes. Configuring Security Group Tag Mapping Interface Level VLAN-to-SGT Mapping Configuring Security Group Tag Mapping 3

Стр. 3

Configuring Subnet-to-SGT Mapping

Default Route is that route which does not match a specified route and therefore is the route to the last resort destination. Default routes are used to direct packets addressed to networks not explicitly listed in the routing table. How to Configure SGT Mapping This section describes how to configure SGT mapping. Configuring a Device SGT Manually In normal Cisco TrustSec operation, the authentication server assigns an SGT to the device for packets originating from the device. You can manually configure an SGT to be used if the authentication server is not accessible, but an authentication server-assigned SGT will take precedence over a manually-assigned SGT.

To manually configure an SGT on the device, perform this task: Procedure Configuring Subnet-to-SGT Mapping Procedure Configuring Security Group Tag Mapping How to Configure SGT Mapping Command or Action Purpose Step 1 enable Example: Device# enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 cts sgt tag Example: Device(config)# cts sgt 1234 Enables SXP for Cisco TrustSec. Step 4 exit Example: Device(config)# exit Exits global configuration mode and returns to privileged EXEC mode Command or Action Purpose Step 1 enable Example:

Device# enable Enables privileged EXEC mode. • Enter your password if prompted. Configuring Security Group Tag Mapping 4

Стр. 4