Cisco IP-Prefix and SGT-Based SXP Filtering: Руководство по настройке и конфигурации (EN)

Restrictions for IP-Prefix and Security Group Tag (SGT)-Based Security Exchange Protocol (SXP) Filtering

IP-Prefix and SGT-Based SXP Filtering The Security Group Tag (SGT) Exchange Protocol (SXP) is one of the several protocols that supports Cisco TrustSec. SXP is a control protocol for propagating IP-to-SGT binding information across network devices that do not have the capability to tag packets. SXP passes IP-to-SGT bindings from authentication points to upstream devices in a network. This process allows security services on switches, routers, or firewalls to learn user identity information from access devices. The IP-Prefix and SGT-Based SXP Filtering feature allows IP-to-SGT bindings to be filtered, when they are exported or imported.

This filtering can be done based on the IP prefix, SGT, or a combination of both.

Restrictions for IP-Prefix and Security Group Tag (SGT)-Based Security Exchange Protocol (SXP) Filtering, on page 1 Information About IP-Prefix and SGT-Based SXP Filtering, on page 2 How to Configure IP-Prefix and SGT-Based SXP Filtering, on page 2 Configuration Examples for IP-Prefix and SGT-Based SXP Filtering, on page 6 Verifying IP-Prefix and SGT-Based SXP Filtering, on page 7 Syslog Messages for SXP Filtering, on page 9 Feature History for IP-Prefix and SGT-Based SXP Filtering, on page 10 Restrictions for IP-Prefix and Security Group Tag (SGT)-Based Security Exchange Protocol (SXP) Filtering • No high availability support for the stateful synchronization of IP-Security Group Tag (SGT) bindings in an Security Exchange Protocol (SXP) database between active and standby devices.

• Filters applied to an existing connection will take effect only on the subsequent bindings that are exported or imported. The filters do not apply to any bindings that have been exported or imported prior to applying the filters. • Virtual Routing and Forwarding (VRF)-specific filtering is not supported, and a filter specified for a peer IP is applicable across all VRFs on the device. • SGT values in filter rules will be a list of single SGT numbers. SGT ranges are not supported. IP-Prefix and SGT-Based SXP Filtering 1

Стр. 1

How to Configure IP-Prefix and SGT-Based SXP Filtering

Information About IP-Prefix and SGT-Based SXP Filtering Overview The IP-Prefix and SGT-Based SXP Filtering feature allows IP-to-SGT bindings to be filtered, when they are exported or imported. This filtering can be done based on the IP prefix, SGT, or a combination of both. The Security Group Tag (SGT) Exchange Protocol (SXP) is one of the several protocols that supports Cisco TrustSec. SXP is a control protocol for propagating IP-to-SGT binding information across network devices that do not have the capability to tag packets. SXP passes IP-to-SGT bindings from authentication points to upstream devices in a network.

This process allows security services on switches, routers, or firewalls to learn user identity information from access devices. The IP-to-SGT filtering allow systems to selectively import or export only bindings of interest. In an SXP connection, a filter can be configured on a device that acts either as a speaker or a listener, based on the filtering that happens during the export or import of bindings. In the case of bidirectional SXP connections, filters are applied in either of the directions, based on whether a speaker or listener filter is configured. If a peer is a part of both the speaker and the listener filter groups, then filtering is applied in both directions.

Filters can be applied either on a peer-to-peer basis or globally (applicable to all SXP connections). In both cases, the filter can be applied on the speaker or the listener. Filter Rules A filter that needs to be applied on a device is created with a set of filter rules. Each filter rule specifies the action or actions to be taken for bindings with specific SGT values and/or IP-prefix values. Each binding is matched against the values specified in the filter rules; if a match is found, the corresponding action specified in the filter rule is applied. An action that can be applied on a selected binding is either a permit or a deny action.

When a filter is enabled on the speaker or listener during the export or import of IP-SGT bindings, the bindings are filtered based on the filter rules. If a rule is not specified for a binding in a filter list, the catch-all rule that is configured in the filter-list is executed. In the absence of a catch-all rule, the corresponding binding is implicitly denied. Types of SXP Filtering IP-SGT bindings are filtered in one of the following ways: • SGT-based filtering: Filters IP-SGT bindings in an SXP connection based on the SGT value. • IP-prefix based filtering: Filters IP-SGT bindings in an SXP connection based on the IP-prefix value. • SGT and IP-prefix based filtering:

Filter IP-SGT bindings in an SXP connection based on the SGT value and IP-prefix value. A filter rule is applied on each of the IP-SGT binding. How to Configure IP-Prefix and SGT-Based SXP Filtering This section describes how to configure IP-prefix and SGT-cased SXP filtering. IP-Prefix and SGT-Based SXP Filtering Information About IP-Prefix and SGT-Based SXP Filtering IP-Prefix and SGT-Based SXP Filtering 2

Стр. 2

Configuring SXP Filter Group

Configuring SXP Filter List In this step, a filter list is created to hold a set of rules. These rules filter the IP-SGT bindings by allowing bindings that are permitted, and blocking bindings that are denied. Each rule can be based on an SGT, IP prefix, or a combination of both the SGT and IP prefix. If a filter list does not have a rule that matches a specific IP-SGT binding, the binding is implicitly denied unless a default or catch-all ruled is defined. Procedure Configuring SXP Filter Group In this step, a set of peers are combined into a group, and a filter list is applied to the group. A filter-group can either be defined as a speaker group or listener group.

To apply the same filter list to all speakers or all listeners, you can create a global speaker filter group or a global listener filter group. IP-Prefix and SGT-Based SXP Filtering Configuring SXP Filter List Command or Action Purpose Step 1 enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2 configure terminal Enters global configuration mode. Step 3 cts sxp filter-list filter-name Configures a Cisco TrustSec filter list and enters filter-list configuration mode. Step 4 sequence-number permit ipv4 ip-address/prefix deny sgt sgt-value Configures a filter list rule. Step 5 exit Exits filter-list configuration mode and returns to global configuration mode.

Step 6 cts sxp filter-list filter-name Configures a Cisco TrustSec filter list and enters filter list configuration mode. Step 7 [sequence-number] deny sgt sgt-value permit ipv6 ipv6-address/prefix Configures a filter list rule. Step 8 exit Exits filter-list configuration mode and returns to global configuration mode. Step 9 cts sxp filter-list filter-name Configures a Cisco TrustSec filter list and enters filter list configuration mode. Step 10 [sequence-number] permit ipv6 ipv6-address/prefix permit sgt-value permit Configures a filter list rule. Step 11 end Exits filter-list configuration mode and returns to privileged EXEC mode. IP-Prefix and SGT-Based SXP Filtering 3

Стр. 3

Configuring a Global Listener or Speaker Filter Group

Only one filter list can be attached to a filter group. Note Procedure Configuring a Global Listener or Speaker Filter Group When configuring a global listener and global speaker filter group, the filter is applied to across the box for all SXP connections that are in listener or speaker mode. When adding a filter-list to a filter group the currently configured set of filter lists on the box is displayed as a help string. The peer command is not available for the global listener and global speaker filter-group. Note Procedure IP-Prefix and SGT-Based SXP Filtering Configuring a Global Listener or Speaker Filter Group Command or Action Purpose Step 1 enable Enables privileged EXEC mode.

• Enter your password if prompted. Step 2 configure terminal Enters global configuration mode. Step 3 cts sxp filter-group listener listener-name Configures an SXP filter-group listener, and enters filter-group configuration mode. Step 4 filter filter-list-name Configures a filter list rule. Step 5 peer ipv4-address Configures the IP address of a peer. Step 6 exit Exits filter-group configuration mode and returns to global configuration mode. Step 7 cts sxp filter-group speaker speaker-name Configures a voice VLAN on a multiple VLAN access port. Step 8 filter filter-list-name Configures a filter list name. Step 9 peer ipv4-address Configures the IP address of a peer.

Step 10 end Exits filter-group configuration mode and returns to privileged EXEC mode. Command or Action Purpose Step 1 enable Enables privileged EXEC mode. IP-Prefix and SGT-Based SXP Filtering 4

Стр. 4