TrustSec - jibingl/CCNA-CCNP GitHub Wiki
Cisco TrustSec builds secure networks by establishing domains of trusted network devices. Each device in the domain is authenticated by its peers, and communication between devices is secured with encryption, message integrity checks, and data-path replay protection.
Key Components
Cisco TrustSec architecture incorporates these three key components:
| Component | Description |
|---|---|
| Authenticated networking infrastructure | Authentication server, seed device (the first device), peer devices, security group number/tag (SGT) |
| Security group-based access control (SGACL) | Access policies based on the roles (as indicated by security group number) of source and destination devices |
| Secure communication | Communication on each link between devices secured with encryption, message integrity checks, and data-path replay protection |
Security Group Tag (SGT)
SGTs are assigned either statically or dynamically:
| Assignment | Description |
|---|---|
| Static Assignment | In environments where we do not require authentication |
| Dynamic Assignment | Download as an authorization option from ISE when using 802.1x, MAB, or WebAuth authentication |
Security Group ACL (SGACL)
- SGACLs provide a stateless access control mechanism, relying on security group tags rather than traditional IP addresses and filters.
- There are three primary ways to provision SGACL policies:
| Provisioning | Description |
|---|---|
| Static Policy | Administrators manually define SGACL policies using the cts role-based permission command. |
| Dynamic Policy | SGACL policies are centrally managed and configured through Cisco ISE policy management functions. |
| Change of Authorization (CoA) | When an SGACL policy is updated on Cisco ISE, the new policy is pushed to the TrustSec device via CoA. |