Cisco TrustSec

What it is

Cisco TrustSec controls traffic by the role of the user or device, instead of by IP address.

Each role is a security group, and each group has a number called a security group tag, or SGT. Policy is then written as a matrix of source group and destination group. A rule says whether traffic from one group to another is allowed.

How it works

TrustSec has three jobs: classification, propagation and enforcement.

Classification

Classification is how traffic gets its tag. There are two kinds.

• Dynamic: ISE returns the SGT in the authorization result when a user or device authenticates.
• Static: You map an IP address, a subnet, a VLAN or a port to an SGT by hand on the device.

Servers are often tagged statically, since they do not authenticate. Users and endpoints are tagged dynamically.

Propagation

The tag has to reach the point where policy is enforced. There are two ways.

SXP, the Security Group Exchange Protocol, has a speaker that sends mappings and a listener that receives them. It runs over TCP, and the default port is 64999. SXP is used on devices or links that do not support inline tagging.

Enforcement

Enforcement usually happens at the point nearest the destination. The device looks up the source SGT and the destination SGT, and applies the rule from the matrix.

The rule is a security group ACL, or SGACL. It is like an ACL, but it has no IP addresses in it. Because it refers to roles, it does not change when addresses change.

A firewall or router can also enforce by SGT. Switches enforce with the SGACL from the matrix.

ISE configuration

Configuration on ISE is done in the TrustSec work center. The main steps are:

1. Create the security groups and give each one a value.
2. Create the SGACLs that hold the permit and deny rules.
3. Add the network devices and set their TrustSec settings, including a device ID and password.
4. Build the egress policy matrix by choosing an SGACL for each source and destination pair.
5. Assign a security group in the authorization profile for the users and devices.

ISE has some built in tags. The tag for unknown traffic has value 0, and there is a tag for the TrustSec devices themselves.

The switches download the tags and policy from ISE. They authenticate to ISE with the device ID and password, and receive a protected access credential, or PAC, which secures later requests. The tag names and device information come down as environment data, and the SGACLs come down as policy.

Switch configuration

This is IOS XE.

Switch(config)# aaa authorization network ISE-CTS group ISE-GRP
Switch(config)# cts authorization list ISE-CTS
Switch(config)# cts role-based enforcement
Switch# cts credentials id SW1 password CTSPASS

The credentials are entered in privileged mode, not in configuration mode. The ID and password must match what you set for the device on ISE.

Static mappings and SXP use these commands:

Switch(config)# cts role-based sgt-map 10.1.1.100 sgt 20
Switch(config)# cts sxp enable
Switch(config)# cts sxp default password SXPPASS
Switch(config)# cts sxp connection peer 10.1.1.2 source 10.1.1.1 password default mode local speaker

The first line tags a server address with SGT 20. The last line sets this switch as a speaker towards a peer.

Verify

Switch# show cts environment-data
Switch# show cts pacs
Switch# show cts role-based sgt-map all
Switch# show cts role-based permissions
Switch# show cts sxp connections

The environment data shows the tags learned from ISE, and the permissions show the SGACLs. The SXP output shows whether each connection is up.