One of the really cool features about TrustSec,
among others, is that it's embedded that security group
tag inside the frame.
And if you have Cisco gear, it's wonderful,
because Cisco gear can carry that frame and forward it.
However, in many environments we're
not going to have a 100% Cisco environment of all switches
and devices in the path.
And in that case, if you have a device that's non-Cisco between
point A and Z, it may not be able to--
in fact, it won't be able to propagate correctly
that tag in the CMD field, because it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that tag in the CMD field, because it
won't understand what it is.
So to solve that problem, we have a method
of advertising the tags.
That way you can have a packet that
was brought in the network over here, being
routed and forwarded over non-Cisco devices.
But at the very end where it's going
to be sent or egress out and forwarded
to the final destination, we can actually
ship over with a protocol over the network,
like a control protocol, to tell that network access
device at the end, hey, oh by the way,
here are the tags involved for these devices.
So that end device, that network access device like a switch, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that end device, that network access device like a switch,
can still enforce policy, even though we weren't
able to carry all that security group tag information in each
of the frames for the entire duration.
Now that is done with a protocol called SXP, which
is the focus of this video.
So here's a visual representation of the problem,
and then we'll walk through the solution
with SXP, which is the SGT Exchange Protocol.
Think of it like a routing protocol or the security group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Think of it like a routing protocol or the security group
tag information over a network.
So if switch A, right here, is participating in TrustSec,
and so is switch Z, but we have one or more devices
in the path here that know nothing
about it, that can't handle it.
What we could do is have the ISE server, as well as
other devices, act as an SXP.
That's an SGT exchange protocol speaker.
Now think of a speaker as somebody
who is willing to share the mapping information regarding
devices, and IP addresses, and their associated group tag WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
devices, and IP addresses, and their associated group tag
information.
The one option would be have the ISE be a speaker,
and have it go ahead and have switch A be a listener,
and have switch B be a listener.
And that way they could get all the group tag information.
This would be above and beyond the relationship they already
have with the ISE server.
This would be the ability to additionally learn information
about the security group tags.
That way if a packet is coming in here from device Z, which
is in a different security group,
if that tag isn't here it can still get the mapping, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if that tag isn't here it can still get the mapping,
because it's using SXP and learning
that information from ISE.
So that way we're alleviating the problem
of this intermediate network having
to support the CMD field.
So there's components we need to implement at the switch.
There's also components we need to implement
at the server, regarding SXP.
Let me show you both of those right now.
So here is the syntax in configuration mode.
We'd say cts for Cisco TrustSec, sxp as the SGT exchange
protocol, enable.
We'd specify a password, and then we'd WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'd specify a password, and then we'd
tell it who to go ahead and buddy up with.
Think of this like two BGP speakers
that can communicate over a network
to share routing information.
However, in this case, we're learning security group tag
information.
So this cts sxp connection peer is pointing
to the IP address of a speaker.
In this case, I'm just pointing to the ISE server.
We specify a password default, which
is referring to this default password right here.
And then we specify what the peer is going to be.
And that's it.
So this configuration is already present on the switch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this configuration is already present on the switch.
In fact, just to confirm that, let me copy that.
Right-click, copy, and let's go to the switch and apply it.
And that's actually what those messages were right there,
our SXP messages regarding the updates and so forth.
So we'll go ahead and do a config t,
and we'll paste that in.
And it didn't like config t from config t.
But there you go.
There's the config.
We did just show cts, and we did a security-groups,
and show cts role-based sgt-map for all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and show cts role-based sgt-map for all.
We'll do the show authentication, sessions.
And then we could go even further,
if we wanted to take this one, for example, take
its MAC address.
Hit the up arrow key, type in mac.
And then put in the MAC address, paste that in, and then
the word details.
That's going to show us all the details
for that specific session, which is authenticated, including
the STG tag, the vLAN assignment,
and also up here it says it's luis.
There's the IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's the IP address.
There's his MAC address.
And there's the port he's coming in on.
And all of this information, by the way,
would also be in the log as well.
So regarding SXP, we'd have to do this work on the client.
But we'd also want to make sure we enable this feature
on the ISE server itself.
Let's do that now.
So back on ISE, we'd go to work centers, and in TrustSec.
There's an option right here for SXP right there.
So we'll click on SXP.
And what I did was I added switch 2 as an SXP listener.
So if we just edit this switch and go the details, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we just edit this switch and go the details,
it will show us the details.
So I just put in switch 2, its IP address,
said that it was a listener.
And then I also specified, when I configured it,
I specified a password.
And if we want to look at all the mappings
that are currently in place that it
would be advertising via SXP, we can go to all SXP mappings.
And here are the mappings.
It knows about these three devices,
because they're the only three that are connected,
and there's their groups, there's their actual security
group tag numbers.
So this is information that would be advertised via SXP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is information that would be advertised via SXP,
so that devices could still learn about associated IP
addresses and the security group tags,
even if those frames came into that switch
and didn't have that tag on it natively,
because they are connected to a non-Cisco network.
And there's one other option I'd like just
to talk about for a moment, and then Knox Hutchinson
is going to talk more about it when dealing with DNA Center,
regarding these mappings.
And that is if we go to Administration,
and under Administration under System,
and then under Deployment within System, let's go there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then under Deployment within System, let's go there.
And then select our server, ISE 2.
If our device was not a primary ISE node,
we could make it a primary, by clicking on primary here.
It currently is.
And if we scroll down a little bit, here under Policy Service,
see where says enable SXP service?
We need that running if we want this to work.
If we want to enable sharing of information using pxGrid,
again Knox will talk more about that, we'd check that checkbox
and then click on Save.
So for SXP, we'd definitely want to have that checkbox.
And if you need pxGrid services to share that information, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you need pxGrid services to share that information,
you'd click this on as well, and click on Save.
So in this video, we've answered the question, well,
what if I don't have Cisco devices everywhere
that can support those tag fields in the frames.
And the answer is, we can still advertise that mapping
information over to the devices at the edges of our network
that need it using the SGT Exchange Protocol.
Well thanks for joining me in this video on SXP,
and I'll see you in the next one.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.