The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Cisco TrustSec Interface-to-SGT Mapping feature binds all traffic on a Layer 3 ingress interface to a security group tag (SGT). Once this mapping is implemented, Cisco TrustSec can use the SGT to segregate traffic from various logical Layer 3 ingress interfaces.
Information About Cisco TrustSec Interface-to-SGT Mapping
Layer 3 (routed) Ethernet interfaces
Layer 3 (routed) Ethernet 802.1Q subinterfaces
Tunnel interfaces
The configured SGT tag is assigned to all traffic on the Layer 3 ingress interface and can be used for inline tagging and policy enforcement.
CLI—Bindings configured using the cts role-based sgt-map sgt command.
L3IF—Bindings added due to FIB forwarding entries that have paths through one or more interfaces with consistent Layer 3 Interface to SGT (L3IF-SGT) mapping or identity port mapping on routed ports.
SXP—Bindings learned from SGT Exchange Protocol (SXP) peers.
INTERNAL—Bindings between locally configured IP addresses and the devices own SGT.
How to Configure Cisco TrustSec Interface-to-SGT Mapping
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
interface type slot/port Example: |
Configures an interface and enters interface configuration mode. |
|
Step 4 |
cts role-based sgt-map sgt sgt-number Example: |
|
|
Step 5 |
end Example: |
Exits interface configuration mode and returns to privileged EXEC mode. |
|
Step 1 |
enable Enables privileged EXEC mode.
Example: |
|
Step 2 |
show cts role-based sgt-map all Displays the security group tag (SGT) mapping for the ingress traffic on the Layer 3 interface. Example: |
Configuration Examples for Cisco TrustSec Interface-to-SGT Mapping
The following example shows the security group tag (SGT) mapping configuration for the Layer 3 ingress interface:
Device> enable
Device# configure terminal
Device(config)# interface gigabitEthernet 0/0
Device(config-if)# cts role-based sgt-map sgt 77
Device(config-if)# end
|
Related Topic |
Document Title |
|---|---|
|
Security commands |
|
|
Cisco TrustSec and SXP configuration |
|
Description |
Link |
|---|---|
|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
Cisco TrustSec Interface-to-SGT Mapping |
The Cisco TrustSec Interface-to-SGT Mapping feature binds all traffic on a Layer 3 ingress interface to a security group tag (SGT). Once this mapping is implemented, Cisco TrustSec can use the SGT to segregate traffic from various logical Layer 3 ingress interfaces. The following command was introduced or modified: cts role-based sgt-map sgt . |
Feedback