Cisco TrustSec Configuration Manual page 49

Chapter 3 Configuring Identities, Connections, and SGTs
Restrictions
•
•
•
Detailed Steps for Catalyst 6500
Command
Step 1
config t
Example:
switch# config t
switch(config)#
Step 2
[no] cts sxp mapping network-map bindings
Example:
switch(config)# cts sxp mapping network-map 10000
Step 3
[no] cts role-based sgt-map
ipv4_address/prefix sgt number
Example:
switch(config)# cts role-based sgt-map
10.10.10.10/29 sgt 1234
OL-22192-02
An IPv4 subnetwork with a /31 prefix cannot be expanded.
Subnet host addresses cannot be bound to SGTs when the network-map bindings parameter is less
than the total number of subnet hosts in the specified subnets, or when bindings is 0.
IPv6 expansions and propagation only occurs when SXP speaker and listener are running SXPv3,
or more recent versions.
Manually Configuring IP-Address-to-SGT Mapping
Purpose
Enters global configuration mode.
Configures the Subnet to SGT Mapping host count
constraint. The bindings argument specifies the
maximum number of subnet IP hosts that can be
bound to SGTs and exported to the SXP listener.
• bindings—(0 to 65,535)
default is 0 (no expansions performed)
(IPv4) Specifies a subnet in CIDR notation. Use the
[no] form of the command to unconfigure the Subnet
to SGT mapping. The number of bindings specified
in Step 2 should match or exceed the number of host
addresses in the subnet (excluding network and
broadcast addresses). The sgt number keyword
specifies the Security Group Tag to be bound to
every host address in the specified subnet.
ipv4_address—Specifies the IPv4 network
•
address in dotted decimal notation.
prefix—(0 to 30). Specifies the number of bits in
•
the network address.
sgt number (0–65,535). Specifies the Security
•
Group Tag (SGT) number.
Cisco TrustSec Configuration Guide
3-13