Configure A Security Group Tag On An Interface - Cisco ASA Series Configuration Manual

Guidelines for Cisco TrustSec

Configure a Security Group Tag on an Interface

To configure a security group tag on an interface, perform the following steps:
Procedure
Step 1 Specify an interface and enter interface configuration mode.
interface id
Example:
ciscoasa(config)# interface gi0/0
Enable Layer 2 SGT Imposition and enter cts manual interface configuration mode.
Step 2
cts manual
Example:
hostname(config-if)# cts manual
Step 3 Enable propagation of a security group tag on an interface. Propagation is enabled by default.
propagate sgt
Example:
hostname(config-if-cts-manual)# propagate sgt
Apply a policy to a manually configured CTS link.
Step 4
policy static sgt sgt_number [trusted]
Example:
hostname(config-if-cts-manual)# policy static sgt 50 trusted
The static keyword specifies an SGT policy to incoming traffic on the link.
The sgt sgt_number keyword-argument pair specifies the SGT number to apply to incoming traffic from
the peer. Valid values are from 2-65519.
The trusted keyword indicates that ingress traffic on the interface with the SGT specified in the
command should not have its SGT overwritten. Untrusted is the default.
Examples
The following example enables an interface for Layer 2 SGT imposition and defines whether or not the
interface is trusted:
ciscoasa(config)# interface gi0/0
ciscoasa(config-if)# cts manual
ciscoasa(config-if-cts-manual)# propagate sgt
ciscoasa(config-if-cts-manual)# policy static sgt 50 trusted
Cisco ASA Series Firewall CLI Configuration Guide
6-24
Chapter 6 ASA and Cisco TrustSec