Configure The Aaa Server For Cisco Trustsec Integration - Cisco ASA Series Configuration Manual

Chapter 6 ASA and Cisco TrustSec
•
•
•
•
•
•

Configure the AAA Server for Cisco TrustSec Integration

This section describes how to integrate the AAA server for Cisco TrustSec.
devices.) SXP connection loops can cause unexpected behavior of SXP message transport. In cases
where the ASA is configured to be a Speaker and Listener, an SXP connection loop can occur,
causing SXP data to be received by the peer that originally transmitted it.
When changing the ASA local IP address, you must ensure that all SXP peers have updated their
peer list. In addition, if SXP peers changes its IP addresses, you must ensure those changes are
reflected on the ASA.
Automatic PAC file provisioning is not supported. The ASA administrator must request the PAC file
from the ISE administrative interface and import it into the ASA.
PAC files have expiration dates. You must import the updated PAC file before the current PAC file
expires; otherwise, the ASA cannot retrieve environment data updates.
When a security group changes on the ISE (for example, it is renamed or deleted), the ASA does not
change the status of any ASA security policies that contain an SGT or security group name
associated with the changed security group; however, the ASA generates a syslog message to
indicate that those security policies changed.
The multi-cast types are not supported in ISE 1.0.
An SXP connection stays in the initializing state among two SXP peers interconnected by the ASA;
as shown in the following example:
(SXP peer A) - - - - (ASA) - - - (SXP peer B)
Therefore, when configuring the ASA to integrate with Cisco TrustSec, you must enable the
no-NAT, no-SEQ-RAND, and MD5-AUTHENTICATION TCP options on the ASA to configure
SXP connections. Create a TCP state bypass policy for traffic destined to SXP port TCP 64999
among the SXP peers. Then apply the policy on the appropriate interfaces.
For example, the following set of commands shows how to configure the ASA for a TCP state bypass
policy:
access-list SXP-MD5-ACL extended permit tcp host peerA host peerB eq 64999
access-list SXP-MD5-ACL extended permit tcp host peerB host peerA eq 64999
tcp-map SXP-MD5-OPTION-ALLOW
tcp-options range 19 19 allow
class-map SXP-MD5-CLASSMAP
match access-list SXP-MD5-ACL
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class SXP-MD5-CLASSMAP
set connection random-sequence-number disable
set connection advanced-options SXP-MD5-OPTION-ALLOW
set connection advanced-options tcp-state-bypass
service-policy global_policy global
Cisco ASA Series Firewall CLI Configuration Guide
Guidelines for Cisco TrustSec
6-13