Cisco ASA Series Cli Configuration Manual page 923

Chapter 1 Configuring the ASA to Integrate with Cisco TrustSec
Examples
The following example shows how to configure SXP peers in the ASA:
hostname(config)# cts sxp enable
hostname(config)# cts sxp connection peer 192.168.1.100 password default mode peer speaker
hostname(config)# cts sxp connection peer 192.168.1.101 password default mode peer
hostname(config)# no cts sxp connection peer 192.168.1.100
hostname(config)# cts sxp connection peer 192.168.1.100 source 192.168.1.1 password default mode peer speaker
hostname(config)# no cts sxp connection peer 192.168.1.100 source 192.168.1.1 password default mode peer
speaker
Refreshing Environment Data
The ASA downloads environment data from the ISE, which includes the Security Group Tag (SGT) name
table. The ASA automatically refreshes its environment data obtained from the ISE when you complete
the following tasks on the ASA:
•
•
•
Normally, you will not need to manually refresh the environment data from the ISE; however, security
groups can change on the ISE. These changes are not reflected on the ASA until you refresh the data in
the ASA security group table. Refresh the data on the ASA to make sure any security group made on the
ISE are reflected on the ASA.
Tip
We recommend that you schedule policy configuration changes on the ISE and the manual data refresh
on the ASA during a maintenance window. Handling policy configuration changes in this way
maximizes the chances of security group names getting resolved and security policies becoming active
immediately on the ASA.
Prerequisites
The ASA must be configured as a recognized Cisco TrustSec network device in the ISE and the ASA
must have successfully imported a PAC file, so that the changes made for Cisco TrustSec are applied to
the ASA.
Restrictions
•
•
To Refresh Environment Data
On the ASA, enter the following command:
hostname(config)# cts refresh environment-data
The ASA refreshes the Cisco TrustSec environment data from the ISE and resets the reconcile timer to
the configured default value.
Configure a AAA server to communicate with the ISE.
Import a PAC file from the ISE.
Identify the AAA server group that the ASA will use for retrieval of Cisco TrustSec environment
data.
When the ASA is part of an HA configuration, you must refresh the environment data on the primary
ASA device.
When the ASA is part of a clustering configuration, you must refresh the environment data on the
master device.
Configuring the ASA for Cisco TrustSec Integration
Cisco ASA Series CLI Configuration Guide
1-19