Catalyst 3850 And Catalyst 3650 Switches, And Wlc 5700 Wireless Lan Controllers; Catalyst 3750-X And Catalyst 3560-X Switches - Cisco TrustSec Configuration Manual

Configuration Guidelines and Restrictions
Catalyst 3850 and Catalyst 3650 Switches, and WLC 5700 Wireless LAN
Controllers
•
•
•
•
•

Catalyst 3750-X and Catalyst 3560-X switches

The following guidelines and limitations apply to configuring Cisco TrustSec SGT and SGACL:
•
•
•
•
•
•
Cisco TrustSec Configuration Guide
A-2
Appendix A Notes for Catalyst 3000 and 2000 Series Switches and WLC 5700 Series Wireless LAN Controllers
Cisco Trustsec can be configured only on physical interfaces; not on logical interfaces.
Cisco TrustSec for IPv6 is not supported.
Dynamic binding of IP-SGT is not supported for hosts on Layer 3 physical routed interfaces because
the IP Device Tracking feature for L3 physical interfaces is not currently supported.
Cisco TrustSec can not be configured on a pure bridging domain with IPSG feature enabled, user
has to either enable ip routing, or disable IPSG feature in the bridging domain.
Cisco TrustSec only supports up to 255 security group tag.
You cannot statically map an IP-subnet to an SGT. You can only map IP addresses to an SGT. When
you configure IP address-to-SGT mappings, the IP address prefix must be 32.
If a port is configured in Multi-Auth mode, all hosts connecting on that port must be assigned the
same SGT. When a host tries to authenticate, its assigned SGT must be the same as the SGT assigned
to a previously authenticated host. If a host tries to authenticate and its SGT is different from the
SGT of a previously authenticated host, the VLAN port (VP) to which these hosts belong is
error-disabled.
Cisco TrustSec enforcement is supported only on up to eight VLANs on a VLAN-trunk link. If there
are more than eight VLANs configured on a VLAN-trunk link and Cisco TrustSec enforcement is
enabled on those VLANs, the switch ports on those VLAN-trunk links will be error-disabled.
The switch can assign SGT and apply corresponding SGACL to end-hosts based on SXP listening
only if the end-hosts are Layer2 adjacent to the switch.
Port-to-SGT mapping can be configured only on Cisco TrustSec links (that is, switch-to-switch
links). Port-to-SGT mapping cannot be configured on host-to-switch links.
When port-to-SGT mapping is configured on a port, an SGT is assigned to all ingress traffic on that
port. There is no SGACL enforcement for egress traffic on the port.
OL-22192-02