Example For Cisco Trustsec; Anyconnect Vpn Support For Cisco Trustsec; Typical Steps For A Remote User Connecting To A Server - Cisco ASA Series Configuration Manual

Example for Cisco TrustSec

Example for Cisco TrustSec
The following example shows how to configure the ASA to use Cisco TrustSec:
// Import an encrypted CTS PAC file
// Configure ISE for environment data download
// Configure SXP peers
//Configure security-group based policies
//Configure security group tagging plus Ethernet tagging
interface gi0/1
cts manual
propagate sgt
policy static sgt 100 trusted
cts role-based sgt-map 10.1.1.100 sgt 50

AnyConnect VPN Support for Cisco TrustSec

ASA Version 9.3(1) fully supports security group tagging of VPN sessions. A Security Group Tag (SGT)
can be assigned to a VPN session using an external AAA server, or by configuration of the local user
database. This tag can then be propagated through the Cisco TrustSec system over Layer 2 Ethernet.
Security group tags are useful on group policies and for local users when the AAA server cannot provide
an SGT.
If there is no SGT in the attributes from the AAA server to assign to a VPN user, then the ASA uses the
SGT in the default group policy. If there is no SGT in the group policy, then tag 0x0 is assigned.

Typical Steps for a Remote User Connecting to a Server

1.
2.
3.
4.
5.
Cisco ASA Series Firewall CLI Configuration Guide
6-26
cts import-pac asa.pac password Cisco
aaa-server cts-server-list protocol radius
aaa-server cts-server-list host 10.1.1.100 cisco123
cts server-group cts-server-list
cts sxp enable
cts sxp connection peer 192.168.1.100 password default mode peer speaker
object-group security objgrp-it-admin
security-group name it-admin-sg-name
security-group tag 1
object-group security objgrp-hr-admin
security-group name hr-admin-sg-name
group-object it-admin
object-group security objgrp-hr-servers
security-group name hr-servers-sg-name
access-list hr-acl permit ip object-group-security objgrp-hr-admin any
object-group-security objgrp-hr-servers
A user connects to the ASA.
The ASA requests AAA information from the ISE, which may include an SGT. The ASA also
assigns an IP address for the user's tunneled traffic.
The ASA uses AAA information to authenticate and creates a tunnel.
The ASA uses the SGT from AAA information and the assigned IP address to add an SGT in the
Layer 2 header.
Packets that include the SGT are passed to the next peer device in the Cisco TrustSec network.
Chapter 6 ASA and Cisco TrustSec