Effects Of Changes To Security Groups On The Ise - Cisco ASA Series Configuration Manual

Chapter 6 ASA and Cisco TrustSec
The following figure shows how a security policy is enforced in Cisco TrustSec.
Figure 6-2
End-Point
(AR)
1.
2.
3.
4.
5.

Effects of Changes to Security Groups on the ISE

The ASA periodically refreshes the security group table by downloading an updated table from the ISE.
Security groups can change on the ISE between downloads. These changes are not reflected on the ASA
until it refreshes the security group table.
Security Policy Enforcement
Authentication
Access
Switch
(PEP)
An endpoint device connects to an access layer device directly or via remote access and
authenticates with Cisco TrustSec.
The access layer device authenticates the endpoint device with the ISE by using authentication
methods such as 802.1X or web authentication. The endpoint device passes role and group
membership information to classify the device into the appropriate security group.
The access layer device uses SXP to propagate the IP-SGT mapping to the upstream devices.
The ASA receives the packet and looks up the SGTs for the source and destination IP addresses
using the IP-SGT mapping passed by SXP.
If the mapping is new, the ASA records it in its local IP-SGT Manager database. The IP-SGT
Manager database, which runs in the control plane, tracks IP-SGT mapping for each IPv4 or IPv6
address. The database records the source from which the mapping was learned. The peer IP address
of the SXP connection is used as the source of the mapping. Multiple sources can exist for each
IP-SGT mapped entry.
If the ASA is configured as a Speaker, the ASA transmits all IP-SGT mapping entries to its SXP
peers.
If a security policy is configured on the ASA with that SGT or security group name, the ASA
enforces the policy. (You can create security policies on the ASA that include SGTs or security
group names. To enforce policies based on security group names, the ASA needs the security group
table to map security group names to SGTs.)
If the ASA cannot find a security group name in the security group table and it is included in a
security policy, the ASA considers the security group name to be unknown and generates a syslog
message. After the ASA refreshes the security group table from the ISE and learns the security group
name, the ASA generates a syslog message indicating that the security group name is known.
ISE (PDP/PAP)
User Tag
SXP SXP
Firewall
Switch
(PEP)
(PEP)
Tag Policy
Cisco ASA Series Firewall CLI Configuration Guide
About Cisco TrustSec
AD (PIP)
Network
Data Flow
Tag Policy
6-5