I85PREP
⌘ K
Cisco 300-715 SISE study materials
Cisco 300-715 SISE study resources

TrustSec SXP Gap and TACACS+ Command Authorization

Cisco 300-715 SISE · Put your knowledge to work in context.

All case studies

TrustSec SXP Gap and TACACS+ Command Authorization

Contoso Retail has Catalyst 9300 access switches, an ASA 5525-X, and Cisco ISE 3.1. TrustSec uses inline tagging on the Catalyst switches; the ASA relies on SXP from two switches. SGTs 4 (Employees), 5 (Contractors), and 9 (PCI) are assigned dynamically by ISE. An SGACL on the switch denies Contractor-to-PCI, but a contractor laptop can still reach the PCI server on TCP 443. The ASA shows no SGT mappings for the PCI subnet. Device administration uses TACACS+ to ISE; helpdesk users in the 'NetOps' group must run show commands but not configuration commands. A recent change added a command set that permits 'show run' but helpdesk reports 'Command authorization failed' for 'show run interface'. The contractor VLAN is 120, and the PCI server is 10.20.30.15.

1. The ASA has no SGT mappings for the PCI subnet. How do you troubleshoot SXP, and why is inline tagging not enough?

Read the worked answer

Inline tagging carries the SGT in the Ethernet frame only on TrustSec-capable links. The ASA is not inline-tagged here, so it depends on SXP to learn SGT-to-IP mappings.

Troubleshoot in this order:

  1. On the two Catalyst switches, confirm SXP speaker configuration and the connection to the ASA listener. Check show cts sxp connections.
  2. Confirm the SXP password and speaker/listener roles match on both sides.
  3. Confirm TCP 64999 is allowed between the switches and the ASA.
  4. Confirm the PCI server's IP is actually mapped to SGT 9. If the server is behind a router that does not propagate SGT, the mapping will be missing. Use show cts role-based sgt-map on the switch.
  5. If the PCI subnet is not advertised by SXP, add a static SGT mapping for 10.20.30.15 or enable SXP on the distribution switch that owns that subnet.

Do not assume inline tagging on the access switch reaches the ASA. Without SXP, the ASA sees the PCI traffic as untagged or default SGT, so its SGACL cannot enforce Contractor-to-PCI correctly.

2. The contractor laptop still reaches the PCI server on 443 even though an SGACL denies Contractor-to-PCI. What enforcement points and directions should you verify?

Read the worked answer

SGACL enforcement is directional and platform-dependent. The deny must be attached to the correct source/destination SGT cell and enforced at a point the traffic actually crosses.

Verify:

  • The contractor laptop is actually assigned SGT 5. If ISE authorization failed or the switch used a static SGT, the traffic may be SGT 0 and not match the deny.
  • The SGACL is attached to the Contractor-to-PCI cell, not PCI-to-Contractor. Direction matters.
  • The policy is enforced on the switch port, VLAN, or SVI where the traffic ingresses; some platforms enforce at egress.
  • The return traffic and the ASA policy are not bypassing the switch SGACL.
  • The SGACL order: a deny ip must precede any permit ip that matches.

Use show cts role-based permissions and show cts role-based policy on the switch. If the traffic traverses a non-TrustSec hop before the enforcement point, the SGT may be lost; inline tagging must be enabled on the trunk.

3. Why does 'show run interface' fail for helpdesk when 'show run' is permitted, and how should the TACACS+ command set be written?

Read the worked answer

TACACS+ command authorization matches the command and arguments, not just the first word. show run interface is a different command line from show run, so a command set that permits exactly show run does not match the longer form.

Check:

  • The command set contains a pattern that covers arguments, such as permit show run .* or the platform's equivalent wildcard syntax, rather than only permit show run.
  • Command order: TACACS+ applies the first matching command. A deny before the permit blocks the request.
  • The NetOps group is mapped to the command set in the device administration policy.
  • The NAD uses TACACS+ for authorization, not only authentication.
  • The device sends the full command with arguments; the command set must account for that.

Test with test aaa on the switch and read the ISE TACACS+ live log to see the exact command string. If the device sends show run interface GigabitEthernet1/0/1, the command set must permit that full pattern or a wildcard that matches it.