Cisco TrustSec and Network Device Administration
Cisco TrustSec and Network Device Administration
This domain tests two policy-control areas: TrustSec segmentation with SGT/SGACL/SXP, and TACACS+ device administration with shell profiles and command sets. The exam expects you to know where policy is defined in ISE and where it is enforced on the network device.
Core rules
- An SGT is a tag assigned to traffic; ISE can return an SGT in an authorization profile. SGACLs define permitted or denied traffic between source and destination SGTs.
- TrustSec enforcement uses inline tagging where supported, or SXP to propagate SGT-to-IP bindings to devices that cannot tag. Environment data (SGTs and SGACLs) is downloaded from ISE to enforcement devices.
- SGACL evaluation uses the source and destination SGT at the enforcement point; the rule direction and order matter.
- TACACS+ device administration uses a network device with a shared secret, a device administration policy set, a shell profile for privilege/auto-command, and command sets for command authorization.
- Command sets can permit or deny commands and arguments; unmatched commands need an explicit default. Accounting records commands and sessions.
- RADIUS and TACACS+ are separate: device admin uses TACACS+ when command-level control is required.
Worked example
A switch must allow netadmins full privilege and helpdesk read-only. The network device is configured with the TACACS+ shared secret and points to ISE. A device administration policy set matches the switch and TACACS+. Authentication uses AD. Authorization rule 1 matches AD group NetAdmin and returns shell profile Priv-15. Rule 2 matches AD group Helpdesk and returns Priv-1 plus command set ShowOnly. ShowOnly permits show commands and denies configure; unmatched commands are denied. When a helpdesk user types configure terminal, ISE denies the command and the switch does not enter config mode. If the shared secret differs, authentication fails before any command set is evaluated; if the command set permits show but the shell profile lacks privilege, the user may log in but cannot run the permitted commands. The reasoning is that authentication, shell authorization, and command authorization are separate checks.
Traps
- Mixing TACACS+ and RADIUS for command authorization.
- Shared secret mismatch or wrong device IP in the network device object.
- Command set order and unmatched default; a permit-all at the top defeats deny rules.
- Confusing shell profile privilege with command set permissions.
- Assigning an SGT statically when the design expects ISE authorization.
- Forgetting SXP or environment data refresh on legacy devices.
- SGACL direction/source-destination reversal.