Question

A security engineer is rolling out Cisco TrustSec in a data center. SGTs are already being assigned to endpoints, and the SGACL egress policy matrix has been fully defined in ISE. Before committing to hard enforcement, the team wants switches to log which traffic flows WOULD be permitted or denied by the SGACLs without actually dropping any packets, so they can validate the matrix against real traffic. Which action accomplishes this goal?

Accepted Answer

Enable Monitor Mode for the TrustSec matrix in the ISE work center so enforcement is logged but not applied

Answer

Configure the default egress cell to 'Permit IP' and remove all custom SGACLs from the matrix

Answer

Set the switch interfaces to 802.1X monitor (open) mode so authentication failures are logged only

Answer

Disable inline SGT propagation and rely on SXP so the switches only report tags to ISE