Question

A network engineer is deploying Cisco TrustSec across the campus. Corporate laptops authenticate via 802.1X and must receive a Security Group Tag (SGT) of 'Employees' (SGT 10) that follows them regardless of which switch or VLAN they connect to. The engineer wants ISE to assign the SGT dynamically as part of the successful authentication result. Where in ISE should the engineer configure the SGT assignment so it is applied to authenticated employee sessions?

Accepted Answer

In the authorization profile referenced by the matching authorization policy rule

Answer

In the authentication policy rule that selects the identity store

Answer

In the SGACL egress policy matrix under TrustSec components

Answer

In the Network Device Group definition for the campus switches