Question

A network engineer is deploying Cisco TrustSec across a campus. Several older access switches support 802.1X and downloadable ACLs but do NOT support inline SGT tagging or SXP. The engineer still wants endpoints connecting to these switches to receive a Security Group Tag so egress enforcement can occur on a capable distribution switch. Which approach allows ISE to assign an SGT to these endpoints despite the access-switch limitation?

Accepted Answer

Configure ISE to assign the SGT in the authorization result and use SXP to propagate the IP-to-SGT binding from ISE (or an SXP-capable device) to the enforcement switch

Answer

Enable inline tagging (CMD) on the access switch trunk uplinks so frames carry the SGT

Answer

Configure a static IP-to-SGT mapping for each endpoint MAC address in the access switch running-config

Answer

Downgrade the access switches to MAB-only so ISE can push the SGT via a downloadable ACL