Question

A network engineer is deploying Cisco TrustSec and wants a Catalyst switch to authenticate to ISE and download its environment data (SGT-to-name mappings and the CTS environment) so it can participate in the TrustSec domain. The switch is configured with 'cts credentials id SW1 password <secret>' and points to ISE as its AAA server. What must be configured on ISE, and what does the switch obtain first, to enable this exchange?

Accepted Answer

Add the switch as a Network Device with the 'Advanced TrustSec Settings' enabled using a matching Device ID and password; the switch first obtains a Protected Access Credential (PAC) via automatic PAC provisioning

Answer

Add the switch as a RADIUS client only; the switch first obtains a downloadable ACL (dACL) that contains the SGT mappings

Answer

Configure an LDAP identity store for the switch account; the switch first obtains an EAP-TLS certificate for inline tagging

Answer

Enable pxGrid on the switch; the switch first obtains the SGACL egress policy matrix before any environment data