Question

A network engineer must classify traffic from a group of critical database servers in the data center for Cisco TrustSec enforcement. These servers do not perform 802.1X or MAB authentication and have fixed IP addresses. The engineer needs ISE to assign SGT 50 (Database) to traffic sourced from these hosts. Which ISE configuration accomplishes this classification?

Accepted Answer

Create IP-to-SGT static mappings in ISE and deploy them to the data center switch/SXP domain

Answer

Configure an authorization profile that returns SGT 50 for the servers' MAB authentication

Answer

Enable inline tagging on the server access ports so the servers tag their own frames

Answer

Build an SGACL matrix entry mapping the destination SGT to permit database traffic