Question

A network engineer is deploying Cisco TrustSec across a campus. Access switches assign Security Group Tags (SGTs) at the point of authentication, but the enforcement point is a distribution switch several hops away. The engineer confirms all switches support hardware inline tagging on the Layer 2 links between them. Which method should be used to carry the SGT from the access switch to the enforcement point across these directly connected, capable devices?

Accepted Answer

Enable inline SGT tagging by embedding the SGT in the Cisco Meta Data (CMD) field of the Ethernet frame on the trunk links

Answer

Configure SXP (SGT Exchange Protocol) peering between the access switch and the distribution switch

Answer

Configure static IP-to-SGT mappings on the enforcement point for every access endpoint

Answer

Use RADIUS CoA to push the SGT directly to the distribution switch after each authentication