Static Security Group Tag (SGT) for TrustSec Plugin

cts.svr_<server-name>.sgt_<SGT-name>

‘cts.svr_<server-name>.sgt_BYOD’ or ‘cts.svr_<server-name>.sgt_15’

Create active sessions so that Panorama can learn SGT tags for dynamic or static address group definition. To create active sessions, use ISE to authenticate devices. Panorama does not collect default SGT tags on ISE. Create address groups and verify that they are added.
Select
Objects > Address Groups.
Select the Device Group you created for monitoring endpoints in your Cisco TrustSec environment from the
Device Group
drop-down.
Click
Add
and enter a
Name
and
Description
for the address group. The dynamic address group naming convention is cts.svr_(server-name).sgt_<SGT-name>. Static address group naming convention is: cts.svr_<server-name>.sgt_<SGT-decimal number>.
Select
Type
as
Dynamic
or
Static
in the drop-down.
Click
Add Match Criteria
.
Select the
And
or
Or
operator and click the plus (+) icon next to the security group name to add it to the dynamic or static address group. Panorama can only display security group tags it has learned from active sessions. Security group tags in live sessions appear in the match criteria list.
Click
More
in the
Addresses
column of the address group. Panorama displays a list of IP addresses added to that address group based on the match criteria you specified.
Use dynamic or static addresses groups in policy. Dynamic address groups are empty until you attach them to a policy. You won’t see dynamic address groups unless a policy is using it. To use a address group in policy:
Select
Policies > Security.
Click
Add
. Enter a
Name
and a
Description
for the policy.
Add the
Source Zone
to specify the zone from which traffic originates.
Add the
Destination Zone
at which traffic is terminating.
For the
Destination Address
, select the address group you just created.
Specify the action,
Allow
or
Deny
, for the traffic. Optionally attach the default security profiles to the rule.
Repeat steps a-f to create another policy rule.
Click
Commit
.
Optionally update the objects from the pxGrid server at any time by synchronizing objects. Synchronizing objects enables you to maintain context on changes in the virtual environment and allows you to enable applications by automatically updating the address groups used in policy rules.
Select
Panorama > Cisco TrustSec > Monitoring Definition.
Click
Synchronize Dynamic Objects.