Focus

Next-Generation Firewall

Configure Ethernet SGT Protection

Table of Contents

Filter

Expand All | Collapse All

In a Cisco TrustSec network, employ Zone Protection based on dropping packets that contain specific security group tags (SGTs) in the 802.1Q header.

Where Can I Use This?	What Do I Need?
NGFW	One of these licenses when using Strata Cloud Manager Strata Cloud Manager Essentials Strata Cloud Manager Pro

Use the following task to configure an Ethernet SGT Protection profile.

Configure Ethernet SGT Protection (PAN-OS)

Procedure for configuring an Ethernet SGT protection profile in PAN-OS and Panorama.

Create a Zone Protection profile to provide Ethernet SGT Protection.
1. Select NetworkNetwork ProfilesZone Protection.
2. Add a Zone Protection profile by Name.
3. Select Ethernet SGT Protection.
4. Add a Layer 2 SGT Exclude List by name.
5. Enter one or more Tag values for the list; range is 0 to 65,535. You can enter individual entries that are a contiguous range of tag values (for example, 100-500). You can add up to 100 (individual or range) tag entries in an Exclude List.
6. Enable the Layer 2 SGT Exclude List. You can disable the list at any time.
7. Click OK.
Apply the Zone Protection profile to the security zone to which the Layer 2, virtual wire, or tap interfaces belong.
1. Select NetworkZones.
2. Add a zone.
3. Enter the Name of the zone.
4. For Location, select the virtual system where the zone applies.
5. For Type, select Layer2, Virtual Wire, or Tap.
6. Add an Interface that belongs to the zone.
7. For Zone Protection Profile, select the profile you created.
8. Click OK.
Commit.
View the global counter of packets that the firewall dropped as a result of all Zone Protection profiles that employ Ethernet SGT Protection.
1. Access the CLI.
2. > show counter global name pan_flow_dos_l2_sec_tag_drop

Procedure for configuring an Ethernet SGT protection profile in Strata Cloud Manager.

Log in to Strata Cloud Manager.
Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesDoS ProtectionConfigurationNGFW and Prisma AccessSecurity ServicesDoS Protection and select the Configuration Scope where you want to create the Zone Protection profile.

You can select a folder or firewall from your Folders or select Snippets to configure the Zone Protection profile in a snippet.
Navigate to the Zone Protection Profiles and Add Profile.
Enter a descriptive Name.
(Optional) Enter a Description.
Select Ethernet SGT.
Add a Layer 2 SGT Exclude List by name.
Enter one or more Tag values for the list.

Range is 0 to 65,535. You can enter individual entries that are a contiguous range of tag values (for example, 100-500). You can add up to 100 (individual or range) tag entries in an Exclude List.
Enable the Layer 2 SGT Exclude List.

Layer 2 SGT Exclude Lists are enabled by default when added.

You can modify an existing Zone Protection profile to disable a specific Layer 2 SGT Exclude List from enforcement.
Save.