Focus

Panorama Administrator's Guide

Panorama Plugin for Cisco TrustSec

Table of Contents

Panorama Plugin for Cisco TrustSec

The Panorama plugin for Cisco TrustSec enables you to create security policy for your TrustSec environment using dynamic or static address groups. The plugin monitors for changes in TrustSec security groups and registers that information with Panorama and forwards IP information to the firewall, so Panorama can apply the correct policy to corresponding endpoints. The Panorama plugin for Cisco TrustSec supports up to 16 pxGrid (Cisco ISE) servers.

The Panorama plugin processes the endpoint information and converts it to a set of tags that you can use as match criteria for placing IP addresses in dynamic address groups. Panorama creates a tag for each security group tag (SGT) on your pxGrid servers. The tags are constructed in the following format:

cts.svr_<pxgrid-server-name>.sgt_<SGT-name>

To retrieve endpoint IP-address-to-tag mapping information, you must configure a Monitoring Definition for each pxGrid server in your environment. The pxGrid server configuration specifies the username and password and is referenced by the monitoring definition that allows Panorama to connect to the pxGrid. Additionally, you can configure the plugin to verify the pxGrid server identity with a certificate profile on Panorama. It also specifies the device groups and corresponding notify groups containing the firewalls to which Panorama pushes the tags. After you configure the Monitoring Definition and the plugin retrieves the tags, you can create dynamic address groups and add the tags as match criteria.

The Panorama Plugin for Cisco TrustSec version 1.0.2 and later supports Bulk Sync and PubSub monitoring modes. The plugin selects a mode based on the Panorama version—Bulk Sync mode if the Panorama version is earlier than 10.0.0, and PubSub mode on Panorama 10.0.0 and later. The user interface displays the configuration options for the default monitoring mode.

Bulk Sync
PubSub

Bulk Sync

Bulk Sync mode uses two intervals to retrieve information from your pxGrid servers—the monitoring interval and full-sync interval. This mode is the default when the Panorama Plugin for Cisco TrustSec version 1.0.2 or later is installed on a Panorama version earlier than 10.0.0. Panorama versions earlier than 10.0.0 support IP-tab updates to configd every 10 seconds.

Monitoring interval—The monitoring interval is the amount of time that the plugin waits before querying for changes. If no changes have occurred, the monitoring interval resets. If there are changes, the plugin processes the changes before resetting the monitoring interval. The default monitoring interval is 60 seconds. You can set the monitoring interval from 10 seconds to one day (86,400 seconds).

The minimum monitoring interval is 30 seconds when the Panorama plugin for Cisco TrustSec 1.0.0 is installed.
Full-sync interval—The full-sync interval is the amount of time that the plugin waits before updating the dynamic objects from all pxGrid servers regardless of any changes occurred. This ensures that the plugin is synchronized with the pxGrid server even if a change event is missed by the monitoring interval. You can set the full-sync interval from 600 seconds (10 minutes) to 86,400 seconds (one day). You must configure the full-sync interval from the Panorama CLI.

If the monitoring interval is greater than the full-sync interval, the full-sync interval is ignored and a full synchronization is performed at every monitoring interval.

PubSub

PubSub mode monitors notifications directly from the Cisco ISE server (the subscription daemon), parses for IP tags, and sends relevant information to the tag processing daemon (tag-proc). PubSub is the default mode when the Panorama Plugin for Cisco TrustSec version 1.0.2 or later is installed on Panorama version 10.0.0 or later. Panorama versions 10.0.0 or later support IP-tab updates to configd every 100 milliseconds.

Push interval—The push interval is the amount of time between pushes. If the previous push takes too much time, the next push is triggered as soon as it finishes. The minimum push interval is 100 milliseconds (0 seconds) and the maximum is 60 seconds. The default push interval is 0 seconds.
Enable Full Sync—Enable this option to trigger a complete update. If you enable full sync, you can set the full-sync interval. Default is no.
Full-sync interval—The full-sync interval is the amount of time that the plugin waits before updating the dynamic objects from all pxGrid servers regardless of any changes occurred. The default full-sync interval is 10 minutes. You can set the full-sync interval from 600 seconds (10 minutes) to 86,400 seconds (one day). You must configure the full-sync interval from the Panorama CLI.
Reconnection interval—The initial reconnection interval is 1 second, and it is doubled if the previous reconnection failed. The maximum reconnection interval is 64 sec. There is no limit to the number of reconnection attempts.

Differences between dynamic and static addresses

You use the Panorama plugin for Cisco TrustSec to create security policy using dynamic or static address groups. The mapping received from the Cisco ISE Server is converted before being processed by the Panorama plugin framework. This conversion, representing a custom tag, is based on the pxGrid server name and the SGT received:

cts.svr_<server-name>.sgt_<SGT-name>

SGT names are represented in a Cisco ISE Server in three different formats:

String—For example, BYOD.
Decimal number—For example, 15.
Hexadecimal number—For example, 000F.

The format of the SGT name depends on the type of SGT:

The com.cisco.ise.session service, used by dynamic SGTs, returns the tag in a string format. This format enables you to configure the matching criteria as:
```
cts.svr_<server-name>.sgt_BYOD
```
The com.cisco.ise.sxp service, used by static SGTs, returns the tag in a decimal format. As a result, the matching criteria for a static SGT is:
```
cts.svr_<server-name>.sgt_15
```

You can include both dynamic and static SGTs in the same address group, however, the matching criteria must include both formats:

cts.svr_<server-name>.sgt_BYOD

cts.svr_<server-name>.sgt.15

Endpoint Monitoring for Cisco TrustSec

Install the Panorama Plugin for Cisco TrustSec