Focus

VM-Series Deployment Guide

Panorama Plugin for Cisco TrustSec

Table of Contents

Panorama Plugin for Cisco TrustSec

The Panorama plugin for Cisco TrustSec enables you to create security policy for your TrustSec environment using dynamic address groups. The plugin monitors for changes in TrustSec security groups and registers that information with Panorama and forwards IP information to the firewall, so Panorama can apply the correct policy to corresponding endpoints. The Panorama plugin for Cisco TrustSec supports up to 16 pxGrid (Cisco ISE) servers.

The Panorama plugin for Cisco TrustSec currently supports dynamic objects but not static objects.

The Panorama plugin processes the endpoint information and converts it to a set of tags that you can use as match criteria for placing IP addresses in dynamic address groups. Panorama creates a tag for each security group tag (SGT) on your pxGrid servers. The tags are constructed in the following format:

cts.svr_<pxgrid-server-name>.sgt_<SGT-name>

To retrieve endpoint IP-address-to-tag mapping information, you must configure a Monitoring Definition for each pxGrid server in your environment. The pxGrid server configuration specifies the username and password and is referenced by the monitoring definition that allows Panorama to connect to the pxGrid. Additionally, you can configure the plugin to verify the pxGrid server identity with a certificate profile on Panorama. It also specifies the device groups and corresponding notify groups containing the firewalls to which Panorama pushes the tags. After you configure the Monitoring Definition and the plugin retrieves the tags, you can create dynamic address groups and add the tags as match criteria.

The Panorama Plugin for Cisco TrustSec version 1.0.2 and later supports Bulk Sync and PubSub monitoring modes. The plugin selects a mode based on the Panorama version—Bulk Sync mode if the Panorama version is earlier than 10.0.0, and PubSub mode on Panorama 10.0.0 and later. The user interface displays the configuration options for the default monitoring mode.

Bulk Sync
PubSub

Bulk Sync

Bulk Sync mode uses two intervals to retrieve information from your pxGrid servers—the monitoring interval and full-sync interval. This mode is the default when the Panorama Plugin for Cisco TrustSec version 1.0.2 or later is installed on a Panorama version earlier than 10.0.0. Panorama versions earlier than 10.0.0 support IP-tab updates to configd every 10 seconds.

Monitoring interval—The monitoring interval is the amount of time that the plugin waits before querying for changes. If no changes have occurred, the monitoring interval resets. If there are changes, the plugin processes the changes before resetting the monitoring interval. The default monitoring interval is 60 seconds. You can set the monitoring interval from 10 seconds to one day (86,400 seconds).

The minimum monitoring interval is 30 seconds when the Panorama plugin for Cisco TrustSec 1.0.0 is installed.
Full-sync interval—The full-sync interval is the amount of time that the plugin waits before updating the dynamic objects from all pxGrid servers regardless of any changes occurred. This ensures that the plugin is synchronized with the pxGrid server even if a change event is missed by the monitoring interval. You can set the full-sync interval from 600 seconds (10 minutes) to 86,400 seconds (one day). You must configure the full-sync interval from the Panorama CLI.

If the monitoring interval is greater than the full-sync interval, the full-sync interval is ignored and a full synchronization is performed at every monitoring interval.

PubSub

PubSub mode monitors notifications directly from the Cisco ISE server (the subscription daemon), parses for IP tags, and sends relevant information to the tag processing daemon (tag-proc). PubSub is the default mode when the Panorama Plugin for Cisco TrustSec version 1.0.2 or later is installed on Panorama version 10.0.0 or later. Panorama versions 10.0.0 or later support IP-tab updates to configd every 100 milliseconds.

Push interval—The push interval is the amount of time between pushes. If the previous push takes too much time, the next push is triggered as soon as it finishes. The minimum push interval is 100 milliseconds (0 seconds) and the maximum is 60 seconds. The default push interval is 0 seconds.
Enable Full Sync—Enable this option to trigger a complete update. If you enable full sync, you can set the full-sync interval. Default is no.
Full-sync interval—The full-sync interval is the amount of time that the plugin waits before updating the dynamic objects from all pxGrid servers regardless of any changes occurred. The default full-sync interval is 10 minutes. You can set the full-sync interval from 600 seconds (10 minutes) to 86,400 seconds (one day). You must configure the full-sync interval from the Panorama CLI.
Reconnection interval—The initial reconnection interval is 1 second, and it is doubled if the previous reconnection failed. The maximum reconnection interval is 64 sec. There is no limit to the number of reconnection attempts.

Endpoint Monitoring for Cisco TrustSec

Install the Panorama Plugin for Cisco TrustSec