TrustSec on WS-C3850-24 t

Similar Questions

• TrustSec caught SGT supported platforms and modules

  Hi all

  I have a question about how to determine if a Cisco router/switch supports inline tagging SGT.

  Although I found a link (below) that shows what platforms and modules are required to support the inline SGT I can't surely determine yet if my switches support inline Sgt

  http://www.Cisco.com/c/en/us/solutions/enterprise-networks/TrustSec/trustsec_matrix.html

  Here are the relevant sections of my 3750's 'see the worm' (I know that IOS be 15.X version and type 'ipbase')

  What is material support inline tagging?

  Cisco IOS software, software C3750 (C3750-IPSERVICESK9-M), Version 12.2 (55) SE3,.

  System image file is "flash:/c3750-ipservicesk9-mz.122-55.SE3.bin".

  processor of Cisco WS-C3750G-24TS-1U (PowerPC405) (revision 01) with K 131072 bytes
  memory.
  Card processor ID FOC0941U2TU
  Last reset of tension
  3 virtual Ethernet interfaces
  28 gigabit Ethernet interfaces
  Password recovery mechanism is activated.

  512K bytes of memory simulated by flash not volatile configuration.
  Basic Ethernet MAC address: 00:15:C6:F5:32:80
  Motherboard set number: 10219-73-03
  Power supply part number: 341-0098-01
  Motherboard serial number: FOC09400WB9
  Power supply serial number: AZS093800Q6
  Revision of the model number: 01
  Motherboard revision number: 04
  Model number: WS-C3750G-24TS-S1U
  System serial number: FOC0941U2TU
  Top Assembly part number: 800-26859-01
  Top of page revision number of the Assembly: 06
  Version ID: V03
  Revision number of hardware consulting: 0x02

  ===========================================

  Here are the relevant sections of my 6500's 'see the worm' (I know that IOS be 15.X version and type 'ipbase')

  What is material support inline tagging?

  Cisco IOS Software, s72033_rp (s72033_rp-ADVIPSERVICESK9_WAN-M), Versio
  n 12.2 (33) SXI12, VERSION of the SOFTWARE (fc2)

  ROM: System Bootstrap, Version 12.2 S9 (14r), RELEASE SOFTWARE (fc1)

  System image file is "disk0:s72033 - advipservicesk9_wan - mz.122 - 33.SXI12.bin".

  processor of Cisco WS - C6506 (R7000) (version 3.0) with 458720K / 65536K bytes of mem
  ORY.
  Card processor ID SAL08363E5J
  SR71000 pace at 600 Mhz, implemented 0 x 504, Rev 1.2, 512 KB of L2 Cache
  Last reset of tension
  7 virtual Ethernet interfaces
  50 gigabit Ethernet interfaces
  1917K bytes of non-volatile configuration memory.
  8192K bytes of packet buffer.

  65536 K bytes of Flash internal SIMM (sector size of 512K).
  Configuration register is 0 x 2102

  TIA

  Restrictions and configuration notes

  The guidelines and the following limitations apply to configuring Cisco TrustSec SGT and SGACL on Catalyst 3750-X and Catalyst 3560-X switches:

  • You cannot statically map one IP subnet to a Sergeant you can that card to a Sgt IP addresses when you configure IP address-to-SGT mappings, the IP address prefix must be 32.
  • If a port is configured as Multi-Auth mode, all hosts on this port connection must be assigned the same Sgt When a host tries to authenticate, his assigned Sergeant must be the same as Sergeant assigned to a previously authenticated host. If a host attempts to authenticate and his Sergeant is different from the previously authenticated host SGT, the port VLAN (VP) to which belong these hosts is error-disabled people.
  • Cisco TrustSec execution is supported only on up to eight VLANS on a VLAN Trunk link. If there are more than eight VLANs configured on a VLAN Trunk link and Cisco TrustSec execution is enabled on VLANs, the switch ports on these links of VLAN Trunk will be error-disabled people.
  • The switch can assign the SGT and apply SGACL matches from end-hosts of the SXP listen only if the end-hosts are adjacent Layer2 switch.
  • Port mapping - to the-SGT can be configured only on Cisco TrustSec (i.e., switch-switch links). Port mapping - to the-SGT cannot be configured on the host-switch links.

  When the port mapping - to the-SGT is configured on a port, a SGT is attributed to any circulation penetration on this port. There is no output on port traffic SGACL app.

  • SGT/SGACL is supported on the network switches Cisco Catalyst 3750 - X and X-3650 which all uplink modules: C3KX-NM - 1 G, C3KX-NM - 10G, C3KX-NM-10GT and C3KX-SM - 10G. C3KX-SM - 10G is only necessary for the effect on the uplink.
  • http://www.Cisco.com/c/en/us/TD/docs/switches/LAN/catalyst3750x_3560x/software/release/15-0_2_se/configuration/guide/3750x_cg/trustsec.html

• Configuration of the battery of WS-C3850-48 t-S

  I am looking for help on how correctly configure/create a new battery using two WS-C3850-48 t-S switches.

  Here are two new switches directly out of the box and never been powered on/configured. What is a procedure to follow to configure these two switches to create the stack.

  Mainly, configure switches switches 'stand-alone' first then plug the stackwise cables in, or do I connect the stackwise first cables, turn on switches can do the configuration?

  Beyond that, what are the commands or the things I have to do this differ from the implementation of a stand alone switch

  Thank you for your help.

  Stack them in first and make your configurations.

  Have a read of these have more knowledge on the subject

  http://www.Cisco.com/c/en/us/TD/docs/switches/LAN/catalyst3850/software/...

  http://www.Cisco.com/c/en/us/products/collateral/switches/catalyst-3850-...

  Hope this helps

  Please note useful messages *.

  Thank you

  Madhu

• TrustSec and SXP

  Hello world

  I am trying to fully understand the trustsec technology and things get confusing... so I ask a little help :)

  Feel free to correct me if I'm wrong (it's the point indeed).

  I have the following architecture to implement:

  • ISE / AD (classification)
  • ASA (application)
  • SGT-compatible switches
  • WLC (non - SGT capable)

  From what I understood, ISE is the first authentication (classification) and returns the tag SGT switches. Allow that the switches to mark the entry correctly (spread) before coming to the execution (which will be made by ASA firewall).

  But what I don't understand is how the WLC is ISE tags? He is not capable, SGT, so it does not work with the SXP peering as a speaker. So he can send the right mapping tables (Sgt ip)? How can he card nothing if it cannot receive tags authentication ISE (saying that the user is in SGT 'employee' for example)? It should only be static mapping to WLC (then yes ok but trustsec starts becoming useless...)?

  I'm really confused, so I guess I misunderstood the principle of trustsec...

  Thank you very much for reading and if you can help.

  Best regards

  Basile

  When a wireless client connects to the network as part of the policy of auth is also give to Sgt the WLC as speaker SXP will transmit the SGT intellectual property mapping the SXP listener. the listener is entered the package on behalf of the WLC SGT.

  I hope that makes sense. It's confusing :)

• How to recover the password on a C3850-24s

  Hello

  I have a switch that I myself have accidentally locked after having entered the following commands:

  enable password Hello

  enable secret Hello

  turn on Hello secret 5

  And now none of the above passwords are allowing me to access the privileged exec mode.

  Your help would be great.

  You must power cycle and interrupt the boot process. Who will start in a default configuration, correct the errors and then reload once more to completely recover.

  The details are explained here:

  http://www.Cisco.com/c/en/us/TD/docs/switches/LAN/catalyst3850/software/...

• Combatiability fiber Module

  Hello

  I need to know who is Cisco C3850-NM-8-10 G switch Module is Compatible with the Cisco ONS-TR-100-LX10 (Sonet Mux).

  Thank you

  I don't think that there is compatible options.  The closest would be GLC - FE - 100LX, but it is not listed as being compatible with a 3850.  I don't quite see 3850 SFP listed as 100LX in support.  So I think you're out of luck.

  http://www.Cisco.com/c/en/us/TD/docs/interfaces_modules/transceiver_modules/compatibility/matrix/100MB_Tx_Matrix.html

• Updated NTP on the 3850

  Hello

  I have a 3850 with NTP configured switch. The connection to the server has been disconnected briefly but after reconnecting NTP was not synchronized.

  It would probably start working if I delete and add the median of declaration of the ntp server. But y at - it means to make it work again without having to reconfigure the switch (removing and adding the ntp server)

  Model switch SW Version SW Image Mode ports
  ------ ----- ----- ---------- ---------- ----
  * WS-C3850-24 1, t 32 03.06.03.E cat3k_caa-universalk9 BUNDLE

  Clock SWITCH #show
  . 09:22:29.466 Thu Sep 15 2016 Greenl
  SWITCH #show ntp ass

  address Ref clock st when poll reach delay offset disp
  ~ 172.20.5.49. INIT. 16 127137 1024 0 0.000 0.000 15937.
  172.28.10.44 INIT. 16-1323-1024 0 0.000 0.000 16000.
  * sys.peer, # selected, + candidate - outlyer, x falseticker, ~ configured
  State SWITCH #show ntp
  Clock is unsynchronized, 16, no reference clock stratum
  nominal freq is 250,0000 Hz, real freq is 250,0050 Hz, precision is 2 * 10
  NTP uptime 2378908500 (1/100 of a second), the resolution of 4000
  reference time is DB831257. C624DF50 (22:03:35.774 Greenl kills 13 2016 Sep)
  the clock offset is 0,0000 msec, delay of root is 0.00 msec
  root dispersion is 1.81 msec, the peer dispersion is 0.00 msec
  loopfilter State is 'CTRL' (Normal controlled loop), drifting is - 0.000020078 s/s
  the system polling interval is 64, update was 127142 sec ago.
  SWITCH #.

  The original post seems to suggest that NTP was working. But I agree with Leo that a starting point would be to specify if the NTP work properly with the current configuration.

  The fact that the reference clock shows INIT indicates that this option has not communicated successfully with the NTP servers. Then maybe another troubleshooting step would be to check the connectivity to the servers.

  HTH

  Rick

• ESXi-> Cisco 3850-> router upstream routing does not

  Please see the attached diagram.

  I currently have the installation of "router on the stick" and I move to lass on Cisco 3850 battery. Initially, I moved VLAN100.  I can ping to each of the directly connected devices (i.e. the router 3850 and 2911). I can't do a ping to a virtual machine on vlan 100 router and vice versa. Here's what works what doesn't work.

  Work in both sense

  VM (172.16.100.51) <->GW on IVR (172.16.100.254)

  VM (172.16.100.51) <->an another IVR (172.16.230.254)

  VM (172.16.100.51) <->Int L3 on 3850 (10.2.2.2)

  L3 on 3850 (10.2.2.2) int <->int L3 on 2911 (10.2.2.1)

  SVI on 3850 (172.16.100.254) <->int L3 on 2911 (10.2.2.1)

  Does not not in both directions:

  VM (172.16.100.51) <->L3 interface on 2911 (10.2.2.1)

  VM (172.16.100.51) <->else NOT routed on 3850

  I have following routes on 2911 and 3850.

  3850:
  IP route 0.0.0.0 0.0.0.0 10.2.2.1

  2911:

  IP route 172.16.100.0 255.255.255.0 10.2.2.2

  IP route 172.16.230.0 255.255.255.0 10.2.2.2

  If in theory everything that comes from 172.16.100.51 no 3850 premises must be sent to 10.2.2.1 since it is the default route on 3850.

  I suspect that this is a problem with the license. I have IP Base feature set stack license 3850. I have checked using the license to show and display the version controls.

  According to this FAQ Cisco, http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-..., routing should work because I do not have more than 16 static routes and I'm only using base L3 routing features.

  I am at a loss here. What is going on? Can someone please confirm?

  I bought WS-C3850-24 t-S,

  http://www.Cisco.com/c/en/us/TD/docs/switches/LAN/catalyst3850/software/...

  thinking that I would be able to use Lass and keep all traffic to get into the routers as switches upstream of our most ancient were only L2.

  It looks like an upgrade for all IP Services features is possible.

  https://cisco3850.wordpress.com/2015/04/22/licensing-for-cisco-catalyst-....

  That I have to upgrade the image so or can I just pass the license using the built-in commands described here.

  http://www.Cisco.com/c/en/us/TD/docs/switches/LAN/catalyst3850/software/...

  I hope that I don't have to reboot switches because this configuration is currently using this stack as the core and distribution.

  Any help is appreciated.

  Thank you

  Turning and the "IP routing" did?

• Incompatibility of Version H/w stacking Cisco 3850

  I have a cisco failure 3850. I got a new switch and the IOS was lower than my pile to course, so I've updated. When I do a show worm IOS looks right but when I do a show the H/W version parameter are different.  What causes my carpet to fail?

  New switch:

   

  Model switch SW Version SW Image Mode ports

  ------ ----- -----              ----------        ----------            ----

  * 1 56 WS-C3850 - 48P INSTALL 03.07.03E cat3k_caa-universalk9

                                                                   

  Current H/W

  Switch # Mac address priority Version State role

  ------------------------------------------------------------

  * 1 active 15 ready V04

  Old switch:

  Model switch SW Version SW Image Mode ports

  ------ ----- -----              ----------        ----------            ----

  * 1 56 WS-C3850 - 48P INSTALL 03.07.03E cat3k_caa-universalk9

  S

  Current H/W

  Switch # Mac address priority Version State role

  ------------------------------------------------------------

  * 1 active 15-V06 ready

  Hi Kurt,.

  That will not cause the battery to fail, you just need to make sure that the version of IOS and the level of license are the same between the members of the battery and make sure you turn the switch before plugging in the battery again.

  HTH

  Julio

• Cisco ISE (Identity Services Engine) - seeds SGA device?

  Hello

  We have a LAB with Cisco ISE, certificates and list DACL. Everything works fine with the 1.1.1 version but now we want to use the functionality of CMS - SGT instead of the ACL and we found that we need seed for this device and the only device that takes in charge the Nexus 7000 is. Is this true? What is the only way that we can use LMS - SGT? Are there plans that any other device will be used to seed device?

  BR, Marko

  The device of seed set as first device that communicates with the ISE. It must be a link.

  http://www.Cisco.com/en/us/docs/solutions/enterprise/security/TrustSec_2.0/trustsec_2.0_dig.PDF

  In addition the Nexus needs a license of Advanced Services installed in order to support the Trustsec.

  I can't comment on any future plans.

• ISE 2.0 authorization number (patch 1)

  I'm running into a bit of a strange problem with ISE 2.0 (patch 1).  I have a laptop Win 7 passing authC/authZ, get an IP address, but cannot access internal or external resources.  It uses 802. 1 x with EAP - TLS with machine and user of AD certs.  With this question, I'll have a MAR, but TAC addresses this issue.

  I just can't understand how the device can get an IP address, but not access anything on the network.  The laptop can do a release/renew the IP address, so it becomes somewhere on the network.

  DRM for ideas.

  -Dan

  Looks like a dhcp snooping/analysis of device issue, the sess auth does not know the ip address of your windows pc and then the ACL is not applied. You can check with 'show ip access-list interface x/x '. Can you do a 'show ip analysis device int x/x' and see if the ip of the device shows as active? Also have you configured the settings recommended in the switch using the configuration of the switch guide universal trustsec?

• 3850 catalyst, MAB and RADIUS

  Hello

  This a 3850 catalyst drivers to speak (C3750 MAB auth works like a charm) and the strange thing is that I don't see RAIUS client sending packets button anywhere:

  Statistics of RADIUS #show
  Auth.      ACCT.       Both
  Length maximum inQ: NA NA 0
  Length maximum waitQ: NA NA 0
  Length maximum doneQ: NA NA 0
  Total number of responses seen: 0 0 0
  Packages with answers: 0 0 0
  Packages without answers: 0 0 0
  Access releases: 0
  Average answer delay (ms): 0 0 0
  Maximum response delay (ms): 0 0 0
  Number of timeouts RADIUS: 0 0 0
  Detects duplicate IDS: 0 0 0
  Buffer allocation failed: 0 0 0
  Memory (bytes) maximum buffer size: 0 0 0
  Malformed responses: 0 0 0
  Authenticators: 0 0 0
  Unknown answers: 0 0 0
  Source Port range: (2 ports only)
  1645 - 1646
  Used in last Port Source / ID:
  1645/0
  1646/0

  Time passed since the last reset of counters: 6h44m
  Distribution of radius of latency:
  <= 2ms="" :         ="" 0         ="">
  3-5ms  :          0          0
  5 10ms: 0 0
  10 20ms: 0 0
  20 50ms: 0 0
  50-100 m: 0 0
  > 100ms: 0 0

  Current length of the NQI: 0
  Current length of the doneQ: 0

  #debug talkative RADIUS

  All mac addresses are unable to authenticate

  #sh newspaper

  03007: 3 August 17:55:20.239 UTC: % MAB-5-FAIL: failure of authentication for the client (XXXX. XXXX. XXXX) on the Interface item in gi1/0/7 AuditSessionID XXXXXXXXXXXXXXXXXXXXXXXXXX
  003008: 3 August 17:55:20.239 UTC: % MAB-5-FAIL: failure of authentication for the client (XXXX. XXXX.XXX) on the Interface item in gi1/0/7 AuditSessionID XXXXXXXXXXXXXXXXXXXXXXXXX

  There entry context very log in debugging MAB invalid EVT 9 of the EAP (I don't know what it could be)

  MAB #debug all

  003085: 3 August 18:04:26.146 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] context MAB received create from AuthMgr
  003086: 3 August 18:04:26.146 UTC: mab - ev: MAB authorizing XXXX. XXXX. XXXX
  003087: 3 August 18:04:26.146 UTC: mab - ev: client context created MAB 0x1B00004B
  003088: 3 August 18:04:26.146 UTC: mab: State has original mab_initialize enter
  003089: 3 August 18:04:26.146 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] sent to create a new event in context of EAP of MAB to 0x1B00004B (XXXX. XXXX. XXXX)
  003090: 3 August 18:04:26.147 UTC: mab - ev: [XXXX. XXXX. XXXX, gi1/0/48 article] authenticating MAB began to 0x536EE850 (XXXX. XXXX. XXXX)
  003091: 3 August 18:04:26.147 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] Invalid EVT 9 of the EAP
  003092: 3 August 18:04:26.147 UTC: mab - sm: [XXXX. XXXX. XXXX, item in gi1/0/48] received event 'MAB_CONTINUE' on the 0x1B00004B handle
  003093: 3 August 18:04:26.147 UTC: mab: during the mab_initialize State, had 1 (mabContinue) event
  003094: 3 August 18:04:26.147 UTC: @ mab: mab_initialize-> mab_authorizing
  003095: 3 August 18:04:26.147 UTC: mab - ev: [XXXX. XXXX. XXXX] formatted mac = XXXXXXXXXXXX
  003096: 3 August 18:04:26.147 UTC: mab - ev: [XXXX. XXXX. XXXX] created mab nickname dot1x profile dot1x_mac_auth_XXXX. XXXX. XXXX
  003097: 3 August 18:04:26.148 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] from MAC-AUTH-BYPASS to 0x1B00004B (XXXX. XXXX. XXXX)
  003098: 3 August 18:04:26.148 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] Invalid EVT 9 of the EAP
  003099: 3 August 18:04:26.148 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] MAB received an Access-Reject for 0x1B00004B (XXXX. XXXX. XXXX)
  003100: 3 August 18:04:26.148 UTC: % MAB-5-FAIL: failure of authentication for the client (XXXX. XXXX. XXXX) on the Interface 0A48021200000FD1007B87DE AuditSessionID item in gi1/0/48
  003101: 3 August 18:04:26.148 UTC: mab - sm: [XXXX. XXXX. XXXX, item in gi1/0/48] received event 'MAB_RESULT' on the 0x1B00004B handle
  003102: 3 August 18:04:26.148 UTC: mab: during the mab_authorizing State, had 5 (mabResult) event
  003103: 3 August 18:04:26.148 UTC: @ mab: mab_authorizing-> mab_terminate
  003104: 3 August 18:04:26.149 UTC: mab - ev: [XXXX. XXXX. XXXX, item in gi1/0/48] delete profile of credentials for 0x1B00004B (dot1x_mac_auth_XXXX. XXXX. XXXX)
  003105: 3 August 18:04:26.150 UTC: mab - sm: [XXXX. XXXX. XXXX, item in gi1/0/48] received event 'MAB_DELETE' on the 0x1B00004B handle

  The configuration is below:

  RADIUS AAA Server Group XXX-XXXXXX
  Server 10.XX. XX.30
  Server 10.x.x.x. XX.30

  AAA authorization network default Group XXX-XXXXXX no
  accounting dot1x default start-stop group AAA-XXX-XXXXXX

  radius of the IP source-interface Loopback0

  RADIUS-server host 10.XX. XX.30 touches 7 XXXXXXXXXXXXXXXXXXXXXXX
  RADIUS-server host 10.x.x.x. XX.30 touches 7 XXXXXXXXXXXXXXXXXXXXXXX
  RADIUS server retransmit 0
  RADIUS 3 server timeout

  interface GigabitEthernet1/0/6
  XXXX XXXXX description
  switchport access vlan XXX
  switchport mode access
  switchport voice vlan XXX
  the host-mode multi-auth authentication
  authentication order mab
  Auto control of the port of authentication
  authentication timer restart 180
  MAB
  no link-status of snmp trap
  Storm-control broadcasts 0.50
  spanning tree portfast
  end

  #sh worm

  Model switch SW Version SW Image Mode ports
  ------ ----- -----              ----------        ----------            ----
  * 1 56 WS-C3850 - 48P INSTALL 03.07.02E cat3k_caa-universalk9
  2 56 WS-C3850 - 48P INSTALL 03.07.02E cat3k_caa-universalk9

  Any ideas?

  P.

  Your authentication dot1x missing "aaa".

• Cisco Ise 1.3 with Flex to connect wireless supported function

  Hello

  My environment is formed ROUND of flex-mode connection wireless and cisco Ise 1.3, these features are supported?
  Basic functions of the AAA
  profiling
  posturing
  Substitution VLAN
  Substitution of the ACL
  Comments commissioning

  TrustSec 2.0 this MDC is not supported? someone try this feature?

  These all work with ISE 1.3 and FlexConnect WLAN.

  You need the right license ISE - the type of mobility (wireless) license will cover everything. If you have wired and wireless, then you must have basic (for most features) + more (for profiling) + Apex (for Posturing).

• ISE 1.4 and Apple 'captive Network Assistant"causing problems

  I'm testing ISE 1.4 with 10.10.2/Safari 8.0.3 MAC and the boring revised downward Safari AKA "Captive Network Assistant" gets in the way.  I wonder what other people did to work around.

  According to the compatibility of network component Cisco ISE v1.4 Safari I must be compatible, in captivity Network Assistant says that this isn't, but I suspect its because the computer MAC laptop try to validate with ~ 200 areas (so I hear for this).  My ISE/WLC have a DACL that allows certain IP addresses before finishing the AuthC/Z, and obviously I can't put in the DACL for all 200 of these areas.  My ISE is configured with trustsec model where I have two SSID, a first on the front-end to detect if Anyconnect 4.x is installed and if it is not then redirect to a portal.  Fails it MAC peripheral security check cause... or should I say will not display it. cause Apple Network Assistant captive.

  I know I can disable the captive Network Wizard by renaming the file, but it will probably not an acceptable solution in my environment for political reasons.  I wonder what others have done to bypass this annoying problem.  Maybe something with a DNS record or something...

  Thank you

  e-

  Common recommendation is to deceive the apple devices to think he has access to the internet by running this command on the command-line of your WLC:

  config network web-auth captive-bypass enable

• VDI with ISE access control

  Hi guys,.

  Can ISE access control for VDI users with thinclients like PC? Now, we want to implement authentication 802. 1 x for the VDI users, but I don't know if this can be done by ISE. We just need to configure access switch ports to open 802. 1 x as usual and the switch will then relay the RADIUS to the ISE?

  Hello

  The link below can help you:-

  http://blogs.Cisco.com/borderless/using-TrustSec-to-simplify-virtual-desktop-infrastructure-VDI-deployment/