Verified TrustSec


In my continued journey with Cisco TrustSec, I now have a verified switch configuration with all the components of basic TrustSec with ISE doing the policy and the switch doing the enforcement.

It was important to me to reach this point, as i now have to remember everything until this point in my practice. That and i dont have to fumble around a million different blog posts scattered all over the interwebs, in order to figure out what to do.

This is a working config for me on my Catalyst 3650 switch. I leave the ISE portion out of the equation for now, but obviously thats a component just as important.

aaa new-model
!
!
aaa group server radius ISE-GRP
 server name ISE01
 ip radius source-interface Vlan100
!
aaa authentication dot1x default group ISE-GRP
aaa authorization network default group ISE-GRP 
aaa authorization network CTS-LIST group ISE-GRP 
aaa accounting network default start-stop group ISE-GRP
!
aaa server radius dynamic-author
 client 10.0.100.40 server-key Cisco123
!
ip dhcp snooping vlan 1,10,30
ip dhcp snooping
!
device-tracking tracking
!
!
cts role-based sgt-map 10.0.100.30 sgt 9
cts role-based sgt-map 192.168.100.100 sgt 12
cts role-based enforcement
cts role-based enforcement vlan-list 1-4094
!
!
dot1x system-auth-control
!
! Client Port:
!
interface GigabitEthernet1/0/8
 switchport mode access
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator
 spanning-tree portfast
!
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
!
radius server ISE01
 address ipv4 10.0.100.40 auth-port 1812 acct-port 1813
 pac key Cisco123
!

And some verification commands on the switch after all of this is implemented:

C3650#sh cts pacs 
AID: 56F93AE4DB08EB3D6DACF61DF1506236
PAC-Info:
  PAC-type = Cisco Trustsec
  AID: 56F93AE4DB08EB3D6DACF61DF1506236
  I-ID: C3650
  A-ID-Info: Identity Services Engine
  Credential Lifetime: 08:28:41 UTC Thu Apr 02 2026
PAC-Opaque: 000200B0000300010004001056F93AE4DB08EB3D6DACF61DF150623600060094000301007ADBBA8BE1A5EA6BB1D71148816968DA00000013695242CC00093A80A7B5D16B1396546E8A1923025472E744B29F1C43042CD3D835B9C6ADE1F45A700066E12854B8CE7C6ACE5BE262D577F8BCC6443909D8E951D506F783602E3832F357A0390D47A402084D145249A82EDD205F2B6ED9B2F780AC3A2842FE36B765279A77809EBD4DA532ADD5D2809127A9D386B806
Refresh timer is set for 12w3d

C3650#show cts environment-data 
CTS Environment Data
====================
Current state = COMPLETE
Last status = Successful
Local Device SGT:
  SGT tag = 2-00:TrustSec_Devices
Server List Info:
Installed list: CTSServerList1-0001, 1 server(s):
 *Server: 10.0.100.40, port 1812, A-ID 56F93AE4DB08EB3D6DACF61DF1506236
          Status = ALIVE
          auto-test = TRUE, keywrap-enable = FALSE, idle-time = 60 mins, deadtime = 20 secs
Security Group Name Table:
    0-00:Unknown
    2-00:TrustSec_Devices
    3-00:Network_Services
    4-00:Employees
    5-00:Contractors
    6-00:Guests
    7-00:Production_Users
    8-00:Developers
    9-03:Auditors
    10-00:Point_of_Sale_Systems
    11-00:Production_Servers
    12-01:Development_Servers
    13-00:Test_Servers
    14-00:PCI_Servers
    15-00:BYOD
    255-00:Quarantined_Systems
    2002-00:KP_USERS
    4004-01:KPLAB_ORDINARY_USERS
Environment Data Lifetime = 86400 secs 
Last update time = 10:06:38 UTC Sat Jan 3 2026
Env-data expires in   0:02:34:13 (dd:hr:mm:sec)
Env-data refreshes in 0:02:34:13 (dd:hr:mm:sec)
Cache data applied           = NONE
State Machine is running

C3650#show cts role-based sgt-map all
Active IPv4-SGT Bindings Information

IP Address              SGT     Source
============================================
10.0.100.20             2       INTERNAL
10.0.100.30             9       CLI
10.10.10.1              2       INTERNAL
10.10.10.11             2002    LOCAL
10.30.30.1              2       INTERNAL
192.168.100.100         12      CLI

IP-SGT Active Bindings Summary
============================================
Total number of CLI      bindings = 2
Total number of LOCAL    bindings = 1
Total number of INTERNAL bindings = 3
Total number of active   bindings = 6

C3650#show cts role-based permissions 
IPv4 Role-based permissions default:
        Permit IP-00
IPv4 Role-based permissions from group 2002:KP_USERS to group 9:Auditors:
        Deny IP-00
IPv4 Role-based permissions from group 2002:KP_USERS to group 12:Development_Servers:
        Deny IP-00
IPv4 Role-based permissions from group 2:TrustSec_Devices to group 2002:KP_USERS:
        Permit IP-00
IPv4 Role-based permissions from group 4004:KPLAB_ORDINARY_USERS to group 2002:KP_USERS:
        Deny IP-00
RBACL Monitor All for Dynamic Policies : FALSE
RBACL Monitor All for Configured Policies : FALSE


C3650#show cts role-based counters 
Role-based IPv4 counters
From    To      SW-Denied  HW-Denied  SW-Permitt HW-Permitt SW-Monitor HW-Monitor
*       *       0          0          0          1008       0          0         
2002    9       0          0          0          0          0          0         
2002    12      0          0          0          0          0          0         
2       2002    0          0          0          5          0          0         
4004    2002    0          0          0          0          0          0         

Thats it for now. I hope you can use this as a reference for your own lab work.

Take Care!!

/Kim