cisco certification pathway

cisco certification pathway.Security group-based access control: Instead of enforcing access control based on the IP address of the source and destination, as in a regular ACL, access control is enforced based on the roleofthesourceanddestination. The access control is based on the roleofthesourceanddestination. To do this, the source and destination are assigned a Security Group Tag (SGT) OEncrypted traffic: On each link, the traffic is encrypted with 802.1AE Media Access Control Security (MACSec).Similar to 802.IX, Cisco TrustSec also defines the supplicant, authentication server, and authenticator (supplicant,authentication server,authenticator). Before an applicant can send a packet into the network, it needs to join theBefore sending packets into the network, the applicant needs to join the TrustSec domain, which involves the following steps.Step 1. The applicant authenticates its identity to the authentication server via 802.1X. During the authentication phase, the authentication server authenticates the identity of both the applicant and the authenticator. The identities of both the applicant device and the user may both need to be authenticated.4.10 Implementation of Identity and Access Control Mechanisms 217Step 2. the authentication server sends authorization information to the authenticator and the applicant. the information will contain the SGT assigned for the applicant's traffic.Step 3. negotiate a security association and establish link encryption between the applicant and the authenticator (the rest of the domain already has link encryption set up as a part of the network device registration process).Figure 4-22 shows how to embed SGTO access control in a Layer 2 frame by "marking" the traffic at the ingress and enforcing SGACL inspection at the egress. That is, once a packet flows into the CiscoTrustSec domain, it is tagged according to its origin, and access control is enforced at the egress based on its destination. Access decisions are made based on the SGACLs implemented at the egress. An example of how to "mark traffic at the ingress and enforce SGACL checks at the egress" is shown in Figure 4-23.