Cisco ASA 5508-X, Configuration Manual

Page: 102 / 428

6-20
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 6 ASA and Cisco TrustSec
Guidelines for Cisco TrustSec
hostname(config)# no cts sxp connection peer 192.168.1.100
hostname(config)# cts sxp connection peer 192.168.1.100 source 192.168.1.1 password default mode peer speaker
hostname(config)# no cts sxp connection peer 192.168.1.100 source 192.168.1.1 password default mode peer
speaker
Refresh Environment Data
The ASA downloads environment data from the ISE, which includes the Security Group Tag (SGT) name
table. The ASA automatically refreshes its environment data that is obtained from the ISE when you
complete the following tasks on the ASA:
•
Configure a AAA server to communicate with the ISE.
• Import a PAC file from the ISE.
•
Identify the AAA server group that the ASA will use to retrieve Cisco TrustSec environment data.
Normally, you do not need to manually refresh the environment data from the ISE; however, security
groups can change on the ISE. These changes are not reflected on the ASA until you refresh the data in
the ASA security group table, so refresh the data on the ASA to make sure that any security group
changes made on the ISE are reflected on the ASA.
Note We recommend that you schedule policy configuration changes on the ISE and the manual data refresh
on the ASA during a maintenance window. Handling policy configuration changes in this way
maximizes the chances of security group names getting resolved and security policies becoming active
immediately on the ASA.
To refresh the environment data, perform the following steps:
Procedure
Step 1
Refresh the environment data from the ISE and reset the reconcile timer to the configured default value.
cts refresh environment-data
Example:
hostname(config)# cts refresh environment-data
Configure the Security Policy
You can incorporate Cisco TrustSec policy in many ASA features. Any feature that uses extended ACLs
(unless listed in this chapter as unsupported) can take advantage of Cisco TrustSec. You can add security
group arguments to extended ACLs, as well as traditional network-based parameters.
•
To configure an extended ACL, see the firewall configuration guide.
•
To configure security group object groups that can be used in the ACL, see Configure Security
Group Object Groups, page 2-8 .