Cisco ASA 5508-X, Configuration Manual

Page: 89 / 428

6-7
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 6 ASA and Cisco TrustSec
About Cisco TrustSec
If one end of an SXP connection is configured as a Speaker, then the other end must be configured as a
Listener, and vice versa. If both devices on each end of an SXP connection are configured with the same
role (either both as Speakers or both as Listeners), the SXP connection fails and the ASA generates a
syslog message.
Multiple SXP connections can learn IP-SGT mapping entries that have been downloaded from the
IP-SGT mapping database. After an SXP connection to an SXP peer is established on the ASA, the
Listener downloads the entire IP-SGT mapping database from the Speaker. All changes that occur after
this are sent only when a new device appears on the network. As a result, the rate of SXP information
flow is proportional to the rate at which end hosts authenticate to the network.
IP-SGT mapping entries that have been learned through SXP connections are maintained in the SXP
IP-SGT mapping database. The same mapping entries may be learned through different SXP
connections. The mapping database maintains one copy for each mapping entry learned. Multiple
mapping entries of the same IP-SGT mapping value are identified by the peer IP address of the
connection from which the mapping was learned. SXP requests that the IP-SGT Manager add a mapping
entry when a new mapping is learned the first time and remove a mapping entry when the last copy in
the SXP database is removed.
Whenever an SXP connection is configured as a Speaker, SXP requests that the IP-SGT Manager
forward all the mapping entries collected on the device to the peer. When a new mapping is learned
locally, the IP-SGT Manager requests that SXP forward it through connections that are configured as
Speakers.
Configuring the ASA to be both a Speaker and a Listener for an SXP connection can cause SXP looping,
which means that SXP data can be received by an SXP peer that originally transmitted it.
SXP Chattiness
The rate of SXP information flow is proportional to the rate at which end hosts authenticate into the
network. After an SXP peering is established, the listener device downloads the entire IP-SGT database
from the speaker device. After that, all changes are sent incrementally only when a new device appears
on the network or leaves the network. Also, note that only access devices that are attached to the new
device initiate this incremental update to the upstream device.
In other words, SXP protocol is no chattier than the authentication rate, which is limited to the capability
of the authentication server. Therefore, SXP chattiness is not a major concern.
SXP Timers
• Retry Open Timer—The retry open timer is triggered if one SXP connection on the device is not up.
After the retry open timer expires, the device goes through the entire connection database and if any
connection is in the off or “pending on” state, the retry open timer restarts. The default timer value
is 120 seconds. A zero value means the retry timer does not start. The retry open timer continues
until all the SXP connections are set up, or the retry open timer has been configured to be 0.
•
Delete Hold-Down Timer—The connection-specific delete hold-down timer is triggered when a
connection on the Listener is torn down. The mapping entries that have been learned are not deleted
immediately, but are held until the delete hold-down timer expires. The mapping entries are deleted
after this timer expires. The delete hold-down timer value is set to 120 seconds and is not
configurable.
• Reconciliation Timer—If an SXP connection is brought up within the delete hold-down timer
period, a bulk update is performed on this connection. This means that the most recent mapping
entries are learned and are associated with a new connection instantiation identifier. A periodic,