Other TrustSec Feature

Configure Cisco TrustSec (CTS) parameters, including the device enrollment credentials, inline SGT enforcement and SXP peering on WAN Edge routers.

Diagram

Classes

other_profiles (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
trustsec	Class	[trustsec]	No

trustsec (sdwan.feature_profiles.other_profiles)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	No	trustsec
description	String		No
device_id	String	min: 1, max: 32	No
device_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
device_password	String	min: 1, max: 24	No
device_password_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
device_sgt	Integer	min: 2, max: 65519	No
device_sgt_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enable_enforcement	Boolean	true, false	No
enable_enforcement_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enable_sxp	Boolean	true, false	No
listener_hold_time_max	Integer	min: 1, max: 65534	No
listener_hold_time_max_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
listener_hold_time_min	Integer	min: 1, max: 65534	No
listener_hold_time_min_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
speaker_hold_time	Integer	min: 1, max: 65534	No
speaker_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_connections	List	[sxp_connections]	No
sxp_default_password	String	min: 1, max: 24	No
sxp_default_password_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_key_chain	String	min: 0, max: 256	No
sxp_key_chain_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_log_binding_changes	Boolean	true, false	No
sxp_log_binding_changes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_reconciliation_period	Integer	min: 0, max: 64000	No
sxp_reconciliation_period_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_retry_period	Integer	min: 0, max: 64000	No
sxp_retry_period_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_source_ip	IP		No
sxp_source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

sxp_connections (sdwan.feature_profiles.other_profiles.trustsec)

Name	Type	Constraint	Mandatory	Default Value
max_hold_time	Integer	min: 0, max: 65535	No
max_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
min_hold_time	Integer	min: 0, max: 65535	No
min_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
mode	Choice	local, peer	No
mode_type	Choice	speaker, listener, both	No
peer_ip	IP		No
peer_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
preshared_key	Choice	password, none, key chain	No
source_ip	IP		No
source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
vpn_id	Integer	min: 0, max: 65527	No
vpn_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: This example demonstrates how to configure a TrustSec feature with the device credentials and SGT enforcement enabled, without SXP.

sdwan:
  feature_profiles:
    other_profiles:
      - name: other1
        trustsec:
          name: trustsec
          description: CTS device enrollment
          device_id: trustsecDevice1
          device_password: password123
          device_sgt: 100
          enable_enforcement: true

Example-2: This example demonstrates how to configure a TrustSec feature with SXP enabled, a default SXP password and two SXP connections. The first connection uses the default password, the second one uses a key chain and acts as a speaker towards a peer in VPN 1.

sdwan:
  feature_profiles:
    other_profiles:
      - name: other2
        trustsec:
          name: trustsec
          description: CTS with SXP
          device_id: trustsecDevice2
          device_password: password123
          device_sgt: 100
          enable_enforcement: true
          enable_sxp: true
          listener_hold_time_min: 90
          listener_hold_time_max: 180
          speaker_hold_time: 120
          sxp_default_password_variable: cts_sxp_password
          sxp_key_chain: key1
          sxp_log_binding_changes: true
          sxp_reconciliation_period: 60
          sxp_retry_period: 30
          sxp_source_ip: 10.0.0.1
          sxp_connections:
            - peer_ip: 10.0.0.2
              source_ip: 10.0.0.1
            - peer_ip: 10.0.1.2
              source_ip: 10.0.1.1
              mode: peer
              mode_type: speaker
              preshared_key: key chain
              min_hold_time: 90
              max_hold_time: 120
              vpn_id: 1