Other TrustSec Feature

Configure Cisco TrustSec (CTS) parameters, including the device enrollment credentials, inline SGT enforcement and SXP peering on WAN Edge routers.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
feature_profiles	Class	feature_profiles	No

feature_profiles (sdwan)

Name	Type	Constraint	Mandatory	Default Value
other_profiles	List	other_profiles	No

other_profiles (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
trustsec	Class	trustsec	No

trustsec (sdwan.feature_profiles.other_profiles)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	No	trustsec
description	String		No
device_id	String	min: 1, max: 32	No
device_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
device_password	String	min: 1, max: 24	No
device_password_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
device_sgt	Integer	min: 2, max: 65519	No
device_sgt_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enable_enforcement	Boolean	true, false	No
enable_enforcement_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enable_sxp	Boolean	true, false	No
listener_hold_time_max	Integer	min: 1, max: 65534	No
listener_hold_time_max_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
listener_hold_time_min	Integer	min: 1, max: 65534	No
listener_hold_time_min_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
speaker_hold_time	Integer	min: 1, max: 65534	No
speaker_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_connections	List	sxp_connections	No
sxp_default_password	String	min: 1, max: 24	No
sxp_default_password_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_key_chain	String	min: 0, max: 256	No
sxp_key_chain_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_log_binding_changes	Boolean	true, false	No
sxp_log_binding_changes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_reconciliation_period	Integer	min: 0, max: 64000	No
sxp_reconciliation_period_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_retry_period	Integer	min: 0, max: 64000	No
sxp_retry_period_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
sxp_source_ip	IP		No
sxp_source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

sxp_connections (sdwan.feature_profiles.other_profiles.trustsec)

Name	Type	Constraint	Mandatory	Default Value
max_hold_time	Integer	min: 0, max: 65535	No
max_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
min_hold_time	Integer	min: 0, max: 65535	No
min_hold_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
mode	Choice	local, peer	No
mode_type	Choice	speaker, listener, both	No
peer_ip	IP		No
peer_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
preshared_key	Choice	password, none, key chain	No
source_ip	IP		No
source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
vpn_id	Integer	min: 0, max: 65527	No
vpn_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: This example demonstrates how to configure a TrustSec feature with the device credentials and SGT enforcement enabled, without SXP.

sdwan:
  feature_profiles:
    other_profiles:
      - name: other1
        trustsec:
          name: trustsec
          description: CTS device enrollment
          device_id: trustsecDevice1
          device_password: password123
          device_sgt: 100
          enable_enforcement: true

Example-2: This example demonstrates how to configure a TrustSec feature with SXP enabled, a default SXP password and two SXP connections. The first connection uses the default password, the second one uses a key chain and acts as a speaker towards a peer in VPN 1.

sdwan:
  feature_profiles:
    other_profiles:
      - name: other2
        trustsec:
          name: trustsec
          description: CTS with SXP
          device_id: trustsecDevice2
          device_password: password123
          device_sgt: 100
          enable_enforcement: true
          enable_sxp: true
          listener_hold_time_min: 90
          listener_hold_time_max: 180
          speaker_hold_time: 120
          sxp_default_password_variable: cts_sxp_password
          sxp_key_chain: key1
          sxp_log_binding_changes: true
          sxp_reconciliation_period: 60
          sxp_retry_period: 30
          sxp_source_ip: 10.0.0.1
          sxp_connections:
            - peer_ip: 10.0.0.2
              source_ip: 10.0.0.1
            - peer_ip: 10.0.1.2
              source_ip: 10.0.1.1
              mode: peer
              mode_type: speaker
              preshared_key: key chain
              min_hold_time: 90
              max_hold_time: 120
              vpn_id: 1