Guide
Microsegmentation With Cisco TrustSec: Policy by Group, Not by IP
East-west traffic is where intrusions spread — and where IP-based ACLs strain under their own weight. TrustSec writes policy in groups instead of addresses, and segmentation becomes something humans can read.
Perimeter firewalls answer for north-south traffic. The harder modern question is east-west: once something is inside — a compromised laptop, a vulnerable camera — what can it reach? For years the honest answer was “far too much,” because a common tool for internal segmentation was the IP-based ACL: thousands of lines, addresses nobody can map back to intent, and a change process everyone fears. Cisco TrustSec attacks the root cause. It decouples policy from topology by classifying traffic into security groups and enforcing on group pairs, so the policy reads like the business intent it encodes.
Name the Group, Not the Address
The unit of TrustSec policy is the Security Group Tag (SGT) — a 16-bit value that represents the role of a traffic source: Employee, Contractor, Building-Camera, PCI-Server. Policy becomes a matrix of group pairs, managed centrally in Cisco ISE: Employees reach Corporate-Apps; Cameras reach the video server and nothing else; Contractors reach the systems in their statement of work. Move a server to a new subnet and the policy follows its tag — provided the classification moves with it: a dynamic assignment is re-established when the endpoint authenticates at its new attachment point, while a static IP or subnet mapping must be updated to match. The matrix stays the size of the role structure, not the size of the address plan — which is why group-based policy stays readable and operable in a large, changing network where address-based ACLs grow unmanageable.
The stakes are not abstract. Lateral movement is a common technique in modern intrusions, ransomware campaigns in particular, and internal segmentation constrains how far a foothold can spread — alongside endpoint controls, identity policy, and application authorization, not in place of them. A control this important has to be operable — readable, changeable, auditable — or it decays into exceptions. Well-designed group-based policy stays operable as endpoints and addresses change in ways address-based policy struggles to.
Classification: Where the Tag Is Assigned
A tag has to come from somewhere. The dynamic path runs through ISE: when a user or device authenticates — 802.1X, MAB, or remote-access VPN — the authorization result can carry an SGT along with whatever VLAN or ACL it already assigns. Classification then reflects whatever the authorization policy evaluated — the identity that authenticated and, where the policy references them, device type and posture. The static path commonly covers assets that never authenticate: IP-to-SGT and subnet mappings for servers and legacy zones, VLAN-to-SGT or port-to-SGT where that is the honest granularity. Deployments commonly run both — dynamic at the access edge, static in the data center.
Propagation: Inline Tagging and SXP
Enforcement needs the tag at a device other than the one that assigned it, and in classic TrustSec it travels two ways. (Fabric overlays add a third: Cisco SD-Access carries the SGT in its VXLAN encapsulation.) Between TrustSec-capable devices, inline tagging carries the SGT in a Cisco Meta Data field inserted in the Ethernet frame, link by link, with the data itself. Where the path crosses hardware that cannot carry the tag in the frame, SXP (SGT Exchange Protocol) closes the gap in the control plane: a speaker advertises its IP-to-SGT bindings to a listener over a TCP connection (port 64999), so a downstream enforcement point can map source addresses back to tags without touching the frames. Inline tagging demands TrustSec-capable hardware on both ends of every link that carries it; SXP is the pragmatic half of TrustSec: it lets a brownfield network adopt group-based policy without a forklift, one enforcement point at a time.
Enforcement: SGACLs at Egress
At an enforcement point, the source and destination tags select a cell in the policy matrix, which selects an SGACL — a role-based ACL whose entries filter by protocol and port, not a binary verdict on the pair. The detail worth having straight: on platforms using egress SGACL enforcement — the common switching model — enforcement happens at egress: the enforcement point resolves the destination’s tag from its local and learned bindings and evaluates the matrix as traffic exits the relevant interface. Firewalls participate on their own terms: ASA and FTD can match security groups in their access policies, putting group-based rules at choke points that already inspect east-west boundaries. The failure modes are part of the design. Traffic whose source has no classification or binding is treated as SGT 0 — Unknown — and hits the matrix’s Unknown cells, or the default policy where no cell is configured; lose the only SXP source of a binding and the enforcement point can eventually be left without it, degrading that traffic to Unknown. Deciding what Unknown may reach, and monitoring that classifications and bindings actually exist where enforcement expects them, is where segmentation projects succeed or quietly fail.
Where It Sits on the Certification Path
TrustSec is squarely on the blueprints. SISE 300-715 v1.2 puts it in domain 2, Policy Enforcement (25%), as objective 2.6, “Configure Cisco TrustSec” — the ISE side: groups, the matrix, SXP. SCOR 350-701 v2.0 objective 2.3 names network segmentation using VLANs or SGTs among its infrastructure security methods, and SCAZT 300-740 carries microsegmentation into the workload world in domain 3, Policies (30%), under its Cisco Secure Workload objectives. The SISE course builds the whole chain on real gear — classification, propagation, enforcement, and the failure modes between them — and the first lesson is free.
Frequently Asked Questions
What is a Security Group Tag?
A 16-bit value assigned to traffic at classification time that represents the role of the source — Employee, Contractor, Camera, PCI-Server — independent of its IP address. Enforcement devices then apply policy selected by source and destination tag pair instead of by address pair, so policy follows the role as long as the classification travels with the endpoint.
How do SGTs travel through a network that has non-TrustSec devices?
Two ways. Inline tagging embeds the SGT in a Cisco Meta Data field in the Ethernet frame between capable devices. Where a path segment cannot carry the tag in the frame, SXP — the SGT Exchange Protocol — advertises IP-to-SGT bindings over a TCP connection between a speaker and a listener, so the far enforcement point can still map source addresses back to tags.
Is TrustSec the same as zero trust?
No. TrustSec is one enforcement mechanism that can implement the segmentation piece of a zero-trust architecture on Cisco networks. Zero trust, as NIST SP 800-207 frames it, requires explicit and dynamic authentication and authorization for access, least privilege, and ongoing reassessment — TrustSec consumes classification decisions, typically from ISE, and turns them into which traffic may flow east-west.