A university with wired TrustSec domains in two campuses wants student and staff SGT tags preserved over the SD-WAN fabric so firewall policy at the data center enforces role-based access. Edges connect to switches carrying SGTs in service VPNs. Which TrustSec SGT propagation method preserves role tags across the fabric?
Select an answer to reveal the explanation.
Short Explanation
Your role badge should stay visible on the shuttle between buildings. Inline SGT propagation stamps the tag into overlay packets for the far side. The data-center firewall then knows exactly who just arrived.
Full Explanation
Cisco SD-WAN supports carrying Security Group Tags received from TrustSec-enabled access switches transparently across the overlay by embedding the SGT in the data-plane encapsulation between WAN Edge routers, preserving the original role identity within the same service VPN so egress Edges and firewalls can enforce SGACLs without reclassification. Mapping each SGT to a separate VPN fails because VPNs provide segmentation, not role identity, and would explode the design while requiring re-tagging, redistributing roles via OMP communities fails because OMP carries routing information and communities influence path selection rather than transporting SGTs in data packets, and sending tags via control connections for DHCP download fails because control connections to the SD-WAN Controller, formerly vSmart, do not deliver endpoint tags and DHCP does not assign SGTs. Exam caveat: SGT propagation rides the data plane, not OMP or controller policy. Practical check: confirm TrustSec and SGT options enabled on Edge service VPN interfaces and verify firewall logs show original SGTs from remote campuses.