A logistics firm is tagging traffic across its TrustSec data center. The print server VLAN spans three access switches where cables get re-patched regularly among ports configured with different SGTs, DHCP relay stops at the central server so ISE never sees those leases, fabric switches carry SGT tags inline, and the IDS sensor accepts only IP-to-SGT bindings over SXP. Which classification and propagation design fits these constraints?
Select an answer to reveal the explanation.
Short Explanation
You need three tools for three different jobs, like choosing the right adapter for each connection. Since ISE never sees the DHCP leases, use a static mapping to bind the print VLAN’s IP addresses to its SGT; carry tags inline between fabric switches and use SXP to send bindings to the sensor.
Full Explanation
The correct design uses static IP-to-SGT mappings because ISE cannot learn the print servers’ leases through DHCP when the relay stops at the central server. Inline tagging is the required propagation method between the fabric switches, while SXP supplies the IDS sensor with the IP-to-SGT bindings it can consume. DHCP profiling is a standard way to classify endpoints when ISE receives DHCP information, but it fails here because those leases never reach ISE; the other propagation choices do not fix that missing input. Using SXP between the fabric switches is a valid alternative in networks designed for control-plane binding exchange, but it fails the stated requirement that these fabric switches carry SGTs inline; SXP to the sensor remains appropriate. Assigning SGTs to access ports is common for stable, dedicated endpoint connections, but frequent repatching among ports with different SGTs can change the print servers’ classification, so it does not reliably preserve a VLAN-wide identity. Exam caveat: static IP mappings require managing address changes and avoiding stale or duplicate bindings. Practical check: verify ISE’s IP-to-SGT table and confirm that the sensor learns the intended bindings over SXP while fabric links preserve inline tags.