A bank's campus core propagates SGTs with inline tagging, and ISE classifies endpoints dynamically during 802.1X authorization. One branch building runs a switch that supports SXP but lacks inline tagging hardware, and it filters traffic by IP address. Which TrustSec design keeps SGT-based policy enforceable in that building?
Select an answer to reveal the explanation.
Short Explanation
Nice call — you lean on SXP as the side channel that carries SGT-to-IP bindings when frames can't carry the tag themselves. It's like sending the guest list by phone instead of printing it on every badge.
Full Explanation
The correct design preserves ISE’s dynamic endpoint classification while using SXP to send SGT-to-IP bindings to the branch switch. Because that switch filters by IP address and cannot insert inline tags, it can use the learned bindings to associate IP traffic with SGT-based policy without requiring frame tagging. Downloadable ACLs are a valid way to apply identity-based access controls to 802.1X sessions, but they enforce ACL rules rather than TrustSec policy based on SGT-to-IP bindings, so they do not meet the SGT-based requirement. Static SGT-to-IP bindings can support IP-based policy on a switch, but assigning them manually replaces ISE’s dynamic classification and can leave bindings stale as endpoints or addresses change. Sending bindings through pxGrid to a local firewall can enable group-aware enforcement there, but it shifts enforcement away from the branch switch, the device specified for this design. Exam caveat: SXP distributes mappings, not tags in frames, and both the SXP peer relationship and the switch’s policy capabilities must support the intended use. Practical check: verify that current endpoint IP-to-SGT bindings appear on the branch switch and that a test flow increments the expected SGT-based policy counter.