A regional bank replaced its campus access switches, while the data-centre access switches run on legacy hardware that lacks TrustSec tagging. Policy requires the Finance SGT to reach the data-centre router so client traffic can be matched by security group on egress. Which SGT propagation method should be used across that segment?
Select an answer to reveal the explanation.
Short Explanation
SXP acts like a courier that carries the address book instead of relabelling every package in transit. With SXP, you provide the data-centre router the IP-to-SGT bindings it needs while the legacy switches stay untouched. Assigning an SGT during authentication does not by itself distribute the binding, and inline tagging requires TrustSec-capable devices along the path.
Full Explanation
Inline tagging carries the SGT in the frame, and the network path must support preserving and using that tag for the intended policy. The data-centre access switches lack TrustSec tagging, so SXP is the appropriate way to provide the router with IP-to-SGT bindings without requiring those switches to tag frames. SXP is a control-plane protocol: peers establish a TCP connection and exchange IP-to-SGT bindings, which lets the router apply security group policy using the mappings it learns. Assigning the Finance SGT through an identity group determines the tag associated with an authenticated session but does not, by itself, deliver the mapping to the router. Per-user dACLs provide session-specific access control rather than the required SGT-based policy. SXP carries mappings rather than user traffic; a password can be configured to authenticate an SXP connection. Verify the connection state and confirm that the router has learned the expected IP-to-SGT entries.