Lab Objective
Configure a switch to download SGT environment data (name-to-number mappings) from a centralized policy server, verify the switch resolves SGT names correctly without any local static definition, and confirm the switch automatically picks up a newly added SGT definition without manual reconfiguration.
Lab Purpose
The SGT labs covered earlier in this series manually configured SGT numbers and their meanings on each switch individually — practical for a lab, but unsustainable across dozens of switches in a real deployment where SGT definitions change over time. Environment Data Download lets every switch pull this information dynamically from a single authoritative source, keeping definitions consistent fabric-wide.
Lab Topology
Switch1 ---- PolicyServer (ISE-equivalent,
authoritative source for SGT
name-to-number mappings)
PolicyServer currently defines:
SGT 10 = Employees
SGT 20 = Guests
SGT 30 = ServersTask 1: Configure Switch1 to Point to the Policy Server
Configure the CTS AAA server pointing to the policy server for authorization and environment data.
Task 2: Trigger an Environment Data Download
Manually trigger a refresh of environment data from the policy server.
Task 3: Verify SGT Names Resolve Correctly
Confirm Switch1 displays human-readable SGT names rather than only numbers, sourced entirely from the policy server rather than local configuration.
Task 4: Add a New SGT Definition on the Policy Server
Add a new SGT (SGT 40 = Contractors) on the policy server, without touching Switch1's configuration at all.
Task 5: Verify Switch1 Automatically Learns the New Definition
Confirm Switch1 eventually resolves SGT 40 to "Contractors" without any local configuration change.
Solution and Verification
Switch1(config)# aaa new-model
Switch1(config)# radius server POLICY-SERVER
Switch1(config-radius-server)# address ipv4 [PolicyServer-address] auth-port 1812 acct-port 1813
Switch1(config-radius-server)# key TrustSecKey2026
Switch1(config)# aaa group server radius CTS-SERVERS
Switch1(config-sg-radius)# server name POLICY-SERVER
Switch1(config)# cts authorization list CTS-SERVERSSwitch1# cts refresh environment-data
-- This explicitly requests updated
-- environment data (SGT name-to-number
-- mappings, among other TrustSec
-- environment settings) from the policy
-- server, rather than waiting for the
-- automatic periodic refresh intervalSwitch1# show cts environment-data
CTS Environment Data
====================
Security Group Table:
0-00:Unknown
2-00:TrustSec_Devices
10-00:Employees
20-00:Guests
30-00:Servers
-- Switch1 resolved all current SGT names
-- entirely from the policy server -- no
-- name-to-number mapping was ever manually
-- typed into Switch1's own configurationPolicyServer> [administrator adds a new
SGT definition: SGT 40 =
Contractors]
-- No configuration change made on Switch1
-- at this point-- After the periodic refresh interval
-- elapses (or another manual refresh):
Switch1# cts refresh environment-data
Switch1# show cts environment-data
CTS Environment Data
====================
Security Group Table:
0-00:Unknown
2-00:TrustSec_Devices
10-00:Employees
20-00:Guests
30-00:Servers
40-00:Contractors
-- The new SGT definition appeared
-- automatically, sourced entirely from the
-- policy server -- Switch1 never required
-- any local awareness of this new group
-- being addedKey Takeaway
Environment Data Download decouples SGT naming and definition management from individual switch configuration entirely — every device in the TrustSec domain resolves the same names from the same authoritative source, meaning a single change on the policy server (adding, renaming, or removing an SGT definition) automatically propagates to every switch without requiring a single command to be typed on any of them, a critical scalability improvement over the fully manual per-switch SGT configuration used in the earlier standalone SGT lab.