11
Release Notes for the Cisco IE 2000 Switches, Cisco IOS Release 15.2(1)EY
NEW DOC # PENDING
Limitations and Restrictions
Security Group Tag Exchange Protocol for Cisco TrustSec
Cisco Industrial Ethernet switches now can participate in the Cisco TrustSec security architecture by
using the SGT Exchange Protocol (SXP). Cisco TrustSec establishes domains of trusted network
devices. After a device is authenticated, communication is secured by using encryption and other
mechanisms. As packets enter the network, they are classified by security group tags (SGTs) for the
purpose of applying security policies. SXP is used to propagate the SGTs across network devices, such
as the IE switches, that do not have hardware support for Cisco TrustSec.
To use this feature, enable SXP and configure the connections on each device that needs to participate
in SXP exchanges.
•
Enable SXP by entering the
cts sxp enable
command in global configuration mode.
•
Configure each SXP connection by specifying the peer’s IP address, the password, and the role. For
role, you can specify which device is the “speaker” and the “listener” in the exchange.
For detailed information about the configuration commands and show commands, see “SGT Exchange
Protocol over TCP (SXP)” at
http://www.cisco.com/en/US/partner/docs/switches/lan/trustsec/
configuration/guide/sxp_config.html#wp1056896
Limitations and Restrictions
You should review this section before you begin working with the switch. These are known limitations
that will not be fixed, and there is not always a workaround. Some features might not work as
documented, and some features could be affected by recent changes to the switch hardware or software.
Cisco IOS Limitations
•
Ethernet
•
IP
•
QoS
•
RADIUS
•
SPAN and RSPAN
•
Spanning Tree Protocol
•
Trunking
•
VLAN
Ethernet
•
Traffic on EtherChannel ports is not perfectly load-balanced. Egress traffic on EtherChannel ports
are distributed to member ports on load balance configuration and traffic characteristics like MAC
or IP address. More than one traffic stream may map to same member ports based on hashing results
calculated by the ASIC.
If this happens, uneven traffic distribution will happen on EtherChannel ports.
Changing the load balance distribution method or changing the number of ports in the EtherChannel
can resolve this problem. Use any of these workarounds to improve EtherChannel load balancing:
