A question for our CP colleagues here regarding R82.20

Vincent_Bacher — Wed, 09 Sep 2026 11:12:36 GMT

Hi mates,

In the new "R82.20 Identity Awareness Administration Guide", I noticed the section on "Support for Cisco Security Group Tags (SGTs)".

The guide states: "An SGT header is 8 bytes that a Cisco switch inserts between the MAC header and the IP header. Cisco servers do not authenticate SGT values."

Cisco, however, states: "Each security group in a Cisco TrustSec domain is assigned a unique 16-bit tag called the Security Group Tag (SGT)."
https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/sgt_inline_tagging.html

Is the CP documentation a bit vague here, or is some information missing on how CP arrives at 8 bytes? (Or does the 8-byte figure refer to the CMD header that carries the 16-bit SGT value?)

I've also raised this with our Check Point contact directly, but perhaps one of the CP colleagues here knows the answer.

Re: A question for our CP colleagues here regarding R82.20

Bob_Zimmerman — Wed, 09 Sep 2026 16:28:53 GMT

Technically, the eight bytes is the Cisco TrustSec header (also commonly called the CMD or Cisco Metadata), which contains the two byte SGT value, yes.

Re: A question for our CP colleagues here regarding R82.20

Vincent_Bacher — Thu, 10 Sep 2026 06:23:30 GMT

Thanks a lot !

topic Re: A question for our CP colleagues here regarding R82.20 in General Topics

A question for our CP colleagues here regarding R82.20

Re: A question for our CP colleagues here regarding R82.20

Re: A question for our CP colleagues here regarding R82.20