A question for our CP colleagues here regarding R82.20

[Vincent_Bacher]

Hi mates,

In the new "R82.20 Identity Awareness Administration Guide", I noticed the section on "Support for Cisco Security Group Tags (SGTs)".

The guide states: "An SGT header is 8 bytes that a Cisco switch inserts between the MAC header and the IP header. Cisco servers do not authenticate SGT values."

Cisco, however, states: "Each security group in a Cisco TrustSec domain is assigned a unique 16-bit tag called the Security Group Tag (SGT)."
https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/sgt_inline_...

Is the CP documentation a bit vague here, or is some information missing on how CP arrives at 8 bytes? (Or does the 8-byte figure refer to the CMD header that carries the 16-bit SGT value?)

I've also raised this with our Check Point contact directly, but perhaps one of the CP colleagues here knows the answer.

[Bob_Zimmerman · Accepted solution]

Technically, the eight bytes is the Cisco TrustSec header (also commonly called the CMD or Cisco Metadata), which contains the two byte SGT value, yes.

[Vincent_Bacher]

Thanks a lot !