Custom SGT conditions

A custom SGT condition is a traffic filtering method that

  • uses manually created SGT objects to filter traffic,

  • does not rely on ISE SGTs obtained from a system's connection to an ISE server, and

  • corresponds to the SGT attributes on the traffic you want to control.

If you do not configure Cisco ISE or ISE-PIC as an identity source, you can control traffic using Security Group Tags (SGTs) that were not assigned by ISE. SGTs specify the privileges of traffic sources within a trusted network.

Controlling traffic using custom SGTs is not considered user control.

The rules that support custom SGT conditions are:

  • Access control

  • QoS