How is traffic classified when using Cisco TrustSec technology?

While IP addresses are fundamental for network communication, TrustSec provides a more dynamic and identity-driven classification mechanism that decouples access policies from static IP address assignments.

VLANs provide Layer 2 segmentation, but TrustSec's SGTs offer a more granular, identity-based segmentation that transcends traditional VLAN boundaries for policy enforcement.

Cisco TrustSec classifies traffic using Security Group Tags (SGTs), which are identity-based labels assigned to users or devices once they are authenticated and authorized onto the network. These SGTs are carried with the traffic, enabling consistent enforcement of access policies throughout the network regardless of IP address, VLAN, or physical location.

MAC addresses are used for Layer 2 identification, but they do not provide the identity-based classification and policy enforcement capabilities that Security Group Tags offer in a TrustSec environment.