Security Group Tags (SGTs)

Synopsis

netapi ise get-sgts [OPTIONS]
netapi ise get-sgt --name <NAME>
netapi ise create-sgt <NAME> <VALUE> [OPTIONS]
netapi ise update-sgt <NAME> [OPTIONS]
netapi ise delete-sgt <NAME> [OPTIONS]

Description

Manage TrustSec Security Group Tags for micro-segmentation.

Commands

get-sgts

List all Security Group Tags.

netapi ise get-sgts
netapi ise get-sgts --size 50 --page 2
netapi ise get-sgts --format json
Options
--size, -s INTEGER    Results per page (default: 100)
--page, -p INTEGER    Page number (default: 1)

get-sgt

Get specific SGT details.

netapi ise get-sgt --name "Employees"
netapi ise get-sgt --name "IoT_Devices"

create-sgt

Create a new Security Group Tag.

netapi ise create-sgt "Research_Staff" 100
netapi ise create-sgt "Quarantine" 200 --description "Quarantined devices"
netapi ise create-sgt "IoT_Devices" 150 --description "Internet of Things devices"
Arguments
NAME     SGT name
VALUE    SGT numeric value (avoid 0-15: reserved)
Options
--description, -d TEXT    SGT description
Reserved SGT Values
0       Unknown
1       TrustSec_Devices
2-15    Cisco reserved

update-sgt

Update an existing Security Group Tag.

netapi ise update-sgt "Research_Staff" --value 101
netapi ise update-sgt "Research_Staff" --description "Updated description"
netapi ise update-sgt "Research_Staff" --name "Research_Personnel"
Options
--name TEXT               New SGT name
--value, -v INTEGER       New SGT value
--description, -d TEXT    New description

delete-sgt

Delete a Security Group Tag.

netapi ise delete-sgt "Research_Staff"
netapi ise delete-sgt "Research_Staff" --force
Options
--force, -f    Skip confirmation prompt

Sample Output

       Security Group Tags
 name         value   description
 Unknown      0       Default SGT
 Employees    4       Corporate employees
 Contractors  5       External contractors
 IoT_Devices  10      Internet of Things
 Guests       15      Guest network users
 Quarantine   255     Isolated endpoints

Use Cases

Document SGT Matrix

#!/bin/bash
# List all SGTs
netapi ise get-sgts

# For detailed export, use the API directly:
curl -sk "https://${ISE_PAN_IP}:${ISE_PORT}/ers/config/sgt" \
  -H "Authorization: Basic ${ISE_API_TOKEN}" \
  -H "Accept: application/json"

Related Commands