In one embodiment, a method includes generating at a network device, a trace packet comprising an IP (Internet Protocol) to Source Group Tag (SGT) binding, transmitting the trace packet from the network device to an SGT capable device, wherein at least one non-SGT capable device is interposed in a path between the network device and the SGT capable device, and receiving at the network device, a reply packet from the SGT capable device in response to the trace packet, the reply packet indicating that the IP to SGT binding was installed at the SGT capable device. An apparatus and logic are also disclosed herein.