Cisco Catalyst 4500 Series Configuration Manual page 955

Configuring MACsec Encryption
This chapter describes how to configure Media Access Control Security (MACsec) encryption on the
Catalyst 4500 series switch.
Note Although a Catalyst 4500-X series switch (WS-4500X-32) supports Cisco TrustSec technology, it does
not support TrustSec MACsec Encryption.
MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two
MACsec-capable devices. The Catalyst 4500 series switch supports 802.1AE encryption with MACsec
Key Agreement (MKA) on downlink ports for encryption between the switch and host devices. The
switch also supports MACsec link layer switch-to-switch security by using Cisco TrustSec Network
Device Admission Control (NDAC) and the Security Association Protocol (SAP) key exchange. Link
layer security can include both packet authentication between switches and MACsec encryption between
switches (encryption is optional).
MACsec is supported on the Catalyst 4500 series switch universal k9 image. It is not supported with the
Note
NPE license or with a LAN Base service image.
All downlink ports on a switch can run Cisco TrustSec MACsec link layer switch-to-switch security.
Table 1
Interface
User-facing downlink ports
Switchports connected to other
switches
Cisco TrustSec and Cisco SAP are meant only for switch-to-switch links and are not supported on switch
ports connected to end hosts, such as PCs or IP phones. MKA is meant for switch-to-host facing links
and is not supported on switch-to-switch links. Host-facing links typically use flexible authentication
ordering for handling heterogeneous devices with or without IEEE 802.1X, and can optionally use MKA
encryption. Cisco NDAC and SAP are mutually exclusive with Network Edge Access Topology (NEAT),
which is used for compact switches to extend security outside the wiring closet.
• Understanding Media Access Control Security and MACsec Key Agreement, page 43-2
• Configuring MACsec and MKA, page 43-6
OL-25340-01
MACsec Support on Switch Ports
Connections
Switch-to-host
Switch-to-switch
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
43
C H A P T E R
MACsec support
MKA MACsec encryption
Cisco TrustSec NDAC MACsec
43-1